How Coordinated Disinformation Networks Are Attacking European Democracy

The assault on European elections is no longer the work of crude propaganda. It is industrialized, AI-powered, and state-linked. Over the past two years, a succession of investigations by European intelligence agencies, independent researchers, and digital watchdogs has pulled back the curtain on a sophisticated ecosystem of fake political scandals, cloned news sites, deepfake videos, and bot-amplified smear campaigns targeting voters across the continent.

The European media landscape is facing sustained and evolving threats from information manipulation and foreign interference, a trend that has intensified since Russia's annexation of Crimea in 2014. A 2022 European Parliament report identified Russia and China as primary actors targeting EU institutions, often through disinformation, covert political financing, infrastructure control, and espionage. These hybrid tactics now represent a critical challenge to national sovereignty, democratic integrity, and security.

According to the Eurobarometer, 81% of EU citizens agree that news or information that misrepresents reality or is false is a problem for democracy. The numbers reflect a public that has already noticed something is broken. The investigations documented here show precisely what is breaking it.

The Networks Behind the Fake News: Doppelganger, Portal Kombat, and Storm-1516

Three major disinformation operations, each methodically documented and exposed, stand out as the primary infrastructure of election interference in Europe.

The Doppelganger operation is the most architecturally sophisticated. The DoppelGanger campaign is an ongoing influence operation starting from May 2022 and attributed to the Structura National Technologies and the Social Design Agency, two Russian entities. The primary goal of DoppelGanger is to diminish support for Ukraine in the wake of Russian aggression and to foster divisions within nations backing Ukraine. It targets audiences in France, Germany, Ukraine, and the United States, but also in the United Kingdom, Lithuania, Switzerland, Slovakia, Israel, and Italy. The campaign is supported by a network with two categories of news websites: typosquatted legitimate media outlets and independent news websites.

An investigation by the German nonprofit Correctiv traced an IP address used in the operation to an employee at Russia's Ministry of Defense Main Communications Directorate, further linking the campaign to Voentelecom, a telecom operator associated with Russia's military. In September 2024, the U.S. Justice Department shut down several campaign websites, seizing 32 internet domains disseminating Kremlin propaganda, including content designed to influence the 2024 U.S. presidential election.

Portal Kombat targeted European elections through a different mechanism. France's VIGINUM agency publicly revealed the discovery of the pro-Russian propaganda network called Portal Kombat and highlighted the major role played by a Crimea-based Russian company, TigerWeb, in the creation and administration of the network's sites. TigerWeb is a web development company whose founder has been developing and maintaining websites since at least 2013.

The Russian "Pravda" website ecosystem, previously known as Portal Kombat, significantly expanded in 2024 and broadened its reach across Europe, Africa, and Asia, repurposing hundreds of automated news portals to spread pro-Kremlin content. New domains targeted countries ranging from the U.S. to African nations and New Zealand.

The Storm-1516 operation brought AI-generated content directly into national election campaigns. The German parliamentary elections in early 2025 provide a troubling example. The Storm-1516 operation, linked to Russian influence efforts, used AI to create over 100 fake websites. These platforms pushed deepfakes and fabricated stories targeting political figures like Annalena Baerbock, Robert Habeck, and Marcus Faber, then amplified the content through influencer networks. Other widely circulated falsehoods included fabricated stories about Germany mobilizing troops in Eastern Europe and signing large-scale migration deals with Kenya, showcasing how AI tools now enhance both the reach and credibility of malign campaigns.

Romania: The First European Country to Cancel an Election Over Disinformation

The most consequential documented case of election interference in European history unfolded in Romania in November 2024.

Romanian investigators revealed that far-right and pro-Russian candidate Calin Georgescu, who allegedly conducted his campaign without funding, received undeclared political endorsements worth over 1 million euros funneled through TikTok. European Commission President Ursula von der Leyen responded: "We must protect our democracies from any kind of foreign interference."

Documents declassified by Romanian President Klaus Iohannis revealed that 797 of nearly 25,000 unusually active TikTok accounts supporting the presidential candidate were created as far back as 2016 but remained dormant until weeks before the November 2024 election. According to Romania's intelligence agency, the SRI, these accounts were likely part of a coordinated effort by foreign state actors.

Romania became the first EU country to cancel an election over foreign interference, following reports about information manipulation on TikTok.

The institutional response was swift but, critics argue, insufficient. The European Commission opened formal proceedings against TikTok for a suspected breach of the Digital Services Act in relation to TikTok's obligation to properly assess and mitigate systemic risks linked to election integrity, focusing on TikTok's recommender systems and its policies on political advertisements and paid-for political content.

As late as January 2026, the European Commission confirmed that TikTok investigations remained ongoing, with the Commission still collecting facts and data. Romanian MEPs warned that the Commission's slowness of reaction is "a danger to democracy," noting that "we need rapid response mechanisms, not post-factum findings."

Far-Right Parties and Unlabelled AI Content

State-sponsored operations are not the only source of electoral manipulation. Domestic political actors have also used AI tools to gain an advantage.

In the run-up to the 2024 European Parliament elections, several far-right political parties in France, Italy, and Belgium used unlabelled generative AI content to influence voters despite having pledged to respect ethical campaigning. Many of those lawmakers now hold positions on committees directly responsible for shaping the EU's response to disinformation, digital regulation, and artificial intelligence, including LIBE, IMCO, and the parliament's new Democracy Shield committee.

The scale of deepfake incidents across elections globally is also accelerating. Among the 87 countries with elections since 2023, 33 have seen deepfake-related cases. Even though there is not yet clear evidence that any one EU election result was decisively changed by a deepfake, the psychological impact is real: people may doubt everything or trust nothing, and that shifts how democracy works.

EU Legal Frameworks and the Enforcement Gap

What the Digital Services Act Requires

Under the Digital Services Act, large online platforms like Facebook and TikTok must identify and label manipulated audio and imagery, including deepfakes. The EU's AI Act also establishes a comprehensive legal framework for AI, including transparency requirements for deepfake creators and distributors, prohibitions on harmful deepfakes, and risk assessments for high-risk AI uses.

Where the Enforcement Falls Short

Key gaps in the current enforcement reality include:

• Research using AI models to classify posts from 2023 and 2024 found no overall decline in harmful content following the DSA's implementation, despite some platform-level improvements.
• The European Digital Media Observatory's assessment revealed uneven and partial compliance, with Meta and Microsoft continuing to lag behind in transparency and impact measurement.
• France's Foreign Ministry confirmed that Storm-1516 launched 77 Russian disinformation campaigns since 2023, with operations cloning reputable outlets, scraping articles, rewriting or translating them, and republishing to build credibility.
• For journalists, verification now extends beyond traditional sources. Image and audio authentication, digital footprint tracing, and AI-detection literacy must become core newsroom competencies.

The structural problem is that the very legislators responsible for closing these regulatory gaps were, in some cases, beneficiaries of the same tactics. The disconnect is clear when lawmakers elected through tactics the EU itself describes as dangerous to electoral integrity are shaping the very rules intended to prevent those abuses.