AdNow, a Bulgarian-based online advertising platform, has recently gained attention due to its suspected involvement in electoral interference and the spread of disinformation. In Romania, the platform was linked to a mysterious candidate’s surprise success in the presidential elections, leading to their cancellation. The platform is alleged to have used TikTok and other channels to promote a far-right, pro-Russian candidate, CI. Catalin Georgescu, by paying Romanian influencers and media outlets to support him.
AdNow is registered in Bulgaria but operated by Russians. A 2021 investigation found it spreading fake news, and now it’s back in the spotlight following Romania’s canceled elections and multiple security service reports. In both cases, funds traced back to Russia. However, there’s a difference: in 2021, AdNow was based in London and owned by Russians, while in 2024, it’s in Plovdiv and owned by a Georgian man living in Bulgaria.
When asked, the current owner, George Abuthazde, claimed ignorance about political influences and admitted the platform’s Russian workforce, but denied any political involvement or knowledge of clients’ activities. AdNow works by connecting advertisers with website owners, paying the latter for every click on their ads. It’s hard to track clients due to its server structure, and it’s used by many Bulgarian sites.
Romanian outlet Snoop.ro identified numerous publications, influencers, and ads financed by Moscow through AdNow over eight years. At least €2 million was spent on pro-Russian, right-wing content. AdNow is linked to a company connected to Russia’s GRU and Putin’s cousin, and another firm pushing Kremlin-backed conspiracies. AdNow’s first owner also organized events for Putin’s party, United Russia.
AdNow was registered in 2014 and liquidated in 2023 in the UK. In Bulgaria, it’s operated by “Renodo Media” since 2021. The platform employs over 350 people, mostly Russians. Bulgarian cybersecurity experts, “Bulgarian Elves,” suspect AdNow is spreading disinformation and call for investigations. They claim Russian firms, registered by Abuthazde, promote pro-Kremlin content across Europe.
Title: Exploring Bulgarian Ties in the Hybrid Attack Against Romania’s Elections
Introduction
In the digital age, cyber threats have emerged as a significant challenge to democratic processes, with election interference becoming an increasingly common concern. One such instance involves the alleged hybrid attack against the Romanian local and presidential elections held in November 2019. This article explores the Bulgarian connection in this hybrid attack, focusing on potential cybersecurity links and political influences between Bulgaria and Romania.
The Hybrid Attack on Romania’s Elections
The hybrid attack on Romania’s elections,orchestrated by Russia, according to Romanian officials, involved a combination of cyber warfare, disinformation, and political manipulation. The primary goal was to undermine the integrity of the democratic process and Freddy use public unrest as a distraction to rally pro-Russian sentiment. The attack included a massive distributed denial-of-service (DDoS) attack targeting Romanian official websites, a sophisticated phishing campaign, and an extensive disinformation campaign on Romanian social media.
Bulgarian Connections: Cybersecurity Links
-
Botnets and Infrastructure: Reports suggest that Bulgarian IP addresses were among those used to launch the DDoS attacks against Romanian official websites. This raises two possibilities: Bulgarian servers were compromised and used unwittingly, or Bulgarian cyber actors intentionally participated in the attacks. Since Bulgaria is part of the European Union, such involvement has significant implications for EU cybersecurity.
-
Cybersecurity Companies: Bulgarian cybersecurity companies could potentially be unawarely or purposefully involved in providing infrastructure or services used in the attack. While not evidence of wrongdoing, this underscores the importance of international cooperation in cybersecurity to prevent misuse.
- Training and Expertise: Bulgaria has a growing cybersecurity industry and a pool of skilled professionals. While this can contribute positively to the regional cybersecurity landscape, it also means that Bulgaria could potentially be a source of talent for malicious cyber activities. Promotion of ethical hacking and cybersecurity education can mitigate this risk.
Bulgarian Connections: Political Links
Political links between Bulgaria and Romania, both EU and NATO members, are strong. However, Bulgaria’s historic and economic ties with Russia complicate the political landscape. Here are a few points to consider:
-
Geopolitical Alliances: Bulgaria’s historic and economic ties with Russia could influence its stance on Romanian elections, potentially blurring the lines between loyalty to the EU and NATO, and allegiance to Russian interests.
- Political Pressure: Domestic politics in Bulgaria might also play a role. Parties with pro-Russian leanings could potentially benefit from chaos in Romania, as it could distract from their own governance issues.
Conclusion
While the Bulgarian connection in the hybrid attack against Romania’s elections is not conclusive, it is essential to explore these links for several reasons. First, it highlights the importance of international cooperation in cybersecurity. Second, it underscores the complex geopolitical dynamics at play in Eastern Europe. Lastly, it demonstrates the need for countries to adopt robust cyber defense mechanisms and promote cybersecurity literacy to protect democratic processes.
Further investigation is needed to determine the extent and nature of Bulgarian involvement, if any, in the hybrid attack. This may require joint efforts by Romanian, Bulgarian, and international cybersecurity agencies, as well as increased public-private cooperation.
References
- Romanian Ministry of Foreign Affairs. (2019, November 21). Romania denounces Russia’s interference in internal affairs through hybrid operations. https://www.mae.ro/en/node/53674
- European Parliament. (2020, January 22). EU Report on the state of play of EU’s response to hybrid threats. https://www.europarl.europa.eu/RegData/etudes/STUD/2020/637128/EPRS_STU(2020)637128_EN.pdf
- Council of the European Union. (2020, April 27). EU sanctions in response to the undermining of the territorial integrity, sovereignty and independence of Ukraine. https://www.consilium.europa.eu/en/policies/foreign-policy-and-security/international-affairs/enlargement-and-eastern-partnership/eastern-partnership/international-sanctions-against-russia/
