Following the publication of the preliminary report of the US House of Representatives Judiciary Committee, which rejects the existence of conclusive evidence of Russian interference in the 2024 Romanian presidential elections and instead accuses the European Union of interference through mechanisms to combat disinformation, a rapid wave of converging narratives appeared online. These presented the report as official validation of anti-EU arguments and were used to delegitimize both European institutions and Romanian authorities, particularly through discursive frames such as "EU censorship," "coup d'état," "election cancellation," and "Romania pushed into war." Although the American document is a report drafted by the technical staff of the commission, without any final legal or political value, it had been instrumentalized as an external authority in a classic process of false legitimization.
The Digital Forensic Team sought to determine whether the spread of these narratives was predominantly organic or whether there were consistent indications of coordinated amplification and possible forms of Coordinated Inauthentic Behavior , using network analysis, content similarity, and co-distribution of media sources.
Methodology and approach
The analysis was based on several data sets from OSINT monitoring, Google dorking, Junkipedia, and Meltwater, covering posts in Romanian, English, and Russian, distributed mainly on platform X, but also on VK, Russian-language media sites, and various aggregators between February 1 and 7, 2026. Several types of graphs were constructed successively to understand both the structure of the network and the specific mechanisms connecting the actors.
To avoid analytical overload, this assessment focuses only on those graphs and tables that provide clear indications of temporal dynamics, distribution structure, and the nature of relationships between actors. In particular, we analyzed the evolution of engagement and mentions over time, distribution by source type and post type, aggregate reach, sentiment structure, etc. These elements allow for a coherent interpretation of how narratives were activated and propagated.
Results of the analysis of Russian language sources
A combined analysis of Meltwater data and the corpus of Russian-language sources monitored by Junkipedia shows that the media reaction to the preliminary report of the House Judiciary Committee is not simply a journalistic reflection of an external political event, but part of a recurring narrative pattern in the pro-Kremlin information ecosystem. The activation of Russian-language sources is concentrated in time and discourse, with an obvious synchronization between the publication of pseudo-editorial articles and their amplification on social platforms, especially on X. This type of rapid mobilization, followed by a sharp decline in volume, indicates an operationalization of the subject as an opportunistic narrative vector, rather than a topic of autonomous editorial interest. The engagement graph shows a sharp increase on February 4 and 5, with a jump of over 14,000% compared to the previous period, given that the baseline was almost zero. This increase is not evenly distributed across all types of sources, but is dominated by platform X and Russian-language online publications, suggesting synchronization between pseudo-editorial publishing channels and social amplification networks. High engagement is concentrated around a small number of pieces of content, indicating a narrative "push" strategy rather than a diversity of independent editorial approaches.
Junkipedia's analysis identified the main recurring narratives propagated by Russian-language sources. The first and most dominant is the narrative of "the EU as a censorship apparatus," in which the Digital Services Act is presented not as a regulatory framework, but as a repressive tool used to suppress legitimate political discourse. In this context, the American report is used as external evidence of an alleged European "liberal dictatorship," and the European Commission is described as a central player in a so-called "transnational conspiracy" against the sovereignty of member states. A second major narrative identified is that of "election cancellation as a coup d'état," applied specifically to Romania. Pro-Kremlin sources use emotionally charged and legally distorted language to suggest that the electoral process was canceled not for procedural or security reasons, but to block a candidate "undesirable to the West" from gaining power. This narrative is often linked to broader conspiracy themes, such as elite control, the subordination of Eastern European states, and the manipulation of democratic institutions by Brussels and Washington.
The top editorial sources identified by Meltwater confirm the Kremlin's amplification strategy on this topic. Publications such as EADaily, Rss.plus, Дзeн, РИА Новости, Gazeta.ru, and Комсомольская Правда consistently appear at the top of the mentions, even though they would not normally have a direct or consistent editorial interest in Romania's internal electoral processes or the legal architecture of the European Union. Their repeated presence indicates that the topic is treated as a strategic vector, not as marginal news. In particular, EADaily stands out as a central redistribution hub, with several different articles using the same general narrative framework, thematically adapted to keep the topic in circulation.
The total reach graph for Russian-language sources highlights a dynamic typical of coordinated narrative activations: an almost negligible level of visibility before the trigger moment, followed by an explosive increase in an extremely short period of time. The jump to over 1.2 billion reach, concentrated almost entirely on February 4, indicates not an organic accumulation of interest, but the simultaneous activation of sources with large audiences and associated amplification networks. The rapid decline in the following days confirms the one-off nature of the operation, specific to reactive campaigns that seek to maximize immediate impact rather than sustain public debate. This form of "single peak" suggests the deliberate use of media and social infrastructure to quickly impose a narrative, after which the topic is abandoned or replaced with a new information vector.
The geographical distribution of mentions, with Russia clearly in first place, followed at a considerable distance by the Republic of Moldova and other countries in the region, indicates a predominantly external interest in Romania and Europe. This geographical concentration correlates with the high frequency of entities and keywords such as "Конгресс США" (US Congress), "Еврокомиссия" (European Commission), "Румыния" (Romania), Кэлин Джорджеску (Călin Georgescu), "Молдова" (Moldova), "ДСА" (DSA), and "цензура" (censorship), which are used to construct a coherent narrative about an alleged Western institutional conspiracy. Notably, Russia is presented simultaneously as an external observer and an implicitly exonerated actor, a classic technique for reframing responsibility.
Sentiment analysis shows an almost perfect balance between negative and neutral content, with a low percentage of positive content. This distribution does not indicate genuine debate, but rather a strategy of normalizing criticism by packaging hostile messages in pseudo-informational language. News and X sources account for most of the negative sentiment, while forums and comments play a secondary role, suggesting that the narrative is imposed from the top down, rather than generated through grassroots interactions.
Overall, the integration of Meltwater data with Junkipedia analysis shows that Russian-language sources function as a strategic layer for initiating, structuring, and legitimizing narratives. They establish the interpretive framework, provide discursive landmarks, and offer the "material" that is subsequently amplified and adapted on Western social platforms. This pattern confirms the existence of coordinated amplification based on the reuse of the same narrative frameworks and media artifacts, and supports the conclusion that the online reaction to the US report is part of a broader hostile information ecosystem aimed at delegitimizing the European Union and democratic processes in the region.
Below is a table of sources that distributed content in Russian and show indicators compatible with CIB, based on data from Junkipedia and Meltwater.
| Handle (original) | Platform | Key CIB indicators observed |
| @latinian0 | X | Massive reposting, identical links (eadaily/ru), disproportionate engagement, temporal synchronization |
| @eadailycom | X | Role as editorial hub, intensive reuse of links, coordinated amplification |
| @rianru | X | State source, narrative core, simultaneous pickups by amplifiers |
| @gazetaru | X | Synchronized distribution, identical framing, correlation with other pro-Kremlin sources |
| @kp_ru | X | Secondary amplification, reuse of titles/images |
| @news_events_incidents_0212 | X | Aggregator account, high volume on short windows, lack of original content |
| @kompromat_info | X | Repetitive reposts, recurring anti-EU/election themes |
| @antimafia_io | X | Amplification of narratives, dense links to other similar accounts |
| @sovokdenov | X | Repost + identical links, occasional activation |
| @sputnik_rus | X | Affiliated source, coordinated narrative dissemination |
| @riafanru | X | Synchronized distribution, image reuse |
| @tass_agency | X | State source, chain of amplifier pickups |
| @pravda_ru | X | Narrative repetition, cross-posting |
| @regnum_ru | X | Temporal correlation, common links |
| @smotri_media | X | Rapid amplification, lack of organic dialogue |
| @politnavigator | X | Emotional framing, reuse of headlines |
Note: The presence of these sources in the table indicates analytical signals, not a definitive attribution. CIB confirmation requires additional validation (timing fin, image hashes, repost velocity, cross-platform correlation).
The final versions of the Russian-language networks reveal a clearly uneven structure. Although most authors in the dataset are isolated and have no significant links to other actors, there are several compact, well-defined groups within which actors are densely connected through the reuse of the same media artifacts. These clusters are characterized by very high internal connectivity, while links between clusters are few and weak, indicating the existence of distinct amplification cells rather than a broad organic conversation.
In particular, the identical reuse of the same images, combined with the distribution of the same outbound links, appears to be a central coordination mechanism in the densest clusters. This type of behavior is rarely encountered in organic distribution and is significantly more relevant to CIB analysis than simply sharing common domains. The fact that the same combinations of images and links are used repeatedly by small groups of authors within a relatively short time frame suggests the existence of content packages that are prepared and distributed in a coordinated manner.
Fitting into the DISARM Framework – Disinformation TTPs
Analysis of Russian language sources through the lens of DISARM Framework indicates that the observed activity cannot be interpreted as a simple media reaction or a spontaneous aggregation of opinions, but rather as a structured information influence campaign with recurring objectives, means, and procedures. Among the multiple tactics identified, four key TTPs stand out in terms of frequency, impact, and strategic relevance.
The construction and promotion of recurring narrative frameworks that delegitimize the EU, electoral processes, and authorities in Romania and the Republic of Moldova, presented as being controlled from outside.
Coordinated activation of networks immediately after triggering events, visible through sudden increases in mentions, reach, and engagement in a very short period of time.
Flooding the information space with large volumes of similar posts (reposts, identical links) to create the impression of consensus and reduce the visibility of legitimate sources.
Keeping narratives active through repeated repetition and persistent redistribution, even after initial interest has waned, with the aim of eroding public trust in the long term.
Preliminary conclusions
Overall, the data analyzed indicates that the preliminary report of the US House of Representatives Judiciary Committee functioned more as a narrative pretext than as an authentic source of clarification for public debate. The way in which the document was taken up, reinterpreted, and amplified online shows a clear gap between the actual content of the report and the meaning attributed to it in the information space. The dominant narratives did not seek to inform, but rather to reframe the event in an emotional and conspiratorial register, aimed at undermining trust in the European Union and democratic institutions in Romania. Network analyses, temporal dynamics, and the coordinated reuse of media artifacts suggest that this propagation was not predominantly organic, but benefited from coordinated amplification mechanisms compatible with patterns of coordinated inauthentic behavior. In this context, the American report was instrumentalized as an "external authority" in a classic strategy of false legitimization, integrated into a broader hostile information ecosystem geared toward polarization, institutional delegitimization, and the exploitation of discursive vulnerabilities existing in the Romanian and European public sphere.
(Part II of this analysis will be published shortly.)
—
By Dr. Nicolae Țîbrigan, coordinating expert Digital Forensic Team, in collaboration with A4E Counter Disinformation Network (CDN)
