The incident on June 5, 2026, in which four Ukrainian naval drones entered Romanian territorial waters and self-destructed, sparked one of the most aggressive disinformation campaigns in recent months in the Romanian-language information space. Building on a real event and the public’s legitimate concerns regarding security in the Black Sea region, several online voices have constructed a conspiracy theory claiming that Ukraine deliberately attempted to cause a disaster in the Port of Constanța in order to draw Romania and NATO into a direct war with the Russian Federation.
The message was initially shared on various social media platforms and was subsequently amplified by websites and commentators within the “fringe media” ecosystem to promote anti-Western, anti-Ukrainian, or conspiracy-theory positions. At the heart of this narrative lies the claim that the drone discovered in the Port of Constanța did not arrive in the area by accident, but was intended to destroy the oil terminals and cause a catastrophic explosion that would have erased all traces of the operation and prompted NATO to intervene militarily against Russia. At first glance, the story may seem convincing. It contains all the necessary ingredients to generate excitement and go viral: real images, explosions, critical infrastructure, alleged hidden geopolitical interests, and accusations of a cover-up orchestrated by the authorities and the media. However, a careful analysis of the publicly available facts shows that the narrative is built almost exclusively on speculation, assumptions, and arbitrary connections, not on verifiable evidence.
According to official information released by the Romanian Government, the Ministry of National Defense, and the Presidential Administration, on the morning of June 5, a naval drone was observed at Berth 78 in the Port of Constanța. Following inspections conducted by Romanian authorities and contacts established with the Ukrainian side, it was confirmed that Ukraine had lost control of four naval drones involved in a military operation conducted in the Black Sea. One of them reached the port, another self-destructed outside the port, and two exploded out at sea. Romanian authorities immediately implemented security measures, restricted naval traffic, evacuated areas deemed vulnerable, and activated the necessary response procedures to protect the population. There were no casualties as a result of the explosions. Subsequently, President Nicușor Dan and Prime Minister Ilie Bolojan stated that the Ukrainian side had informed Romanian authorities of the loss of control over the drones and the possibility of their self-destruction. According to official explanations, Ukrainian forces lost control of the naval assets as a result of electronic warfare operations conducted by the Russian Federation. Additionally, Romanian authorities specified that the drone that exploded in the port had entered automatic self-destruct mode and was not detonated in a controlled manner by operators.
These elements are essential to understanding how the conspiracy narrative was subsequently constructed. Despite the existence of an official timeline and confirmation that it was not a single drone but four naval vessels that were lost simultaneously, conspiracy theorists selectively highlighted only the elements that supported an alarmist interpretation. Instead of an evidence-based analysis, claims began appearing on websites, forums, and social media that the drone had been deliberately sent toward the oil terminals in Constanța, that Ukrainian operators had tracked its movement in real time, and that the self-destruction had been carried out to destroy evidence that would have demonstrated the existence of a plan to attack Romania. And now, let’s analyze the data from the Romanian-language information space.
From the naval incident to online conspiracy theories
An analysis of the dataset collected via Meltwater confirms that the conspiracy theory surrounding the naval drone in the Port of Constanța did not remain a fringe phenomenon, but instead quickly spread across both social media and various online websites. The Boolean query was designed to identify not just any mention of the incident, but those instances that explicitly link the drone case to the central elements of the disinformation narrative: “controlled detonation,” “destruction of electronics,” “destruction of evidence,” “ammonium nitrate,” “oil terminal,” “half of Constanța,” “invocation of Article 5,” “Romania dragged into war,” “the drone was Russian,” “Ukrainian provocation,” or “false flag operation.”
During the period analyzed, June 5–12, 2026, Meltwater identified 156 relevant mentions. The temporal distribution shows a strong concentration on the day of the incident: on June 5, 80 mentions were recorded, accounting for more than half of the total monitored conversation. The following day, the volume dropped to 23 mentions, after which the discussion remained at a lower but steady level, with 11–13 daily mentions between June 7 and 9 and a slight rebound on June 12. This trend indicates a classic pattern of informational exploitation of a crisis event: an immediate peak at the time of the incident, followed by a phase of reinterpretation and consolidation of conspiracy theories.
The graph shows that more than half of the entire conversation took place on a single day. This is significant because it indicates that the struggle to define the meaning of the incident unfolded almost exclusively during the first 24 hours, when official information was still incomplete and the public was more susceptible to speculative interpretations.
In terms of distribution channels, online media was the primary platform for the narrative’s circulation, accounting for 110 mentions out of a total of 156. Social media, however, played a disproportionately large role in generating engagement (the total number of interactions with the content) for those sources. Platform X recorded 31 mentions but generated 626 interactions, accounting for over 60% of all measured reactions. In comparison, online media, although it generated the most mentions, produced only 304 interactions. Facebook had 12 mentions and 82 interactions. This distribution suggests that social media, particularly X, functioned as a space for narrative radicalization and for testing the conspiracy framework, while online media contributed to expanding the topic’s visibility.
The conversation had a high potential impact. The estimated total reach for the identified mentions exceeded 78.9 million, with a major peak on June 5, when the estimated reach was approximately 43.9 million. On June 6, the reach remained significant, at approximately 14.8 million, indicating that the topic continued to be picked up and shared after the initial phase of the incident. Even though these figures should be interpreted as indicators of potential exposure, not actual audience, they point to rapid and widespread circulation of the narrative. Thus, the most active editorial sources were Replica and ActiveNews, each with 8 mentions. ActiveNews’s presence in the top rankings is significant because the platform played a clear role in providing editorial legitimacy to the conspiracy theories previously circulating on social media.
In practice, it was not the number of posts that made the difference, but rather the ability of certain actors to generate reach and amplification. As a result, a relatively small number of messages reached a very wide audience, which is one of the key characteristics of contemporary information operations.
This graph is important because it shows that the narrative’s impact far exceeded the scope of the initial conversation. In essence, a few hours of intense activity generated the bulk of the public exposure.
At the same time, I should note that the presence of mainstream publications in the dataset does not automatically mean that they promoted the false narrative; in many cases, the mentions come from reports on the incident, from reprints of official statements, or from articles discussing the risks and controversies surrounding the explosion. The most frequently detected terms confirm the narrative’s core theme. The term “oil terminal” appears in 62 mentions, “ammonium nitrate” in 59, “Ukrainian drone” in 16, “naval drone” in 14, “controlled detonation” in 13, “half of Constanța” in 10, and phrases such as “false flag operation” and “Romania at war” appear 8 times each. These data show that the discussion was not limited to describing the incident, but was repeatedly framed through a vocabulary of catastrophe, conspiracy, and military escalation.
The content with the highest engagement comes mainly from X. The account Doar RoMânia (@Doar_Romania) It appears three times among the most shared or engaging posts, with messages linking the incident to scenarios involving the oil terminal, ammonium nitrate, Russian sabotage, or Ukraine’s responsibility. The most engaging post identified in the Meltwater dataset garnered 433 interactions, significantly surpassing online news articles. This confirms the role of social media accounts in shaping the emotional and viral narrative before it is picked up or contextualized by websites.
The graph clearly illustrates the difference between volume and influence. Although online media publishes more content, the emotional impact and ability to mobilize are concentrated in social media.
A particularly relevant factor in assessing this phenomenon is the structure of posts on X. The data show that approximately 84% of the activity consisted of reposts, while less than 10% was original content. This suggests that most users did not contribute their own interpretations but acted as multipliers of messages formulated by a limited number of actors. This pattern is frequently encountered in influence campaigns. A few accounts generate the interpretive framework, and the rest of the community amplifies it through redistribution. Consequently, the success of a narrative does not depend on the number of authors, but on the efficiency of the dissemination network.
An analysis of the content with the highest engagement and the dominant keywords shows that the narrative’s success was built around disaster scenarios. Terms such as “oil terminal,” “ammonium nitrate,” “explosion,” “NATO,” “war,” or “half of Constanța” appear repeatedly in both viral posts and the dominant vocabulary of the conversation. This lexical selection is not random. It aims to trigger strong emotional associations. References to ammonium nitrate immediately evoke the 2020 Beirut explosion, while references to NATO’s Article 5 and “Romania dragged into war” transform a local incident into a purported event with global implications. More importantly, the most successful posts are not those that offer new information, but those that paint the most dramatic scenarios. Thus, platform algorithms reward content that maximizes emotion rather than accuracy.
The dataset also reveals a significant difference between visibility and mobilization. Although online media generated the bulk of the volume and reach, the highest level of engagement came from social media. This indicates a hybrid dissemination mechanism: websites provide volume, archiving, and the appearance of editorial legitimacy, while social media accounts provide emotional charge, radical rhetoric, and distribution within communities already receptive to anti-Ukrainian or anti-NATO messages. Overall, the Meltwater data supports the conclusion that the incident at the Port of Constanța was exploited for propaganda purposes through a well-defined narrative framework. We are not dealing merely with spontaneous reactions to a dangerous event, but with a convergence of several recurring themes: Ukraine as an irresponsible actor, NATO as an organization that would push Romania toward war, the Romanian authorities as actors who would hide the truth, and the mainstream media as a mechanism of “omertà.” This combination transforms a security incident into a tool for political and emotional influence.
The data also indicates that the narrative was built around keywords with high viral potential: “ammonium nitrate,” “oil terminal,” “half of Constanța,” “Article 5,” and “Romania at war.” These phrases serve not only a descriptive function but also trigger images of catastrophe. They suggest that Romania was on the brink of a historic tragedy, and that this alleged tragedy was deliberately concealed by the authorities and the media. It is precisely this shift from verifiable facts to an apocalyptic scenario that constitutes the central mechanism of the disinformation campaign. Consequently, the Meltwater analysis confirms that the narrative about “the drone that was supposed to drag Romania into war” functioned as an operation to amplify fear and mistrust. It exploited a real incident, selected the most sensational elements, linked them to existing conspiracy theories, and redistributed them through a mixed ecosystem of social media accounts, fringe websites, online publications, and news aggregators. The likely goal was not merely to inform the public about a security risk, but to reframe the incident in an anti-Ukrainian, anti-NATO, and anti-Western light.
The Russian-language information ecosystem: from an operational incident to “Ukraine’s attack on NATO”
An analysis of the Russian-language dataset collected by Meltwater reveals dynamics that differ somewhat from those observed in the Romanian information space. While in Romania the conspiracy narrative was constructed primarily through influencers, commentators, and alternative websites that subsequently reinterpreted the incident, in the Russian space we observe the reverse process: the narrative was formulated from the outset by publications and media platforms affiliated with or close to the pro-Kremlin information ecosystem, and was then redistributed and adapted into other linguistic spaces. The data shows that between June 5 and 10, 68 relevant mentions were identified, with an estimated reach of approximately 485 million impressions. Although the total volume is lower than in the case of monitoring in Romanian, the capacity for dissemination is significantly greater. This is explained by the fact that the sources involved are Russian publications with very large audiences and considerable regional and international distribution capacity.
The graph highlights the fact that nearly all coverage of the narrative is concentrated between June 5 and 7. Unlike in Romania, where the conversation continued to circulate even after public interest had waned, in Russia we observe an information operation that is much more concentrated in time. Essentially, the narrative is aggressively launched in the first 72 hours, after which media interest drops rapidly once the main message has already been conveyed. This difference suggests that the primary objective was not to sustain a long-term public debate, but rather to rapidly impose an interpretation of the incident that was favorable to the Kremlin.
The most prominent publications identified in the dataset are Военное обозрение (Voennoye Obozrenie), Аргументы и факты (Argumenty i Fakty), SpravkaRF24, Информационное агентство (Informatzionnoe agenstvo) and other similar platforms. All of these promote variations on the same central idea: that Ukrainian naval drones are not merely military assets lost during operations in the Black Sea, but rather instruments deliberately deployed against targets located on NATO territory.
This distribution is significant because it shows that the dominant sources are not obscure blogs or individual accounts, but rather publications that already enjoy a certain degree of legitimacy within the Russian information ecosystem. Consequently, from the very beginning, the narrative takes on the appearance of a journalistic interpretation rather than a mere conspiracy theory.
The content with the highest engagement confirms this trend. One of the most popular articles published by Argumenty i Fakty claims there is a “secret thread” that allegedly proves Ukraine’s involvement and suggests that the drone found near Constanța is evidence of Kiev’s hostile intentions. Another article published by Voennoye Obozrenie claims that Ukraine is attempting to draw European countries into a military escalation and suggests that Western coordination is behind the naval operations taking place in the Black Sea. The article published by Vzglyad, which explicitly refers to “the launch of attacks on NATO ports.”
Thus, the chart above shows that the most widely shared posts are precisely those that shift the discussion from the specific incident to its geopolitical implications. It is not the drone explosion itself that generates public interest, but its reinterpretation as evidence of a direct confrontation between Ukraine and NATO.
The thematic analysis provided by Meltwater confirms that Russian discourse is dominated by military and geopolitical vocabulary. The cloud of entities and keywords is dominated by terms such as НАТО (NATO), ВСУ (Armed Forces of Ukraine), Минобороны (Ministry of Defense), военный эксперт (military expert), Киев (Kyiv), Зеленский (Zelensky), Румыния (Romania), and Констанца (Constanța). In practice, the incident is framed almost exclusively in the context of war and international security.
This lexical structure is significant because it highlights one of the central objectives of Russian propaganda: shifting responsibility for the risks posed by the conflict from the Russian Federation to Ukraine and its Western allies. Instead of the incident being interpreted as an indirect consequence of the war launched by Moscow against Ukraine, it is presented as proof that Kyiv is the primary source of regional instability. We thus observe a recurring mechanism in pro-Kremlin strategic communication. Russia is almost completely removed from the role of a responsible actor, and public attention is redirected toward alleged Ukrainian provocations and NATO’s inability to control the situation.
One of the most interesting differences compared to the Romanian information space is the distribution of sentiment. While the conversation in Romanian was mixed, with approximately 61% neutral mentions and 39% negative, in the Russian space nearly the entire conversation is classified as negative. Meltwater data indicates that 98.5% of mentions fell into the negative category, and only 1.5% were considered neutral.
This distribution is not surprising. It reflects the fact that the primary objective of the media coverage was not to inform the public about the incident, but to use it as a tool to criticize Ukraine, NATO, and the West. Consequently, nearly every article identified contains assessments, accusations, or interpretations that contribute to the construction of a threatening image of Kyiv.
Instead of conclusions
Perhaps the most important conclusion of the analysis is that the incident in the Port of Constanța was very quickly incorporated into a strategic narrative that already existed in pro-Kremlin discourse. We do not observe the emergence of a new theme, but rather the adaptation of an older one: that Ukraine is constantly trying to provoke the expansion of the war and draw NATO into a direct confrontation with the Russian Federation. In this sense, the Constanța case serves as an almost ideal case study for Russian propaganda. There is a real incident, there are authentic images, and there is an inevitable degree of uncertainty in the first hours after the event occurred. All these elements allow for the construction of a story that appears credible at first glance, but which is in reality based on speculation and the attribution of intentions for which no evidence is presented. A comparative analysis of the Romanian and Russian datasets suggests the existence of a narrative transfer process. The main themes subsequently identified in posts on social media and various fringe websites with a propaganda agenda first appear in the Russian media ecosystem: the idea that the drone was targeting critical infrastructure in Constanța, the theory that Ukraine had attempted to provoke a major incident on NATO territory, and the claim that the entire operation was aimed at escalating the conflict. The comparative graph highlights the fact that the peak of the conversation was recorded in both information ecosystems on June 5, immediately after the incident occurred.
However, the Russian-language information space generated a significantly higher volume of mentions (80 versus 29), suggesting a rapid and coordinated mobilization of pro-Kremlin sources to promote an interpretation favorable to Moscow. After the initial peak, conversation declined in both spaces, though the Romanian ecosystem maintained more consistent activity in the following days. The cumulative trend confirms that most mentions were concentrated between June 5 and 7, supporting the hypothesis of a rapid narrative transfer between the Russian and Romanian media ecosystems. Thus, the incident became a vehicle for spreading converging themes regarding Ukraine, NATO, and Romania’s security. The difference is that in the Russian sphere these claims are presented as geopolitical analyses, while in the Romanian sphere they are rephrased as conspiracy theories and accusations of a cover-up.
Overall, Meltwater data indicates that the incident on June 5 was exploited simultaneously in two different but complementary information ecosystems. In the Russian information space, the main objective was to reinforce the image of Ukraine as a dangerous and unpredictable actor. In the Romanian space, the same narrative was adapted to fuel distrust in Ukraine, NATO, and Romanian state institutions. This narrative convergence is one of the most important indications that we are not dealing merely with spontaneous reactions to a security incident, but with a process of propagating and adapting informational themes already established within the pro-Kremlin ecosystem.
—
By Dr. Nicolae Țîbrigan, coordinating expert Digital Forensic Team, in collaboration with A4E Counter Disinformation Network (CDN)
