Between July 24 and 27, 2026, the incursion and the downing of Russian drones into Romanian airspace led not only to a military and diplomatic response, but also a wave of messages intended to sow distrust, fear, and confusion. In the Russian-language information space, the incidents were denied, reinterpreted, or used to ridicule Romania’s and NATO’s ability to defend their national territory. At the same time, a false story circulated on social media in Romania according to which the drones reportedly entered the country with the president's approval.
To understand how these incidents were exploited for information purposes, the Digital Forensic Team analyzed 4,635 results collected using the Meltwater platform between July 24 and August 3, 2026. After manually and automatically filtering out noise, 2,019 items directly related to the topic of drone shoot-downs in Romania remained. Of these, 119 included at least one piece of propaganda, and 44 either directly promoted it or presented it in a manipulative editorial context.
At the same time, the analysis also shows that the main propaganda message promoted on Russian-language channels was not limited to denying the Russian origin of the drones. Much more widespread was the attempt to portray Romanian and allied air defense systems along NATO’s eastern border as costly, ineffective, or even ridiculous. Specifically, the dominant message of Russian propaganda emphasized the excessive cost of the missiles used to shoot down inexpensive drones, the insufficient number of pilots, the existence of alleged “misses” of targets, and a NATO described as absent and inept on its eastern flank. At the same time, the data also indicates a repetitive and synchronized distribution of nearly identical texts, although these elements, when taken separately, do not prove the existence of any coordinated campaign of the type CIB.
High numbers don't necessarily mean a campaign
The initial dataset contained 4,635 results. Of these, only 2,019 were actually related to the incidents, official responses, or the discussion regarding the defense of Romania’s airspace. Within this relevant corpus, only 119 items included one or more propagandistic narratives. And of those 119, only 44 directly promoted the claim or used a manipulative and/or propagandistic editorial framework.
In this case, the difference between the figures is significant. An article may quote a statement by a Russian official without presenting it as fact, or without providing interpretive context (from an expert, for example). The article may report on the event with factual references, may challenge the official’s claim, or may refute it. In our analysis, 43 Russian-language articles simply reproduced narratives as attributed statements, 19 presented them in a somewhat factual context (to mimic journalistic neutrality), eight took an unclear stance, and five contradicted or verified them.
Figure 1. From raw results to content with an explicitly identified propaganda framework after filtering
Therefore, the mere presence of a keyword, a quote, or a title in content collected through Meltwater is not sufficient to label a piece as propaganda. Any analysis of this kind must examine both the statement itself and the editorial stance of the cited source: who is making the statement, whether it is attributed, whether there is evidence (or facts), and whether the text seeks to inform, persuade, or cast doubt on the topic of interest to the researcher.
Where did the main conversation take place?
Nearly half of the relevant content identified after filtering came from news websites: 1,002 items, or 49.6% of the total corpus. Social media provided 850 items, accounting for 42.1%. Forums followed, with 158 items (7.8%), while blogs and comments accounted for a very small share (less than 0.5%). At the same time, the “social media” category is dominated by Platform X, based on the data exported from Meltwater. Telegram does not appear in any identifiable field, which means this analysis cannot measure the volume or role of Telegram channels. This is merely a limitation of the social media listening platform and not evidence that the topic was absent from the platform.
Figure 2. Breakdown of the 2,019 relevant items by type of identified source
How has the distribution of Russian-language narratives evolved?
The first four days of the monitoring period accounted for the bulk of the activity. On July 24, 410 relevant items were identified on the topic of drones flying over Romania. On July 25, although the volume of content dropped to 293, the first consistent wave of coverage emerged. On July 26, following the third incident, Russian-language content on this topic reached its peak for the monitoring period: 508 items. On July 27, there were 470 items, and social media surpassed online news outlets.
After July 28, the overall volume of content drops sharply. However, the topic does not disappear from the public agenda. On August 1, the campaign picks up again with lower numerical intensity but much greater editorial consistency, focusing primarily on defense costs and NATO’s alleged “silence.” This is one of the most important aspects of the corpus: the intensity of propaganda does not always correspond to the overall volume of the conversation.
Figure 3. Daily trends in relevant content in Russian-language online media, social media, and forums
Figure 4. Daily volume compared to narrative expositions and editorial frames
| WHY IT MATTERS On July 26, 508 relevant items were detected, but only five narrative pieces. On August 1, there were only 19 relevant items, 17 of which had a strong editorial slant. Monitoring based solely on the number of mentions would miss precisely this smaller but more homogeneous and aggressive wave. |
Top six propaganda narratives identified
The Kremlin’s propaganda narratives about drones did not emerge in isolation or spontaneously. Some materials combined two or more narratives—for example, the idea of an ineffective defense combined with the accusation that NATO is provoking an escalation of the war. For this reason, the totals for each narrative may overlap and should not be added together as if they represented distinct materials.
Figure 5. The frequency of the six propaganda narratives and the way they were presented
Narrative 1: Defense is expensive, weak, and ridiculous
This was the dominant narrative throughout the monitoring period: 57 items identified and distributed across 38 domains. The messages compared the cost of missiles to the price of drones, mocked the alleged misses (sic!), and suggested that Romania did not have enough pilots or that NATO had remained passive in the face of aerial threats from the east. In 37 cases, this narrative was promoted directly or presented in a strongly worded editorial. The power of this narrative lies precisely in its simplicity. A “expensive missile versus cheap drone” comparison seems intuitive, but it ignores the protected target, the risks to the civilian population, the cost of a successful strike, and the role of deterrence. In this case, Russian propaganda reduces a complex military decision to a single emotional label: a waste of money and resources.
Narrative 2: The incidents are fabricated or staged
Thirty-five instances were identified in which the accusations made by Romania were denied or the incidents were described as “staged.” In 31 cases, the claim was presented as a statement attributed to a Russian official. Only two news pieces promoted it directly through their own editorial stance. In the case of the Russian Federation, the media’s reporting of an official position automatically constitutes an endorsement of that position. This narrative gained traction especially after Bucharest’s diplomatic response. At that point, the technical denial of the airspace violation was linked to a broader political accusation: that Romania’s leadership had used the incidents to conceal the costs of its military support for Ukraine.
Narrative 3: NATO is escalating the conflict and using Romania
Nineteen articles portrayed the North Atlantic Alliance as an actor that is testing Russia, pushing Romania toward war, or proving incapable of protecting its ally. Seventeen of these used a highly charged editorial framework. Here we can identify a more flexible narrative: if Romania reacts, it is described as provocative; if it reacts cautiously, it is described as weak.
Narrative 4: Romania will face retaliation
Nineteen members reiterated warnings about a Russian response to the expulsion of the Russian diplomat. All of these appeared as statements attributed to Russian officials, including Russian Foreign Ministry spokesperson Maria Zakharova. The message shifts the focus from the airspace violation to the alleged cost of Romania’s response and attempts to portray the normal defense of sovereignty as a reckless move by Bucharest.
Narrative 5: “Ukraine is to blame” or “it’s a false-flag operation”
Fourteen sources shifted the blame to Ukraine or suggested a provocation intended to draw NATO into the Russian-Ukrainian war. Six actively promoted this hypothesis, while eight took an ambiguous stance. The false narrative resurfaced on August 2-3, centered on a related episode that the data cannot automatically link to the drone incidents of July 24-27, 2026.
Narrative 6: Bucharest is hostile and adventurous
Six articles framed Romania’s policy of supporting Ukraine in its efforts to resist as a manifestation of “irrational hostility” toward Russia. All of them repeated statements attributed to Russian officials, bloggers, or commentators. However, the purpose of this latter framing is to blur the distinction between a response to a security breach and an alleged political provocation initiated by Bucharest.
Figure 6. Schedule of Narrative Exhibitions, July 24-August 3, 2026
Repetition can create a false impression of plurality
A piece of information seems more credible when it can be found in many places (amplification). But ten websites publishing the same text do not necessarily represent ten independent confirmations. They may be ten reposts from the same source, produced by a network cluster, automated aggregation, or coordinated distribution. In the analyzed corpus, 1,442 of the 2,019 relevant items—71.4%—were part of clusters with at least two occurrences. A total of 273 clusters with multiple items and 206 clusters involving at least two domains were identified. Redundancy is, therefore, a structural feature of the conversation, not an exception.
It is also worth noting here that two other particularly relevant incidents have been identified. On July 25, 17 news outlets published, within a span of about three hours, a headline that mocked the number of pilots and conjured up the image of a “Ghost of the Danube,” an ironic reference to the myth created around an aviation ace at the start of the Kiev offensive— "The Ghost of Kyiv". On August 1, another 17 domains published, within 159 minutes, a text about Bucharest’s alleged “bankruptcy” and NATO’s fearful “silence.” Fifteen of these domains were common to both waves identified by the platform.
Figure 7. The proportion of duplicate content and the overlap between two editorial cycles
Sources and amplifiers: few appearances, but synchronized distribution
At the individual level, most fields have published only one or two narrative exposés. Mirtesen.ru had seven, Rambler.ru and News-kiev.ru six at a time, Dzen.ru five, and on the platform YouTube Four instances of exposure were identified. The numbers are small, but they become significant when the same texts appear almost simultaneously across a broader network. A domain should not automatically be equated with an editorial office or a single owner. Some Russian websites are aggregators, others republish external feeds, and the same entity may operate multiple domains.
Figure 8. The top ten domains by number of items with narrative exposure
What we should keep in mind
The drone incidents that occurred between July 24 and 27, 2026, were not only a test for Romania’s air police forces, but also for the ability of institutions and the media to quickly manage an information crisis. Russian propaganda constructed contradictory explanations around these real events, all of which, however, pointed to the same conclusion: Romania would be either too aggressive or incapable of defending itself; it would spend too much on intercepting drones, yet at the same time be unable to protect its territory; it would be both a victim of Ukraine’s actions and a mere tool of NATO. However, the power of these messages does not lie in their consistency, but rather in their ability to adapt to any real-life situation. If a drone is shot down, the intervention is portrayed as costly, dangerous, or provocative. If it is not immediately addressed, the incident automatically becomes “proof” of the weakness of the national defense. Thus, regardless of the decision made by the authorities, the Russian-speaking public is presented with the same interpretation: the authorities in Bucharest are incompetent, and Romania’s allies cannot be trusted. Unfortunately, such narratives are almost instantly translated into Romanian and disseminated by local actors. In such cases, the Kremlin no longer even resorts to sophisticated propaganda campaigns, but simply waits for the conspiracy theories or for relativist narratives to further deepen social divides. In other words, a campaign of “Foreign Interference and Manipulation of Information” (FIMI) coordinated by Moscow in Romania can easily be replaced by a much more effective and less costly “Domestic Information Interference and Manipulation” (DIMI) campaign, while also maintaining the appearance of not being directly involved.
The data collected and analyzed by the Digital Forensic Team confirms that this information exploitation was not a minor occurrence. Of the 4,635 results collected, 2,019 were relevant to the incidents under investigation. Within this corpus, 119 pieces of content exposed the public to at least one propaganda narrative, and 44 promoted such messages or presented them in a manipulative editorial context. And the most prominent theme was not a direct denial of the drones’ Russian origin, but rather the ridicule of Romanian and allied air defenses, particularly through simplistic comparisons between the price of a drone and the cost of the means used to intercept it. Such a comparison, however, ignores the essential question: what exactly is being protected by the intervention? However, the cost of defense cannot be assessed solely in relation to the target’s value; rather, it must be weighed against the human lives, infrastructure, communities, and strategic objectives that are at risk. A relatively inexpensive drone can cause damage that is incomparably greater than its value, and this includes people’s health and lives. Therefore, the effectiveness of an intervention is not measured by how similar the costs of the two weapons are, but by the risk that the intervention prevents from materializing.
That is why the best information defense does not begin after a falsehood has gone viral, nor is it limited to refuting it. Our institutions must explain in advance how the decision-making process works and what the difference is between detecting, identifying, classifying, intercepting, and neutralizing a target. During an incident, the prompt publication of a single timeline—specifying the times, locations, institutions involved, and the level of certainty of the information—would limit the scope for speculation, conspiracy theorists, and the usual propagandists.
Furthermore, public communication should also explain the reasons for an intervention and the risks that were averted, not just the type of missile used or its cost (which is irrelevant compared to the associated risks). At the same time, specialized institutions should monitor not only isolated false claims, but also textual patterns, groups of websites publishing the same content, the reuse of images, and the sharing of messages across online media, Telegram, Facebook, and other platforms. The repetition of the same patterns across multiple venues may indicate an amplification mechanism worth investigating, even if it does not automatically prove the existence of a coordinated CIB-type operation.
—
By Dr. Nicolae Țîbrigan, coordinating expert Digital Forensic Team and Diana Moraru, expert of the Digital Forensic Team in collaboration with Alliance4Europe – Counter Disinformation Network (CDN)
