Digital Forensic Center: Expulsion has not stopped Rybar, the Russian information machine continues to target Montenegro
Less than a month after Montenegro expelled Mikhail Zvinchuk, founder of the Russian Telegram network Rybar, the network was among the first to mock a request by the defence ministers of Montenegro and Albania for NATO to send experts to counter Russian disinformation, according to the latest analysis by the Digital Forensic Center.
The research also shows that Russian and pro-Russian channels, the Pravda network and the Matryoshka campaign rapidly and uniformly disseminated the same message over a 32-hour period - the Russian threat is fabricated, while Montenegro and Albania are irrelevant.
- The trigger was a November 3 article by Politico about the request made by ministers Dragan Krapović and Ermal Nufi. From the morning of November 4 until 5:15 p.m. on November 5, the Difital Forensic Center documented 46 problematic posts mocking the request or placing Russian disinformation in quotation marks. Russian Telegram channels and media outlets established the narrative within approximately two hours. The Pravda network published 21 articles, while translating a Rybar text into Albanian, English and German at the same minute, just two minutes after the first Russian-language copy identified by the DFC - the statement said.
The DFC considers it particularly concerning that the Pravda network already has a subdomain dedicated to Montenegro, which has published more than 13,000 articles since December 2024. It also covered this request in Serbian.
- The Matryoshka campaign went a step further, publishing 22 fake graphics bearing the logos of the Radio Television of Montenegrom Reuters, DW, the BBC and Politico, as documented by the Antibot4Navalny group. One of them claims that France is advising its citizens not to spend the summer in Montenegro because of a terrorist threat. The French Ministry for Europe and Foreign Affairs has issued no such warning. According to its travel advice, Montenegro is classified as a destination requiring normal precautions, and terrorism is not mentioned - the DFC pointed out.
The story, they added, is not a new one.
- According to an internal assessment by the European External Action Service seen by Reuters, Operation Overload, the EU's name for Matryoshka, exploited unrest in France in October. Two weeks later, the same narrative about the disintegration of the EU resurfaced in a campaign targeting Montenegro and Albania - the DFC said.
According to the DFC, Zvinchuk's expulsion did not prevent Rybar from continuing its operations, as a network of this kind can operate from anywhere, while the same message can quickly be picked up, translated and repackaged by other parts of the Russian ecosystem, such as the Pravda network and the Matryoshka campaign.
- The analysis shows that Russian propaganda infrastructure responds rapidly to developments in Montenegro and adapts its content to Montenegrin audiences. The reach of these posts was limited, with only one receiving more views than Politico's post on X. Nevertheless, the DFC warns that the greatest danger lies not only in individual instances of disinformation, but also in the existence of infrastructure capable of picking up, translating and distributing manipulative content within minutes - the organisation stressed.
The DFC highlights that, ahead of the 2027 parliamentary elections, such infrastructure poses a serious risk to informing citizens and safeguarding the integrity of public debate.
- It already has nodes specifically targeting Montenegro: the Pravda subdomain, the Pravda Montenegro VK page, and a Russian-language Telegram channel about Montenegro, as well as numerous other channels that actively report on developments in our country - the analysis states.
The organisation adds that expelling an individual may be a justified security measure, but protecting against foreign information influence requires continuous monitoring of this infrastructure and stronger cooperation between state institutions, the media and organisations professionally engaged in monitoring hybrid threats.