Revisionism and Ukrainophobia Agitate Online Spaces

Killed Children’s Remembrance Day sparks online violations in Bosnia

On May 5, Sarajevo’s Day of Remembrance for Fallen Children was celebrated in Children’s Square in Sarajevo with parents and officials laying flowers and addressing gathered residents. The event was also attended by Sefik Dzaferovic and Zeljko Komsic, members of the Presidency of Bosnia and Herzegovina.

The Memorial to Children Killed in the 1992-1995 siege was inaugurated on May 9, 2009, in Veliki Park in the municipality of Centar, by artist Mensud Kečo. A year after its opening a pedestal was erected containing the names of 521 children, out of an estimated total of 1,621 dead.


A Bosnian woman prays on the 30th anniversary of the Bosnian Independence at a memorial to the fallen soldiers in the Bosnian War (1992-95), in Sarajevo, Bosnia and Herzegovina, 01 March 2022. Photo: EPA-EFE/FEHIM DEMIR

Three days after this year’s commemoration day, political analyst and psychologist Srdjan Puhalo wrote an article querying the figures used, titled: “Prove that 1,601 children were killed in Sarajevo or stop using that number”.

“The media in Sarajevo know that this number is not based on reliable research, but still transmit inaccurate information without any evidence. I don’t know why they do that, but in any case, it is not correct, professional, or fair,” Puhalo added.

Following the controversial statements, Puhalo was targeted by several insults and threats on Twitter.

Puhalo was also supported by film director Jasmila Žbanić however, who on May 13 on social media urged institutions to publish accurate data on the number of children killed. The director, who was backed by the Director of the Museum of War Childhood, Jasminko Halilović, and political analyst Ivana Marić, said she had since been exposed to “a wave of anger from those who disagree on the important truth”, adding that, “every child killed deserves to know his or her name and to know exactly how he was killed and who killed him!”

In her police report, she stated that some threats were sent from the Facebook profile of Haris Zahiragić, an MP. “Zahiragić put her name and picture in a false context and provoked a mob calling for a lynch with her lies,” she wrote. Another comment about her had read: “Žbanić should be killed as a matter of urgency”.

Fake news on Ukrainian President continues to go viral in Hungary

Following the April 28 episode of misinformation where Ukrainian President Zelensky was falsely accused of using drugs, online violations targeting Zelensky have not slowed in Hungary’s digital environment.

Disinformation campaigns and misleading news about Zelensky are now commonplace in several countries where social media channels linked to Russia and Belarus aim to destabilize digital environments.

Recently, Pro-Russia online operatives falsely claimed that the Ukrainian President had committed suicide in an attempt to undermine the Ukrainian government and deceive the public.

In an opinion poll launched by Statista, in May, about 65 per cent of Hungarian citizens expressed a negative opinion about Zelensky. This could reflect the disinformation campaigns that pro-Fidesz media outlets have started since the conflict began in Ukraine.


Supporters of Ukraine attend a counter-event against a pro-Russian rally held nearby in Budapest, Hungary, 30 April 2022. Photo: EPA-EFE/Zoltan Balogh

On May 10, an episode was recorded in Hungary where a picture of a weeping girl with a caption calling her the daughter of Zelensky spread among Hungarian Facebook users. The text circulating online says “Zelensky’s daughter” hates her father, who is a “fascist” and “murderer of the Ukrainian people”. However, the picture did not actually show Zelensky’s daughter. It was from a Russian-language video, available online since 2017, in which the crying girl complains that her boyfriend didn’t buy her a new phone.

A further episode of online manipulation occurred on May 16 in which Zelensky was accused of wearing a Nazi swastika. Several social media posts of Zelensky holding a soccer jersey with a swastika in place of a number went viral on Hungarian social media. However, after the detection of pixel discrepancies by AFP, it was found that the picture had been digitally manipulated by adding a swastika to an original photo that Zelensky posted last year, on June 8.

The caption read: “The new jersey of Ukraine’s national football team is special. It can shock. It features several important symbols that unite Ukrainians from Luhansk to Uzhgorod, from Chernihiv to Sevastopol. Our country is one and indivisible. Crimea is Ukraine.”

In polarised Serbia, online attacks on journalists keep going

Although Serbia has some of the most advanced legislation on the media, journalists are routinely threatened by political pressures, and by the impunity of crimes committed against them. In a highly polarised political climate, journalists remain subjected to political attacks instigated by members of the ruling elite that are amplified by certain national TV networks, according to RSF.


A protestor wears a mask while blocking the streets in front of the government headquarters during a protest against Rio Tinto’s plans to open a lithium mine in Belgrade, Serbia, 18 December 2021. Photo: EPA-EFE/ANDREJ CUKIC

Mina Delić, a journalist and photographer from Senta, in the northern province of Vojvodina, received a court summons over the environmental protests and roadblocks organized across Serbia in December last year. She was allegedly marked as a protest organizer because she had posted a call to a protest in a Facebook group. She was summoned to attend the Senta Misdemeanor Court on May 23, and if she does not respond or justify her absence, her arrest would be ordered.

Another case was related to a local government official who used Facebook to insult a journalist and the television station employing her, as well as an opposition activist. Zdravko Mladenović, president of Batočina municipality, posted insulting remarks about Zlatija Labović and Dragan Biočanin, a local opposition activist who Labović had interviewed. Mladenović said: “What else can you expect from such appearances, deserters, traitors, clowns and jukeboxes, to whom you insert something, and they play and sing when you press a button?” Last December, Mladenović also insulted the correspondent of H1 Television shouting: “Why are you filming?” and “You did not announce yourself to come,” expelling the journalist from the Assembly session.

Cyber-attacks and Russian-sponsored DDoS attacks target Romania and North Macedonia

Hacking attacks continue to be registered with alarming frequency in Romania and North Macedonia, where large public companies and institutional sites are targeted by groups that are often linked to Russia.

In the most prominent case of digital rights violations in North Macedonia in the first half of May, scammers targeted one of the biggest banks, NLB Bank and its customers, asking them for their personal data and accounts. The bank warned customers not to share any details with those asking for it, even if they say they are bank representatives.

In another incident, recorded on April 30, the Romanian National Cybersecurity Directorate said its own website was temporarily taken down by a DDoS attack one day after key public institutions in the country were hit by a wave of cyber-attacks claimed by Killnet, a pro-Russia hacking group. The DDoS attack blocked user access to the website for six hours.

A further incident occurred on May 1 when Digi24.ro, the most read news site in Romania, remained unreachable for some hours after a DDoS attack, later also claimed by Killnet. “The Mirai Team is causing massive damage to Digi24 servers. We are waiting for the next success,” the message posted on Killnet’s Telegram said.

Violent Acts and Sensationalism Distort the Web

Romanian Far-Rightists Storm Digital Environment

Following the rejection of the so-called “Sovereignty Bill” by Romania’s Chamber of Deputies on May 10, the political climate has further deteriorated.

The law initiative, signed by 23 MPs from the Alliance for the Union of Romanians, AUR, two from the Social Democratic Party, PSD, and two unaffiliated MPs, and which was on the list for a vote in the Chamber of Deputies, aimed, among other things, to extend the powers of the Intelligence service, empowering it to oblige civilians or companies, as well as public authorities and institutions, to collaborate with the institution.

Police officers secure the entrance from the protestors in the yard of the parliament during the ‘No Green Pass’ rally in front of Parliament building in Bucharest, Romania, 21 December 2021. Photo: EPA-EFE/ROBERT GHEMENT

On May 10, two AUR MPs live-streamed themselves harassing Alfred-Robert Simonis, leader of the Social Democratic parliamentary group in the hallway of the Chamber of Deputies. One of the two MPs, Dumitru-Viorel Focșa, as he left the plenary hall, threatened Simonis, telling him: “I will walk over your body. You are a bastard!” Following this, Simonis also hurled insults at the two MPs. This angered supporters of the far-right party, who further insulted and harassed Simonis on Facebook. Later that day, AUR politician also admitted threatening to beat Simonis

A second case saw George Nicolae Simion, leader of the AUR, storm his way into a media outlet. On May 18, after Virgil Popescu, the Minister of Energy, accused him of defending Russian interests in Romania, he live-streamed himself breaking into the newsroom of Digi24 news TV station. Two security guards accused him of forcing his way into the TV studio premises and called the police. Simion initially refused to leave but left after the arrival of the police, shouting: “The state authorities are at the disposal of Digi24. This is the headquarters of the SRI [Romanian Intelligence Service].”

Misinformation about Ukraine spreads in Hungary, Serbia

Since the Ukrainian war started in February, the digital environments in Hungary and Serbia have experienced increasing amounts of disinformation about what is happening there. Online violations involving propaganda and fake news have become endemic and routine. Hungary remains at the top of the list of countries with the largest number of such digital breaches.

Kyiv’s mayor Vitali Klitschko speaks with the press near the Monument of Friendship in Kyiv (Kiev) Ukraine, 26 April 2022. Photo: EPA-EFE/OLEG PETRASYUK

On May 15, news was published on several Hungarian-language news portals that McDonald’s had introduced a “neo-Nazi menu in Norway”. This referred to the so-called “Bandera burger” that the news portals said was named after the World War II Ukrainian ultra-nationalist Stepan Bandera. In fact, the name “Bandera” referred to the sauce in the hamburger, which recalled the colours of the Mexican flag and was inspired by a particular ingredient of Mexican cuisine.

A further episode of disinformation in Hungary occurred on May 30. After Ukrainian soldiers defending the Azovsztal plant in the port of Mariupol surrendered in May, a photo of an American admiral Eric Olson, shown among the prisoners-of-war, began to spread in the Hungarian social media. Fact-checking websites revealed that the photo was taken a month before Mariupol surrendered and was published on April 14 by the Russian state news agency Sputnik.

Hungary is not the only country where false news about the Ukraine conflict is spreading. On May 27, several news portals in Serbia also reported on an alleged statement by the Mayor of Kyiv, Vitali Klitschko comparing the war in Ukraine and the conflict in Kosovo.

Klitschko has since denied saying this. The news, which went viral in the Serbian digital space, reported an interview given by Klitschko to a Swiss portal in which he supposedly stated: “The Ukrainians will get rid of the Russians like the Albanians got rid of Serbs.” Klitschko also allegedly said: “I am very glad to have met an Albanian journalist for the first time, which is a good opportunity to convey a message to the Albanian people in the Balkans. We have heard and read that you Albanians, like us Ukrainians, are people of peace and freedom-loving. Today we are fighting the Russian regime that is trying to occupy our country, as you were once occupied by Serbia.”

Later that day, on his Facebook profile, the Mayor denied making the quote. “I did not comment on that. Even before they transmit such information and quote anything, journalists should look for audio or video evidence for such an exclusive,” Klitschko wrote.

Political tensions and discrediting strategies in Bosnia, North Macedonia

Ahead of the general elections on October 2, Bosnia has experienced an increasing number of party clashes and internal tensions.

“Bosnia and Herzegovina remain a country traumatized by war,” said Christian Schmidt, the international community’s High Representative, in a letter to the President of the UN Security Council on April 29. Outlining the main challenges ahead of the elections, Schmidt also said that the authorities of the mainly Serbian Republika Srpska entity have increasingly embraced rhetoric and actions that could undermine Bosnia’s constitutional framework and render state laws inapplicable.

The new High Representative and EU Special Representative in Bosnia and Herzegovina, German diplomat Christian Schmidt, looks on during his inaugural press conference in Sarajevo, Bosnia and Herzegovina, 04 August 2021. Photo: EPA-EFE/FEHIM DEMIR

On May 23, meanwhile, Alma Omerović, president of the Women of the SDA (Democratic Action Party) in Sarajevo, invited all voters to vote for her Bosniak party in the elections. Omerović who is also the president of the municipal assembly in Ilijas, insulted the vice-president of the Social Democratic Party, SDP, Denis Bećirović, who will be her opponent in the race for the Bosniak post on the three-member state presidency.

Omerović, who called Bećirović a “traitor” also declared an election “jihad” on social media. “Bosniaks, this is the jihad of our time,” she said on Facebook.

The statement drew numerous reactions, including from the US embassy in Bosnia. “Such a comment is contrary to the sincere commitment to inclusive and collaborative participation in government, for the benefit of all BiH citizens, which is exactly what voters in this country want and deserve,” the embassy said.

In North Macedonia, meanwhile, our monitors also registered a case related to political tensions. On May 25, several Twitter users, in order to discredit the local city government, shared a photo depicting a project that the city of Skopje is carrying out regarding an access ramp in one of its municipalities. The photo, however, turned out to be cropped and the circumstances of the project weren’t stated, which led many Twitter users to accuse the city authorities of not doing a good job on the project.

Albania’s Rama Savages Media Reporting on Child’s Death at Sea

Albania PM Edi Rama during a press conference following the Western Balkans Summit in Tirana. Photo: LSA

Prime Minister Edi Rama lashed out at local media after an off-duty police officer accidentally killed a child with his boat at sea, likening them to animals.

The death on Tuesday shocked the country, where many have been asking for more protection on beaches; this is not the first such case during this year’s touristic season.

Prime Minister Rama, after consoling the child’s family members, focused on attacking the media.

“Even in this case, the political-media animalism of those who wish and expect nothing but disaster to fuel the fire of their unjust and hopeless political war, was not missing!” he wrote on Twitter.

State Police late on Tuesday fired the entire chain of command of the local Directorate for Border and Migration of Vlora, “for not implementing additional measures to prevent incidents with watercraft in coastal areas”.

Communications expert Edlira Gjoni on Facebook said the Prime Minister should seek forgiveness from the media he had insulted.

“What about you, a prime minister that calls us ‘political-media animals’! That’s what we call you too … Get over the animalism and make your deputies deal with initiatives that save, no take, lives!” she wrote.

Citizens have called for a protest meeting at the Ministry of Interior under the motto “The boat did not kill her, the state did”.

Rama is well known for his battles with the media. Last month, when Albania faced another cyber attack, he attacked the media for reporting about it.

Media outlet Top Channel reported that Iran was behind the cyber attack, sending a political message to Albania, which is hosting around 3,000 exiled Iranians in Albania belonging to the People’s Mujahedin of Iran, MEK.

Reports also said the attackers demanded 30 million euros in bitcoin. But Rama denied the report of blackmail on Twitter, calling the news about the “demand for 30 million euros completely fake”.

On Twitter, on July 24 he asked: “Why does Top Channel continue to speculate irresponsibly, without any basis, proof, or fact, on the developments on the cyber war front? I don’t know.”

The relationship between Rama and the local media has long been fraught.

This year Rama ordered two journalists to undergo “re-education”, meaning that they don’t have the right to attend his press conferences or ask him any questions for a certain period.

This year, Albania fell 20 places in the latest press freedom index compiled by international watchdog Reporters Without Borders, falling from 83rd to 103rd place.

Reporters Without Borders said that journalists in Albania are targeted by organised crime groups and even by police violence and that the state is failing to protect them, while private media outlets are owned by businessmen who have links with politicians.

Albania’s Ministers Promote Private Social Media Pages Using Public Resources

Albania’s Prime Minister, Edi Rama, starts his workday at 8 a.m. on his Facebook page, posting photos or videos that foster an aura of optimism, often showing fragments of infrastructure projects from across the country.

Rama has turned his private Facebook page into the main communications channel between the government and the public; it has some 1.6 million likes and posts appear six or seven times a day. Each post gets hundreds of comments and thousands of likes.

Since 2013, the Prime Minister’s office has had another Facebook page, called Kryeministria. However, it’s a lot less popular, with just 3,500 followers, few interactions and no real public influence.

Rama is not the only member of the Albanian government to concentrate public communications in his private channels. Most of his ministers follow the same model; they have more followers and much more content on their personal pages than on the pages of the official institutions they lead.

Social media has been transformed over the last decade into a major political tool in elections; however, to be efficacious, they need to be fed continuously.

Data obtained through a Freedom of Information request also show that Prime Minister Rama and his ministers use public funds and resources and for this, alongside an extensive network of public employees, to produce content and promote their social media accounts.

By analyzing data collected by Crowdtangle, a tool developed by Facebook, BIRN discovered that the personal Facebook pages of Rama and his ministers are fed with far more posts, videos and lives than their institutional pages. About 98 per cent of the total interactions go to their personal pages, compared to just 2 per cent to their institutions’ pages.

The management of the digital communication channels of the Prime Minister, ministers, the Prime Minister’s office and the ministries is the responsibility of the Media and Information Agency, MIA, a body created amidst debate a year ago, which is led by his spokesperson, Endri Fuga.

Although the Socialist government’s communications through social media networks are not regulated by law, civil society groups accuse it of using public resources for political purposes.

“Ministers’ political profiles are supported by ad money from the state budget, while their official duties are later used as weapons to support their parties in election campaigns,” said Rigerls Xhemollari, from the Qëndresa Qytetare, an NGO.

Fuga, director of the MIA, told BIRN that the management of the content of the social media accounts of the Prime Minister and his ministers serves to inform the public. He dismisses suggestions that public resources are being misused.

“Employees of the MIA, including the spokespersons of the ministries, are engaged in producing content that is related only to the government duties of the Prime Minister and members of the government,” Fuga said.

“Their work serves the purpose of informing the public through the social networks about the government’s activities, not the personal or political-party activities of the ministers,” he added.

Private accounts much busier than public ones


Albania’s Prime Minister Edi Rama flashes a Victory gesture to the media as he casts his ballot at a polling station near Tirana, Albania, 25 June 2017. Albanians head to the polls on 25 June for parliamentary elections. EPA/MALTON DIBRA

The MIA was created in September last year through a decision of the Council of Ministers. It is responsible for providing transparency over the policies and activities of the Council of Ministers, ministries and any central government body.

The agency also produces government propaganda and manages and supplies the social networks of the Prime Minister, the Prime Minister’s Office, the ministers and their ministries with content.

MIA told BIRN in an answer to an FoI request that the content for the social networks of the Prime Minister and his office is the responsibility of four employees of the sector for informing the citizens, and is supported by the sector handling Design and Creative Product. The MIA did not divulge the number of employees engaged in this latter sector.

The MIA answer stated that the social network accounts of the members of the government and their ministries are managed by their spokespersons, supported by “structures responsible in each ministry”.

On Rama’s and his ministers’ pages on social media networks they often post personal statements or about their political or party activities, but the MIA insisted these are not their responsibility.

“The publication of posts of a personal character, such as opinions… are the responsibility of the Prime Minister or the ministers, while the publication of the activities or materials of political character and their publication on the social media accounts of the Prime Minister and the ministers are prepared and managed by their political staff, attached to the Socialist Party,” the MIA said.

The number of PR officers that work for the Prime Minister and ministers and their ministries is difficult to ascertain. However, a former ministerial adviser told BIRN on condition of anonymity that there are far more people engaged in this than the official numbers.

“Apart from the spokesperson, each minister has an advisor for media relations and three or four specialists that produce the content for social media,” he said, adding that part of the PR staff usually are paid formally for other positions not directly related to the job they actually do.

In the virtual world of the Facebook, the most popular social network in the country, the success of a page or profile is measured by the number of posts, shares or likes – which are counted as “interactions”.

Using data obtained through the Crowdtangle tool, BIRN discovered that the private pages of Rama and the ministers have an aggregate content and interactions that dwarf the activity of the official pages of the respective institutions. In this analysis, the private profile of Deputy Prime Minister Belinda Balluku is excluded, as she doesn’t have a page on Facebook.

Over a one-year period, the personal page of Rama and ministers together had some 8,801 posts while their official pages have some 5,342 posts. About 62 per cent of posts went to the private pages while 38 per cent to the official ones.

The private pages also had 53 per cent of the all videos posted on Facebook and 69 per cent of live transmissions.

However, the gulf is much wider when views or videos and interactions are also taken into account.

Data collected by using Crowdtangle shows that the private pages of Rama and the ministers together secured more than 15.2 million interactions during a one-year period, while their official pages had just 292,000 interactions. It means that some 98 per cent of the interactions went to the personal pages, compared to just 2 per cent to the official ones.

‘Historical memory ending up on mobile phones’


Albanian Prime Minister Edi Rama speaks to media as he arrives for an EU-Western Balkans leaders’ meeting in Brussels, Belgium, 23 June 2022. The progress on EU integration and the challenges which the Western Balkans countries face in connection to the Russian invasion of Ukraine are topping the agenda when EU and Western Balkan leaders meet prior a European Council meeting. EPA-EFE/STEPHANIE LECOCQ

The normal practice of Western leaders in communicating through social networks involves a clear division between their personal pages and the official pages of the public institutions, which carry most of the burden in communicating with the wider public.

In Albania, the strategy of the government effectively favours the individual pages at the expense of the institutional ones.

Afrim Krasniqi, director of the Institute for Political Studies, criticizes the practice of publishing official acts on social networks, claiming it has effectively “personalized” the state.

Krasniqi says there is cause for concern over the consequences this might have for the documentation of the government’s work.

“Historical memory is ending up on mobile phones or on the personal emails of officials,” Krasniqi said, providing examples of when official conduct was never properly documented elsewhere, except on the personal social media pages of the Prime Minister.

“From a legal aspect, this is a violation of the law, while from an administrative aspect, this is a violation of the rules; from a political aspect, this is an abuse of public office while from a historical aspect this is an investment against the memory of the state and the archives,” Krasniqi said.

Xhemollari, from Qendresa Qytetare, told BIRN that channelling official communications via personal Facebook pages is a reflection of the general practice of the current government, which is based on the individual and not on the institution.

“This communication philosophy creates a party state, individuals that are stronger than institutions, while at the same time it violates the election law and the ethical codes on communication and erodes the rule of law and the transparency of governance,” he said.

However, not all believe in a complete separation between the political leaders and the institutions in terms of communications.

Erla Mehilli, a journalist and former spokesperson of former PM Sali Berisha, told BIRN that while social networks should not replace official channels through which the state communicates to citizens, personal pages can be useful in sharing some informal moments.

Mehilli believes officials cannot be banned from using their personal accounts for official communications, though she also believes that some form of regulation is needed.

“It is not easy to separate the individual from the office that he/she holds. I am not aware whether any law bans an official from using their personal pages along with the official ones for communicating, even for official communications,” she said.

MIA didn’t answer queries from BIRN about what happens with the ministers’ personal pages once they leave office, and have the possibility of using social media created at public expense for their future political careers.

Fuga said the content doesn’t change and is not deleted from these pages. “Such content continues to be accessible for the public in these pages beyond the time of the holding of the office by a minister,” he said.

North Macedonia Ministry Denies Covering up Ransomware Attack


North Macedonia’s Agriculture Minister, Ljupco Nikolovski. Archive photo: mzsv.gov.mk

North Macedonia’s Agriculture Ministry has admitted that on September 12 it was attacked by the ransomware group BlackByte, previously known most for attacking key US infrastructure and agencies.

The admission came after the head of the agriculture committee for the main opposition VMRO DPMNE party, Cvetan Tripunoski, on Sunday accused the ministry of keeping silent about the attack.

The ministry has now confirmed some documents were compromised during the attack and its work blocked for some time, but it denied having lost any significant documents and data in the process.

“There has been damaging or decryption of data from office documents such as Word, Excel and PDF, while the applications of the ministry … were not damaged by the attack but were shut down as a preventive measure, and are now active again,” the ministry told BIRN on Monday.

It did not reveal what kind of data were contained in these documents that are among the most commonly used document formats in many public institutions.

It added that the ministry’s “archive is also [now] functional and works, without a single document gone missing or damaged”.

“From sources inside the ministry, we found out that a large part of the documents from ministry’s archive have gone missing,” Tripunovski said on Sunday, alleging that they had heard of data gone missing from the ministry’s register of farms, wine buyers, agricultural companies and organic producers.

The opposition official added that the register of active contracts for leasing agricultural land was also missing, as well as the list of ministry’s debtors and the documentation on all the administrative disputes that the ministry is involved in.

Tripunovski also gave the entire affair an unexpected spin by speculating whether the digital attack was for real, or a device to cover up crimes.

“The silence of the Agriculture Minister, Ljupco Nikolovski, casts serious doubt on whether this is even a hacker attack, or whether this was done to cover up criminal actions and misuses by the government of the Anti-Macedonian SDS [the main ruling Social Democrats],” he said.

The ministry on Monday said the allegations were “nonsense”.

Asked about why the public only found out about the attack that happened on September 12 in a press release on its website on Sunday, the ministry insisted that while the website had functioning properly all the time, it had informed the public about the attack on the day it happened, but only on its Facebook page.

According to research done by the online security company Trend Micro, published in July, BlackByte ransomware group has been building a name for itself since 2021 by going after “critical infrastructure for a higher chance of a getting a pay-out”.

The North Macedonian Ministry did not clarify whether the group demanded a payout, or if and how it responded to such demands.

BlackByte made its debut in July 2021, the research notes, adding that in Its first year of activity it garnered the attention of the US FBI and the US Secret Service, USS, for going after “at least three US critical infrastructure sectors, notably the government facilities, financial, and food and agriculture.”

The research notes: “At present, BlackByte continues to target organizations from all over the world. However, like LockBit, RansomEXX, and many other ransomware families, BlackByte avoids attacking Russia-based entities.”

The latest attack on a North Macedonian ministry comes after the country’s education ministry’s site was downed earlier this month, seemingly by an unrelated group of hackers, prompting North Macedonia’s National Centre for Computer Incident Response to urge all state institutions and companies to beef up their online security protocols against potential cyber-attacks.

It follows a spate of cyber-attacks on state institutions in Montenegro, Kosovo and Albania, which some observers suspect it might lead to a connection with Russia, which Moscow has denied.

Journalists from Greece Ask PEGA Committee to Check Their Devices

Photo: Lianhao Qu / Unsplash

Greek journalists and foreign correspondents in Greece have asked the EU’s Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware, PEGA, regarding protection of their devices. 

“After the revelation of the ‘Greek Watergate’ scandal, Greek democracy is in danger and the safety of journalists and any other critical voice is at stake,” their joint letter says. 

It adds that there is no trust in the Greek parliament’s in-house investigative committee, set up to investigate the state surveillance scandal, and asks PEGAs and the European Parliament to support them. 

The 24 journalists also call on the European Parliament to provide funding and facilities to check their smartphones and devices for wiretapping and any illegal or legal spyware, or use the existing EU cyber-security structures already available to MEPs.

According to the letter, the journalists who signed it are either directly related to the case, covering the scandal, or have suspicions that their phones may have been infected.  

The initiative was launched by Dutch journalist Ingeborg Beugel, a freelance correspondent who has lived in Greece for 41 years.

After a heated dialogue with PM Kyiriakos Mitstotakis at a press conference in November 2021, she experienced online and physical harassment, and had to leave Greece. 

“The whole letter is a statement. We journalists have grown tired of the Greek government’s words and promises. The rule of law is violated in Greece. We ask PEGA Committee to help us in practice,” Beugel told BIRN. 

Montenegro Seeks Foreign Help on Solving Attacks on Journalists

Montenegrin government session in Podgorica. Photo: Government of Montenegro

Montenegro on Thursday asked for foreign experts’ help in solving old cases of attacks on journalists. Minister without portfolio Zoran Miljanic said the government will continue to insist on solving these attacks.

“We already asked the US and United Kingdom for expert help in investigating old cases of attacks on journalists. Experts from the FBI and other foreign intelligence services will be hired as consultants to help Montenegrin authorities close the old cases of attacks,” Miljanic told a government session.

“Our key priority is solving the case of Dusko Jovanovic’s murder,” he added.

On May 27, outgoing Prime Minister Dritan Abazovic said the government was ready to ask foreign experts to help solve the failed investigation into the murder of Jovanovic 18 years ago.

Abazovic called on the Special State Prosecution to reopen the investigation, stressing that people who can still testify in this case should get the status of cooperative witnesses.

The editor-in-chief and owner of the daily newspaper Dan, well known for his opposition to the then government, was shot dead on leaving his office in Podgorica on May 27, 2004. He had received numerous death threats.

European Affairs Minister Jovana Marovic said there would be no media freedom in the country without solving these attacks.

“Political parties and state officials should also refrain from verbal attacks on journalists and media whatever the disagreements with their editorial policy,” Marovic said.

The government adopted the Commission for Monitoring Violence against Media’s report, which suggests including foreign experts help in investigations.

The report also said the Commission’s cooperation with Special State Prosecution and the National Security Agency and police has improved.

The Commission for Monitoring Violence against Media was formed in December 2013, led by Dan’s then editor, Nikola Markovic. He accused the former government of obstruction and of lacking the political will to clarify the attacks, saying the Commission had been denied access to relevant data.

After a change of power in 2020, the new government appointed new members of the Commission, stressing that it should cooperate with the authorities and propose concrete measures after investigations.

In its 2021 progress report, the European Commission called on the country’s authorities to step up efforts to effectively investigate, credibly solve and adequately sanction cases of attacks against journalists.

“The authorities should promote an environment conducive to investigative journalism and media freedom by promptly reacting to and publicly condemning hate speech and threats, and by refraining from exercising political pressure on journalists, including through their public statements,” the Commission report said.

On March 30, the US State Department’s latest human rights report said unsolved attacks against journalists as violence and harassment remained a significant problem in Montenegro.

Political and Ethnic Hatred Dominates Latest Online Breaches

Political figures targeted in many online spaces

The first half of September saw a flare-up of episodes linked to political motives in different countries.

Serbia, Hungary and North Macedonia are the countries where most such episodes were recorded. This only shows how divisive political clashes and rhetoric remain a major problem in the region.

On September 1, Serbian President Aleksandar Vučić and his sons received death threats via Instagram. A 47-year-old man from Zrenjanin was arrested on suspicion of committing the crime of endangering security in connection with the threats and was placed in pre-trial detention for 48 hours.


Serbian President Aleksandar Vucic attends a joint press conference with Turkish President Recep Tayyip Erdogan (not pictured) in Belgrade, Serbia, 07 September 2022. Photo: EPA-EFE/ANDREJ CUKIC

In Hungary, a deceptive video aimed at an MEP started circulating on Facebook on September 6. A video of a band playing a concert in the Parliamentary Assembly building of the Council of Europe was leaked on Facebook in Hungarian falsely claiming to be showing EU politicians “celebrating their salaries” to “Jewish music” – as European citizens face record energy prices.

In another incident, on September 8, a photo supposedly of former Estonian president and activist Mikk Pärnits wearing a women’s pink dress started circulating on Facebook in Hungarian. The image is actually from a 2020 awards ceremony, where the winner wore a women’s dress to raise awareness about domestic violence and sexual abuse.

North Macedonia is the country where the largest number of episodes have occurred. A photomontage of ex-Finance Minister Nina Angelovska, depicturing her with a plate of cake in the shape of a penis, was published on Twitter on September 2. The author wrote: “Dear viewers, this one was a minister in the cabinet of the bonehead from Murtino.”  The “bonehead from Murtino” refers to former prime minister Zoran Zaev.

In North Macedonia, on September 5, a Twitter user posted a print screen of news about a press conference from the President, about the recent security session. Above the print screen, an inscription read: “It occurred to the louse to say that we are bankrupt!”.

Finally, a last incident on September 9 recorded by our monitors saw former PM Zaev being insulted on Facebook, in which Zaev was quoted about a potential referendum. Facebook users used threatening and offensive words about Zaev, such as “Smelly”, “Idiot”, “Shit traitor”, “Traitor soul”, and, “Crazy monster, the only option for you is a knife or a razor and be cut piece by piece.”

Minority and LGBT communities systematically attacked online

Following Serbia’s government ban of the EuroPride 2022 celebration in Belgrade, where right-wing anti-LGBT groups also announced they would march through the Serbian capital, police arrested more than 64 people, after thousands of LGBTQI+ activists turned out for the march, despite the ban.

At the same time, activists and supporters of the LGBT movement, along with various ethnic minorities, were subjected to an increasing number of online attacks on social networks.


A participant during the EuroPride march in Belgrade, Serbia, 17 September 2022. Photo: EPA-EFE/ANDREJ CUKIC

At the end of August, for example, Serbian filmmaker Stevan Filipović and actor Viktor Savić argued on social media about the holding of the EuroPride in Belgrade. The argument ended a friendship of almost 15 years. After the debate, Filipović shared threatening and insulting messages from Savić’s supporters on Instagram.

North Macedonia also saw anti-LGBT incidents. On September 5, a Twitter account posted: “You open your timeline, and what can you see? all the faggots jumping on your dick from early morning. Fuck off, I have romance to tweet about, fuck you, you ass- fucking tribe”. Other users also used similar insulting and threatening words.

Meanwhile, both the country’s Albanian and Roma communities were repeatedly attacked and abused in North Macedonia’s digital environment. Most incidents occurred on Twitter. One user on September 2, addressing the Albanian minority, wrote: “Shiptars, hippers, who don’t pay electricity, don’t pay, will some cheap electricity be able to boil beans for us on Friday?” The following day, another user on Twitter published a post with a picture of a parking ticket from City Mall in Skopje written only in Albanian. Above the picture he wrote: “Boycott Skopje City Mall, they only give receipts in ‘shiptar’ language”.

“Shiptar” is a highly insulting term for Albanians.

Between 16 and 18 September, three different episodes were also recorded on Twitter. First, while sharing a headline from a media outlet that refers to the appointment of ambassadors from North Macedonia, a Twitter user wrote: “Shiptars are messing with the whole country” and referred to “servants of the Shiptar mafia”.

Another Twitter user, referring to reports that the state administration will be filled with Albanians from the diaspora, wrote: “We’ve returned the shippers from the diaspora”. Finally, another Twitter account wrote an offensive post with hate speech towards Albanians, saying that he does not know any country “that loves Shiptars as a minority.

Data leaks, hacking attacks and online scams also recorded

Serbia, Romania, Bosnia, Hungary, and North Macedonia were all hit by cyber-fraud incidents in recent weeks. In fact, cyberattacks targeting IT systems in the whole region continue to endanger many institutional and private actors due to the absence of a prevention system and a political strategy for this purpose.


A source code on a computer in Taipei, Taiwan, 13 May 2017. Photo: EPA-EFE/RITCHIE B. TONGO

On September 4, personal data of more than 500,000 citizens collected since 2008, such as names, surnames, addresses, emails and dates of birth, from a Serbian employment website called Lako do posla were leaked online.

Initial analysis by cybersecurity experts said the data may have been extracted from the database using a security vulnerability on the website. Meanwhile, the Facebook page of the Bosnian online outlet Gracija was hacked last September 7. The announcement of the new edition of the online media was changed into vulgar and misogynistic words. Editors immediately removed the content. Gracija reported: “The cover could have been the reason for this incoherently written insult”. It said it would not censor its content, however, to show what “dirty games” take place during the pre-election period.

In Romania, several online attacks also occurred. A media website from Vaslui, a county on the border with Moldova, was the target of a Flooding/Denial of Service attack. The attacks don’t seem connected, as the IP addresses involved in the attack on the local media outlet were mostly from Asia, while G4Media was targeted through IP addresses mostly from the US. The local media website was left unavailable for more than an hour during the DDoS attack. At the same time, on September 8, G4Media, a Romanian online media known for investigative pieces on the judiciary, was the target of a massive Flooding/Denial of Service DDOS attack. The newsroom said the unknown attackers were likely targeting an investigative piece on a probe into how the judiciary system silenced plagiarism accusations against PM Nicolae Ciuca.

In Hungary, UniCredit Bank issued a warning that fraudsters are acting as buyers for a product advertised on the internet and asking for the sellers’ banking details (internet banking ID/password/banking activation code) by referring to a mail order service.

The information they obtain is then used to make unauthorised credit card purchases and transfers. Another hacking episode was recorded in North Macedonia, where the website of the Ministry of Education and Science was hacked by a Greek hacker group.

The attackers posted their text on the website: “Hacked by the Greek hacker team Netwatchers”. After the attack, the ministry insisted citizens’ data was not at risk.

FBI: Iranian Hackers Accessed Albanian Systems Over Year Ago


A digital screen displays a live cyber hack attack during a press conference at the Federal Criminal Police Office (BKA) in Wiesbaden, Germany, 11 November 2019. Photo: EPA-EFE/RONALD WITTEK

A report by the FBI and the Cybersecurity and Infrastructure Security Agency, CISA, published on Wednesday, on the wave of hacking attacks in Albania, says Iranian attackers gained access to Albanian systems some 14 months ago, long before the actual attacks started.

The first cyber-attack was reported on July 13, when Albanian government services became unavailable for some days.

“An FBI investigation indicates Iranian state cyber actors acquired initial access to the victim’s network approximately 14 months before launching the [July] destructive cyber attack, which included a ransomware-style file encryptor and disk wiping malware,” the report says.

“The actors maintained continuous network access for approximately a year, periodically accessing and exfiltrating email content,” it adds.

From May to June 2022, “Iranian state cyber actors conducted lateral movements, network reconnaissance, and credential harvesting from Albanian government networks.” it continues.

In June and August, messages against the Iranian dissident group hosted in Albania, the People’s Mujahedin of Iran, MEK, were released.

The hackers also posted polls on their channels, the website called “Homeland Justice” and a Telegram group with the same name, in which they asked Albanians what would they like them to publish.

One poll asked if they would like them to publish Albanian Prime Minister Edi Rama’s emails.

“In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs [Tactics, Techniques, and Procedures] and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran,” the report explains.

Albanian PM Rama on September 7 expelled Iran’s diplomats from the country after the massive cyber-attack on the government’s key servers in July.

After blaming Iran for July’s cyber-attack, fresh attacks occurred two days later, this time targeting the Traveller Information Management System, TIMS.

This caused queues ar border points, where the registration of citizens and vehicles entering and leaving the country had to be done manually.

Attacks continued on September 19, when emails of the former Chief of Police were released by a group that calls itself “Homeland Justice”.

Police said the prosecution had issued a ban on the publication or reposting of any information released by those behind the cyber-attacks, tasking cybercrime police, the broadcasting regulator and the Electronic and Postal Communications Authority to monitor the information and its use.

The order was condemned by the journalists and journalists’ rights organizations, however.

Hackers Likely Accessed Emails of Serbia’s Cadastre Staff, BIRN Reveals


Illustration by Pixabay

A BIRN investigation shows that Serbia’s cadaster system, RGZ, was infected by not just one malware computer virus but by at least three malicious programs and that at least one of them entered the server via the RGZ mail server, from where it tried to spread.

The servers of the Republic Geodetic Institute stopped working on June 14, when it was announced that a hacker attack had been carried out.

For this reason, management said they locked the entire system preventively, which made it impossible to use its services, including the cadastre of property ownership.

RGZ later said the computer sabotage was carried out from abroad using the ransomware virus “Phobos”.

This works by locking the device, disks and databases that only become available again when the hackers are compensated. However, RGZ insisted that “so far, the message with a request for redemption [cash] has not been identified”.

But BIRN discovered that, beside Phobos, the system was infected with Qakbot and Mirai Botnet as well.

Vladimir Cicovic, a cyber security expert, told BIRN that hackers may have used Qakbot to insert the Phobos virus into the system of the Geodetic Institute.

“One group is selling access, and the other is breaking in. The cooperation of several groups is not excluded. In the institution, they were looking for Phobos, but they didn’t look at how it got in, that is, who opened it,” explained Cicovic.

In special databases, the date of detection of the Mirai botnet on the RGZ mail server is May 8, 2022, while the version of Qakbot from the infected email was detected on May 13.

This is about a month earlier compared to the date officially listed as the start of the hacker attack, and two weeks before the virus allegedly entered the system.

A BIRN journalist had himself received an email from RGZ employee with whom BIRN journalists had been in contact in recent months. The title of the email, as well as other details, made everything look like a continuation of the correspondence, but the content of the email was in Dutch!

Cicovic believes that the fact that the author of the infected email wrote in a foreign language indicates that the malicious program was most likely not intended for Serbia. “If a professional was doing this, the email would be in Serbian. The campaign, or whatever, was not intended for Serbia,” Cicovic said.

He added that the infected email, received by a BIRN journalist, is directly related to the hacker attack on the Geodetic Institute because it shows that the earlier correspondence between the RGZ official and the BIRN journalist was leaked and is now in the hands of hackers.

“The BIRN journalist’s correspondence with the RGZ official is in someone’s hands. A hacker can sell, give, publish this data, but the fact is that the data has been stolen. The email received by the BIRN journalist is sufficient evidence for such a thing. It is possible that other information is also available,” he said, stating that this shows there was a threat of compromising private data.

It is not known whether any other citizen received a similar malicious email.

BIRN contacted the office of the Commissioner for the Protection of Information of Public Importance, which replied that the infected email is not proof that personal data has been compromised and that, as such, it has nothing to do with the hacker attack on RGZ.

According to a report by Kaspersky antivirus solutions company , in the first half of this year, Serbia ranked 13th in the world in terms of the number of cyber-attacks on management systems and critical infrastructure, after Vietnam, Sudan, Tanzania, Yemen and Bangladesh.

BIRD Community

Are you a professional journalist or a media worker looking for an easily searchable and comprehensive database and interested in safely (re)connecting with more than thousands of colleagues from Southeastern and Central Europe?

We created BIRD Community, a place where you can have it all!

Join Now