In May 2026, the Kremlin’s European proxy network deployed three coordinated disinformation narratives: one to erase civilian casualties from a mass atrocity, one to delegitimise European governance through antisemitic conspiracy framing, and one to make continued military support for Ukraine politically untenable.
May was a particularly active month for Russian disinformation in Europe. The mass strike on Kyiv on the night of May 23–24 provided the proxy network with its main operational event, generating a coordinated wave of content across at least seven countries within 48 hours. Two other narratives, one targeting EU institutional legitimacy through antisemitic conspiracy framing, one recycling the claim that Ukraine is flooding Europe with illegally trafficked weapons, completed the month’s picture.
Each of the three narratives served a distinct strategic purpose. Together, they illustrate not a coincidence of like-minded outlets but a functioning infrastructure, operating at full capacity.
On the night of May 23–24, Russia launched 90 missiles and 600 drones at Ukraine in what Kyiv City Military Administration Head Tymur Tkachenko described as the largest attack against the capital in terms of locations damaged in the entire full-scale war. Four people were killed and approximately 100 injured across the country, with more than 80 casualties in Kyiv alone, including three children. Around 30 residential buildings were damaged or destroyed. Among the 49 damaged locations in the capital were the Ministry of Foreign Affairs building, a theatre, a philharmonic hall, two museums, a library, a university, a church, and a monastery. Five media organisations reported that their offices were destroyed, with journalists among the casualties.
The pro-Kremlin proxy network published a different version within hours.
Czech outlet CZ24.news, identified as a key node in a Russian-funded influence operation financed through shell companies across four countries, framed the attack as a legitimate military response from the first hours. One article stated that “the strikes were primarily aimed at military, industrial and infrastructure facilities” with “no evidence of repelling the Russian military attack.” A follow-up piece, translating content from pro-Russian blogger Simplicius76, described the event as “a standard military operation with a bonus in the form of the Oreshnik,” concluding that “the fact that we can afford to hit wherever we want with the Oreshnik once every six months is pleasing.”
Slovak outlet Hlavný Denník published near-identical framing the same day, reporting that “Russia carried out a strong retaliatory strike on Kyiv” and that “local Telegram channels reported the use of the Oreshnik missile against an important logistics centre in Bila Tserkva.” Zelenskyy’s public response was highlighted as evidence of military effectiveness rather than civilian catastrophe.
In France, Newsnet reproduced the Russian Ministry of Defence statement with minimal editing: “In response to terrorist attacks carried out by Ukraine against civilian targets on Russian territory, Russia launched a massive strike using Oreshnik ballistic missiles against military command centres, air bases and defence industry enterprises.” The framing of Ukrainian military action as “terrorist” appeared consistently across French, Italian, and Spanish outlets. ControInformazione in Italy described Russia as seeking de-escalation while “Ukraine and Europe are showing little willingness to ease tensions” and “the attacks by Ukrainian Armed Forces against civilian infrastructure indicate that our adversary is determined to continue with its destructive actions.” Spanish outlet Geoestrategia ran a headline referencing “the NATO massacre in Starobelsk” as the moral justification for the Kyiv strike, and listed the Bila Tserkva aircraft repair complex, thermal power plant, and railway and road junctions as the strike’s explicit targets, describing them as “the same place where the ‘flying heritage’ of the Ukrainian Armed Forces is repaired and where trains with NATO weapons arrive.” Diario Octubre described the attack simply as “a retaliatory attack with the Oreshnik against Kyiv.”
In the Netherlands and Belgium, Frontnieuws translated content from the same Russian Telegram channels and cited NASA FIRMS satellite fire data to present the strike as proof of precision hits on the Artem defence factory, attributing any civilian damage to failures of Ukrainian air defence. A follow-up analysis published on May 25 stated: “Oreshnik did not actually hit Kyiv itself, but the nearby air base Bila Tserkva… it turned out to be a military operation with the Oreshnik as a bonus.”
All ten articles identified across seven countries cited the same sources: the Russian MoD briefing and Telegram channels FighterBomber, Baza, and MIG, within a six-to-twelve-hour window after the strike. This is a single content pipeline with multiple local distribution points, not independent parallel reporting.
The second major disinformation narrative of May targeted European institutional legitimacy through a two-stage manipulation that illustrates how the proxy network builds content on top of real events.
The raw material was an interview with Slovak MEP Katarína Roth Neveďalová, broadcast on YouTube channel Diskusia na palete and published by Hlavný Denník. Neveďalová represents Smer-SSD, the party led by Prime Minister Robert Fico, which has consistently opposed EU sanctions on Russia and called for ending arms deliveries to Ukraine. She was among three Slovak Smer MEPs suspended from the Socialists and Democrats group in the European Parliament in 2023, with S&D citing “serious concerns” about their positions on the Russian-Ukrainian war, as Euronews reported at the time.
In the interview, Neveďalová claimed that von der Leyen “has health problems” and would be replaced by Emmanuel Macron, describing him as “more inclined towards rational solutions, for example on the issue of the war in Ukraine.” The claims are unsubstantiated. Von der Leyen was re-elected as European Commission President in 2024 and has given no indication of stepping down.
CZ24.news amplified the interview and added something Neveďalová herself did not say. The outlet’s headline read: “Sick Ursula will be replaced by Rothschild’s lackey Macron!” The Rothschild framing appears nowhere in the documented interview. It was introduced by CZ24.news at the editorial level, layering antisemitic conspiracy content onto a political interview to produce a headline that travels further and lands harder than the underlying content.
This editorial addition connects to a stable, long-running template operating across the pro-Kremlin European network. Frontnieuws, the primary Dutch-language amplifier serving Belgian and Dutch audiences, has applied the same framework repeatedly. A January 2026 article called Macron “Rothschild’s whipping boy” and claimed that “all European kingdoms have huge shares in BlackRock,” presenting this as the real explanation for European military support for Ukraine. A May 2026 piece went further: “England, Germany and France have now been declared financially bankrupt. There is nothing left to borrow from the private Rothschild bank.” French outlet Réseau International described Macron as “the child soldier of the Rothschilds,” adding that “what was asked of this Rothschild child soldier was simply to…” execute a financial elite agenda. Qactus, another French platform operating in the same ecosystem, named Rothschild and political adviser Jacques Attali as “the two godfathers” of Macron’s presidency, calling him “a true puppet” who “applied the Attali roadmap since 2017.”
The strategic logic of this narrative is distinct from the Oreshnik operation. Where narrative No. 1 targets Western public opinion on military support for Ukraine, narrative No. 2 targets trust in European governance as such. By presenting EU leadership as interchangeable agents of the same financial interests, it renders democratic accountability meaningless and European policy illegitimate by definition. The antisemitic framing is not incidental: it connects the content to older and deeper currents of European conspiracy culture, making it emotionally resonant with audiences who would not otherwise engage with explicit pro-Kremlin messaging.
On May 26, FSB Director Alexander Bortnikov addressed the 58th meeting of the CIS Council of Security Agencies in Irkutsk. “Under the close patronage of the West,” he declared, “Ukraine has become a serious factor of destabilisation. The result of the actions of the Kyiv regime was the transformation of the country into the largest centre for the smuggling of weapons and ammunition in Europe.” RIA Novosti published the statement the same morning. By that evening, the claim was circulating across the proxy network in multiple languages, accompanied in several cases by older content on the same theme recirculated to reinforce the impression of an established pattern.
The disinformation narrative that Western weapons supplied to Ukraine are flowing into criminal networks across Europe is one of the most consistently deployed and most thoroughly documented operations of the Russian-Ukrainian war. EUvsDisinfo has catalogued dozens of variants, each adapted to fit the news cycle: gang violence in Sweden, the July 2023 riots in France, the Hamas attacks of October 2023, drug cartel activity in Mexico. In each case, the core claim, that Ukraine is systematically reselling NATO weapons to criminal or terrorist actors, has been made without verifiable evidence and explicitly refuted by the governments whose citizens were supposedly affected. As a Harvard International Review analysis documented, reports linking weapons from Ukraine to Finnish gangsters, French rioters, Nigerian fighters, and Mexican cartels have all been debunked as Russian propaganda designed to pressure the United States and NATO allies into reducing arms transfers.
The May 2026 version follows the same structural logic. Bortnikov’s sweeping categorical claim is supported by a single anecdote, the alleged interception of 500 explosive devices at the Russian-Belarusian border in early 2026, with no independent verification. It was made by the director of a Russian security service at a meeting of post-Soviet security services and transmitted by Russian state media without critical distance.
The proxy network added its own layers. Réseau International linked arms trafficking to drug trafficking and organ trafficking in the same sentence, describing “a massive trafficking of weapons, drugs and human beings (prostitution, organ trafficking)” developing in Ukraine over the past four years. CZ24.news recycled an older piece directly accusing Ukraine’s military intelligence directorate, the GUR, of being “deeply involved in transnational organised crime networks,” with members “previously convicted of arms and drug trafficking,” lending apparent historical depth to Bortnikov’s fresh statement. Hlavný Denník framed Ukrainian EU accession as a continent-wide security threat: “Ukraine is the most armed country in Europe, without weapons oversight. Increased arms trade, human trafficking, mafia, money laundering, drugs, increased crime, social tension are threatened.”
What the network omits is the actual state of the evidence. Europol has warned that Ukraine “could become a significant source of illicit firearms and ammunition in the short to medium term,” but simultaneously clarified that “large-scale detections” of weapons smuggled from Ukraine into the EU have remained limited. The gap between Europol’s cautious, forward-looking assessment and Bortnikov’s categorical present-tense declaration is precisely the space in which this disinformation operates. The goal is not to document arms trafficking. It is to make continued weapons deliveries to Ukraine politically and morally untenable for European audiences.
Three disinformation narratives, three strategic objectives, one operational infrastructure. In May 2026, CZ24.news and Hlavný Denník functioned as the Czech-Slovak content production hub, translating and distributing Russian state media and Telegram channel material with local political framing added at the editorial level. Frontnieuws served Dutch and Belgian audiences. Newsnet and Réseau International covered the French-language market. Spanish outlets Geoestrategia and Diario Octubre completed the southern European distribution. All drew from the same source material: Russian MoD briefings, FSB statements, and a handful of pro-Russian Telegram channels, within windows that in several cases did not exceed six hours from the original Russian publication.
As Insight News Media reported, the EU had just sanctioned two additional organisations, Euromore and Pravfond, for ongoing influence operations targeting European audiences. The proxy network operating across Central and Western Europe in May demonstrates why enforcement at the level of individual organisations leaves the underlying infrastructure intact. The outlets are numerous, the financial structures deliberately opaque — as Voxpot’s investigation into CZ24.news found, the money flows through shell companies from the Seychelles through Britain and Slovakia — and the content pipeline replenishes itself with every news event that Russian state media chooses to weaponise.
Three of RIA Novosti's most prolific columnists are personally sanctioned by the EU for denying…
Russia is running a coordinated disinformation campaign portraying the Ukrainian government as deliberately replacing its…
Russia moved to deny responsibility for a deadly missile strike on a Kyiv apartment building…
Ukraine's Centre for Countering Disinformation and the UK's most senior government communications official have met…
Vladimir Putin arrived in Beijing on May 20 seeking concrete wins. He left two days…
When Ukraine's anti-corruption institutions proved they could reach the very top, Russia's response was immediate:…