ANB: discovered network of cloned portals in North Macedonia linked to Russian interests

The Agency for National Security (ANB) announced that it has uncovered a foreign media network registered in North Macedonia that operated in favor of Russian interests by undermining trust in institutions, stoking ethnic hostility and obstructing the country’s Euro-integration processes. Authorities say one Macedonian citizen is suspected and a search of his home produced items now undergoing forensic analysis.

Background and earlier actions

Authorities first disclosed related counter‑hybrid operations on March 4, 2026. "The Public Prosecutor's Office and the Ministry of Internal Affairs/BJB, synchronously undertook organized measures and activities for criminal prosecution of persons and the seizure of propaganda materials that aim to cause ethnic and national intolerance, discord and hatred among citizens. The persons covered by the criminal complaint, through printing and distribution of propaganda material, planned to incite hatred towards the Macedonian state and identity and to cause tensions, and through the social network Facebook, on the page 'Historical Data for Macedonia' shared content that causes national and ethnic discrimination," ANB said at the time.

The Basic Public Prosecutor's Office later announced criminal proceedings against a single person under the charge of "Spreading racist and xenophobic material via a computer system" (Article 394‑g of the Criminal Code). "The suspect, through a specially created page on the social network Facebook, shared content that causes national and ethnic discrimination thereby instigating hatred against the Macedonian state and identity. Based on prior information from the Agency for National Security, police officers carried out a search and seized propaganda material that the 30‑year‑old Skopje resident had printed intending to distribute it in the country. The suspect was encouraged in these activities by a Bulgarian citizen who for a long period on social networks and other portals has published content whose aim is to incite hatred, intolerance and violence," the prosecutor's office said then.

ANB’s more recent statement frames the uncovered structure as a network of "cloned pseudo‑portals" using Macedonian internet domains to conceal the real actors. "The real actors of this propaganda network that functions in the interests of Russia hide behind cloned pseudo‑portals registered with a Macedonian internet domain. Through these pseudo‑portals false news, disinformation and reshaping of narratives about current events are spread, thus undermining trust in institutions and encouraging ethnic and national hatred and intolerance. The listed activities are a continuation of previously thwarted pro‑Russian hybrid activities of a Macedonian citizen, linked to these propaganda networks, for whom a criminal complaint had been filed for the criminal offense 'Spreading racist and xenophobic material via a computer system' under Article 394‑g of the Criminal Code," ANB said.

Investigations and independent checks have tied the online operation to a Sofia‑based organization called the Macedonia Foundation and to a Bulgarian national, Viktor Stoyanov, who is reported to be banned from entry into North Macedonia. A mid‑July probe identified at least five Facebook pages in Macedonian run from Bulgaria that presented themselves as media outlets; these pages republished items from five locally registered websites and one foreign site, all with very similar layouts and duplicated content. The foreign site was found to be address‑ and capital‑linked to the Macedonia Foundation in Sofia.

The domestic portals implicated were registered under two individuals: Aleksandar Smiljkov registered two sites, while Asen Petrovski registered three. Contact emails on record in the national domain registry include vestimak.mk@gmail.com and v4vfoundation@yahoo.com. ANB says the behaviour it describes — cloning domains, spreading false reports and reworking narratives — matches the operation pattern of those portals. A search of the suspect's home took place on 18 September; despite the probe and material seizures, the relevant portals and Facebook pages have continued to operate.

After ANB’s announcement the Macedonia Foundation posted on Facebook denying the characterization and accusing the security agency of arresting pro‑Western journalists. In that post the foundation claimed: "ANB arrests independent journalists who run pro‑Western media in Skopje, while publicly claiming that it arrested 'representatives of Russian propaganda'. Mucunski falsely claims that the request in the French proposal to stop hate speech in the Skopje media represents 'censorship of their media'. ANB seizes television equipment from an independent pro‑Western medium and falsely claims that that medium is connected to a pedophile from Bitola. It turns out that the pedophile from Bitola is a friend of Mickoski and a member of the top leadership of the ruling party VMRO‑DPMNE. The Mickoski government officially provides documented funding for public figures in Skopje who promote Russian propaganda in the country, while at the same time arrests pro‑Western journalists and presents them to the public as 'representatives of Russian propaganda' – even though Russian propaganda in the country is financed by the state, i.e., by Mickoski's government. We will put an end to these filthy lies and manipulations. Now."

Photo: press material from the event