Drone Incursions in Romania Were Followed by a Coordinated Online Storm
Collaboration: Matei Vrabie (Funky Citizens)
Illustration: Funky Citizens 2026-06-11
Collaboration: Matei Vrabie (Funky Citizens)
Illustration: Funky Citizens 2026-06-11
Drone activity near the EU’s eastern border has been recurring in the last months. But now, Russian drones have gone a step further—into Romania. On the night between May 28 and 29 and again almost exactly a week later on June 5, two drone incidents were observed in Romania. The incidents were also immediately present in different narratives across the online information space and stayed there as a result of artificially created networks of posts which operated for a week without intervention of the platforms.
On June 5, according to the Romanian Ministry of Defense, a Ukrainian naval Magura-type drone self-detonated in the Port of Constanța. The port hosts a major Romanian NATO facility, which includes a significant presence of the US military. At first, the attribution of the drone was unknown, and only defined by Romanian authorities as having been “used in the war in Ukraine.”. Only later did the Ukrainian Naval Forces confirm that it was a Ukrainian Magura vessel that lost control due to an interception by Russia during an operation in the Black Sea. Three other drones that self-detonated were also identified: two exploding 145 km east of Constanța and one outside of the port.
On the night between 28th and 29th of May, a Geran-2 drone crashed into a residential building in Galați, a city in Western Romania, resulting in a fire on the 10th floor, leaving a boy and his mother injured. Based on public briefings, the Romanian Ministry of National Defense did not intervene because of the low altitude; regulatory restrictions over such interventions during peace time; and high risk of shooting down a drone in a residential area. This happened a day after Romania received the second largest allocation of money—€16.68 billion—from the SAFE program, the newest EU-funded financial defense instrument. As a result of this incident, Bucharest expelled Russia’s consul general and closed the Russian Consulate General in Constanta.
What do the incidents have in common? The information space
Funky Citizens, a pro-democracy research and fact-checking NGO, analysed the information space on social media and media outlets before the first incident and a week after it to examine the coordinated campaigns that occurred as reactions to both incidents. The second incident happened in an already active information space, full of postings on drones after and because of the previous incident.
During both incidents, the window between the explosions and the official explanations by authorities left plenty of opportunities for alarmist and alternative explanations of the events. In numerous instances, these ended up being the same messages amplified by multiple accounts.
“The reports collected data across X, Facebook, Instagram, TikTok, Telegram, Reddit, Bluesky, and YouTube, but the coordinated network analysis focused heavily on Facebook pages. That’s where the synchronized posting patterns were documented in detail, with timestamps showing posts appearing seconds apart,” Matei Vrabie, a program manager and author of the report from Funky Citizens, told VSquare. “What stands out is that the platforms played different roles in how the narratives spread. X and Reddit saw more organic debate, with users arguing about whether the drone was Ukrainian, Russian, redirected, or deliberately sent. Facebook was where the coordinated amplification networks were most visible. Telegram was part of the broader dataset, but the reports do not document coordinated amplification there in the same level of detail.”
Going backwards: Starting at the Port of Constanța
Since the official explanation was absent, the Ukrainian origin was the only clue available in the online space and also the most prevalent narrative. The Magura model was identified by a military expert online using image analysis. Some posts took this basic analysis further and conjured up a false flag operation by Ukraine in the territory of Romania meant to force NATO intervention. The second most frequent narrative was aimed at discrediting the official authorities for detecting and leaving the drone in the port for hours before it self-detonated, sending a Ro-Alert (Romanian security alert system) only an hour after the explosion. The third was a counter-narrative, according to which the drone was Russian. This referred to the previous Galați incident, which was an already proven Russian drone. The most elaborate narrative combined technical elements with false interpretations, the constellation of which was hard to straightforwardly refute.
“These aren’t classic ‘fake’ accounts in the sense of being obviously bot profiles with no followers. The networks documented here have massive aggregate followings: one network had 49 million followers across 74 accounts, another had 33 million across 81 accounts. That scale suggests these are real, established pages that built genuine audiences over time by posting a mix of legitimate content, including entertainment, news aggregation, and lifestyle posts, alongside coordinated amplification when needed,” Vrabie told VSquare. “The key insight is that this makes them harder to dismiss and harder to take down. A page that posts recipes and viral videos most of the time, but gets activated to blast out disinformation during a security incident, looks very different from an obvious bot. The infrastructure was built before it was needed, and it is reused across incidents.”
Example of posts from different accounts within the network, Source: Funky Citizens
The crucial week between the incidents
A gap between the incident and the moment of official communication was also exploited a week before in the Galați incident. Two networks of coordinated pages were already active beforethe incident, spreading security-related narratives. They were already active a couple of days before the first incident in Romania. Cumulatively, Funky Citizens collected 14,033 posts from social media between 00:00 on May 28 and 11:00 on May 29. The biggest group were descriptive posts of the event, then official confirmations and international reactions from institutional accounts and diplomatic communications, followed by posts documenting casualties and consequences for the populations.
A wave of posts following the drone incident at the end of May, Source: Funky Citizens
As a result, when the incident in Constanța happened, the information space was already full of posts about drones from the previous week.
Compared to posts following the first incident, where narratives and coordinated posting networks emerged as a reaction to the incident, during this second week, the goal of the coordinated campaigns was to keep the subject on the public agenda. Hundreds of coordinated messages were identified in thousands of posts amplified in waves over the course of just a few days. Sometimes, the posts emerged within an interval of just seconds which suggests an automated system set up to ensure these posts stayed in users’ feeds throughout the day.
For seven days following the Galați incident, waves of coordinated posts kept the subject alive on social media. On June 4, 28 profiles posted the same message in 28 posts across four waves, promoting disinformation: these profiles insisted that the drone that hit the residential building was Ukrainian and that Vladimir Putin called for an objective analysis of the incident. A “typical responsibility-reversal narrative,” according to the researchers, even a week after the Romanian ministry of defense has already officially confirmed that the drone was Russian. These 28 accounts have 5.5 million followers, over 10.8 million views, and 63,000 shares.
On June 3, a network of 46 accounts distributed a message in 46 posts over three waves. This message connected the Russian war in Ukraine with a domestic Romanian politician, and garnered a total of 14 million followers across the 46 accounts, with the posts getting over 66 million total views, and approximately 1.2 million shares of the posts.
Example of posts from different accounts in one wave, Source: Funky Citizens
Similarly alarmist news was distributed using the same pattern every day, though each day the messages, frequency and numbers of posts varied. Even the Moldovan president, Maia Sandu, was present in one of the bigger bursts of coordinated messages: 81 accounts posting in four waves, earning over 102 million views.
Once again, the platforms chose not to interfere
The Digital Services Act forces the very large platforms to prevent systemic risks, which theoretically should include information interference through coordinated inauthentic behavior. However, in this case, as reported by Funky Citizens and others, neither the platforms nor the official institutions managed to react quickly enough by supplying their own accurate information or by blocking the disinformation and coordinated inauthentic behavior.
Recommendations, both technical and structural, exist to improve real-time detection and treat inauthentic coordinated behavior in incidents like this one as severely as they would be treated during elections.
The set up of these accounts is a key factor here: “First, the behavior itself is designed to look organic from a distance. Posting the same message across dozens of accounts in waves is often flagged by automated detection systems, but when those accounts have real followers, established audiences, and years of engagement history, they are harder to classify as coordinated manipulation. Second, the timing window is very short. The coordinated posts arrived in bursts of seconds or minutes, which means the content spread widely before any moderation response could realistically happen. By the time a human reviewer sees it, it may already have reached millions of users,” said Vrabie.
In the future, Vrabie sees less uniformity in the coordinated inauthentic behavior. As in this case, the posts use the exactly the same message and visuals in each post which makes them easy to discover. Another aspect that keeps changing: the speed of deployment of narratives, shrinking the gap between the real-life event and messaging. Lastly, there’s the content itself. “The next step, and there are already signs of this in the attribution-inversion narratives documented here, is to combine real, verifiable technical details with misleading or false conclusions. That kind of content is much harder to flag automatically because it is not obviously false and cannot be easily debunked with a simple search,” said Vrabie.
This analysis is based on report by Funky Citizens and further analysis by authors was published in two parts in Romanian here and here.
Subscribe to Goulash, our original VSquare newsletter that delivers the best investigative journalism from Central Europe straight to your inbox!
Tamara is a journalist from Slovakia, currently based in the Netherlands. Besides VSquare, she writes for The European Correspondent.