Ahead of the second round of voting on 8 December in Romania's presidential election, Bucharest and its Western allies are directing all their efforts into trying to detect any signs of Russian interference in the surprise breakthrough of far-right outsider and pro-Russian candidate Calin Georgescu, who led in the first round on 24 November. An investigation led by Intelligence Online and the Romanian news site Snoop backed by the European Fund for Investigative Journalism, IJ4EU, can now reveal the extent of the pro-Russian network gravitating around the Russia-tied marketing agency AdNow, which is playing a key role in Romania's presidential campaign. This same operator made a name for itself for leading previous disinformation campaigns in Europe.
France was previously the target of one of AdNow's disinformation drives. On 24 May 2021, when the country was grappling with the COVID-19 epidemic, the French science blogger Léo Grasset who runs the popular science channel Dirty Biology, publicly revealed that he had been approached by a digital marketing company called Fazze. The firm allegedly based at 5 Percy Street in London wanted to pay Grasset to broadcast information denigrating Pfizer's vaccine.
Grasset was one of several social media influencers around the world to be approached by AdNow with the same deal. All were asked to circulate the idea that the US-made vaccine would "turn people into monkeys". These companies were also asked to be "passionate about the subject", and claim that "the mainstream media were not talking about it" and "encourage people to draw their own conclusions" about the matter.
The shadow of Moscow
Fazze, it turned out, was a shell company, with a London address behind which was hidden another marketing company, AdNow, which is based in Moscow but has a subsidiary in London.
The firm is headed by Yulia Serebryanskaya, a former Russian state media employee, who then did PR for Dmitri Medvedev and Vladimir Putin's election campaign in 2012. She also headed the political advertising department for the central executive committee of Putin's political party, United Russia. In London, AdNow is also registered at 5 Percy Street and is run by Russian national Stanislas Fesenko aided by Ewan Tolladay, who is a British citizen.
According to the UK media outlet Finance Uncovered, 5 Percy Street is also the address of the company Always Efficient LLP. The London-based firm operated on the BTC-e cryptocurrency platform used by Russian military intelligence (GRU) hackers known as Fancy Bear, who interfered in the 2016 US presidential election. Always Efficient is run by Sandra Gina Esparon and Evaline Sophie Joubert, whose names previously appeared in a 2019 Bellingcat investigation looking into money laundering schemes in the British capital. Prior to running Always Efficient, the two executives ran Enchanted Business Solutions LP, before that firm was taken over by Fesenko.
Taking over the European information space
Influencer Grasset's revelations came as a shock in France, which was struggling with the health crisis brought on by the pandemic. While the French health minister at the time, Olivier Véran, called the scheme "pathetic", "dangerous" and "irresponsible", he did not go as far as publicly attributing the disinformation operation to Russia. The campaign failed, but the identity of the client on whose behalf Fazze and AdNow were acting remained secret and the disinformation operation was not formally attributed.
We undertand that while French domestic intelligence (DGSI) did investigate the Fazze-AdNow case, their conclusions were not publicly revealed. It wasn't until August 2021 that Meta (formerly Facebook) closed 65 accounts on its social network and 243 Instagram accounts linked to Fazze and AdNow, which were spreading anti-vax conspiracies.
Based on leaked financial documents emanating from AdNow's galaxy, Intelligence Online and its partners can now shed light on the operator's activities and how they spread into the European information space from Romania. The marketing agency can be linked to a vast campaign of interference targeting Europe and the United States that can be attributed to the Russian state.
Romanian breeding ground
The Grasset affair was far from AdNow's first foray into information manipulation. The operator was active in Romania long before its activities were revealed in 2021. It appears the company tested various interference and manipulation of information strategies in the eastern European country before exporting them more widely to Europe.
Financial documents also show that AdNow has had close financial links for years with Romania TV (RTV), which is the most widely watched local television channel in Romania and makes no secret of its pro-Russian bias. RTV has been fined over one hundred times and sanctioned more than any other Romanian television channel by the country's media regulator for broadcasting false information. It was recently fined 100,000 lei (€20,000) for the broadcast of 16 programmes against Romanian presidential candidate George Simion, a former colleague of Georgescu.
Between 2016 and 2020, almost €100,000 transited from AdNow to Romania TV's companies. According to the documents consulted by Snoop and Intelligence Online, the funds came from two accounts located in Latvia and Cyprus, countries not known for being particularly transparent.
Russian money questioned
AdNow paid Romania TV to publish advertisements on its website for "alternative" medicine but also for dubious financial investments enticing its viewers to earn "easy money". Over the past few years, AdNow has made regular, fixed payments of €7,000 to RTV. According to online advertising experts interviewed by Intelligence Online and Snoop, these sums do not seem to coincide with the website's recorded traffic of just over 300,000 visitors per month.
For the numbers to add up in the light of AdNow's pricing grid, 33% of visitors to the RTV website would have had to click on AdNow ads, a far cry from online advertising stats, given that only 0.47% of users on average end up clicking on the advertising banners. According to a channel official who wished to remain anonymous "clicks definitely did not exist". The editorial content coordinator for RTV's website, Mihai Oprea, declined to answer our questions about AdNow's Russian money.
But Romania TV is not the only medium to have benefited from money from the Moscow-based firm. Half a million euros were also poured into advertising firm Digital Atelier Interactiv SRL's accounts. Until it closed in 2021, the agency prided itself on placing ads in major Romanian media outlets as well as in more confidential blogs.
Like Romania TV, the advertising agency also received regular payments, which can be broken down evenly into monthly sums. On two occasions, however, these sums appeared particularly high: in April 2019, one month before the European elections in May; and in late 2019, when the last Romanian presidential election was held.
Between 2016 and 2020 in Romania, AdNow made payments totalling almost €2m to Romanian companies. This figure, however, does not take into account possible payments in cryptocurrency or those made through payment firms such as PayPal or Revolut. AdNow currently runs advertisements on 85 websites, including on the European channel Euronews's Serbian site.
First-hand accounts
Intelligence Online and Snoop tracked down several AdNow employees in Romania, including one of its executives, a former communications student who graduated with a master's degree in "brand management" in Moscow. In a interview, this senior manager denied any Russian links with the company and she added that AdNow now operates from a company registered in Bulgaria, Renodo Media Ltd, owned by a Georgian citizen, Giorgi Valerievich Abuladze. While this information corroborates with what is posted on AdNow's website, Abuladze is in fact a trustee representing more than fifty companies world-wide, some of which are in the United States, Niger and Europe.
The AdNow employee disclosed that when revelations around Fazze were made in 2021, the company was told on no accounts to reply to the media: "We were told that if anyone from the BBC or any other organisation contacted us, we were not to reply," she said, adding that"we are no longer linked to Russia [...], we have never collaborated with Russia", although she said that the company's "owner is Russian".
Another AdNow employee in Romania, however, told Intelligence Online that "all the ads he has had to work with came directly from Russia and were systematically linked to false identities " that did not lead to anything.
Doppelgänger campaign
Some of AdNow's ads identified by Intelligence Online and Snoop stand out in particular. Several of these advertisements directly promote fake websites impersonating real media, such as the Romanian versions of French news station RFI (rfi.ro) and Romanian TV channel Digi24 (digi24.ro). This type of identity theft is reminiscent of the Russian influence operation Doppelgänger, which has previously targeted RFI (IO, 22/07/24).
This operation, initially revealed by the European anti-disinformation NGO EU DisinfoLab in September 2022, was attributed directly to Moscow by France through the French foreign affairs ministry in the summer of 2023. This attribution coincided with the publication of a report by the French anti-disinformation agency Viginum in which two companies, Struktura and Social Design Agency (which had close ties to the Russian state through their directors), were identified.
When asked about these ads, the head of AdNow in Romania interviewed above denied their existence. Shortly after our phone call, however, these ads were discreetly withdrawn from AdNow's partner sites.
UberEats copycat
In 2018, AdNow also launched a food delivery app in Romania called FoodEx, whose slogan was "Take FoodEx anywhere". This new app paid for several advertising inserts to promote itself and spoofed photos of a Michelin-starred Singaporean restaurant. Although several people tried to use it and were able to create an account and enter their personal details, the application never functioned. The address that was listed as being that of its headquarters in Malta was in fact that of a hotel.
Before FoodEx vanished, job offers for the AdNow delivery application were posted on the Facebook page of a Russian citizen, Daniil Starkov. His LinkedIn profile claims he has held positions at Mail.ru and VKontakte, two of Russia's largest technology companies. Intelligence Online and Snoop were able to view Starkov's CV in which he claims to be a graduate of the "Presidential Programme", a university programme organised by the Russian Ministry of the Economy. Starkov did not respond to interview requests.
After FoodEx disappeared, the application's Facebook account was renamed after Matei Sergio, a candidate in the Romanian parliamentary election for the Youth Party (Partidului Oamenilor Tineri), launched last year and which was the first to openly support Georgescu. This party was founded by Ana Maria Negrilă, a former MP for the conservative Alliance for the Unity of Romanians (AUR).
Conspiracy influencers funded from 2017
In Romania, AdNow relied on influencers long before it approached France's Grasset in 2021. In 2017 and 2018, the Russian company honed in on health influencer Andrei Laslau, investing €200,000 in his business over that period. During the Covid-19 pandemic, the man who presents himself as the "Romanian Dr Oz" racked up millions of views on his publications promoting the COVID conspiracy theory.
Laslau claims that AdNow and its Russian sponsors chose him because of the "enormous traffic" generated on his website, and said he had no interest in knowing where this money came from. After the pandemic, he continued making money by promoting conspiracies. He now publishes conspiracy theories about the forced enlistment of Romanians to fight in Ukraine.
Another Romanian influencer paid by AdNow is Daniel Polifrone, a former policeman behind the pro-Russian, anti-Western conspiracy website AZ News. Between 2017 and 2020, this former policeman, who is also a practising Catholic, received more than €50,000 from AdNow. When asked about the start of his collaboration with AdNow, he explains that he "discovered this advertising company on one of the websites of a Romanian television channel. [He] opened an account, inserted a piece of code into the site and the adverts [appeared] offering creams and the like". Polifrone declined to comment on how his collaboration with AdNow ended, but it coincided with the outbreak of the Fazze/AdNow affair in France.
The latest alternative medicine conspiracy influencers to be funded by AdNow are Razvan Miulescu and Nicoleta Miulescu, behind Secret Media, another conspiracy site that was particularly active in spreading disinformation during the pandemic and which received more than €100,000 from AdNow between 2017 and 2019.
The same strategy of funding conspiracy figures is alive and well in 2024 in the United States. The US Department of Justice reported that several conservative and conspiracist influencers had received several millions of dollars from Russia to finance their activities. In total, the company Tenet Media, through which the Russian funds passed, received around $10m through two employees of RT, the Kremlin's propaganda TV channel. By now, Moscow's operations are a well-oiled machine, having been tried and tested in Romania.
