Russian traces in the 2025 Dutch elections

Team Members

Dr Serge Poliakoff (UvA), Lera Malchenko (OSAVUL), Xun Gao (UvA), Alan B. Joseph (UvA)

Introduction

Research on Russian influence operations has shown that foreign electoral contexts often become targets for a broad ecosystem of state-aligned and proxy actors engaged in coordinated information activities. Decades of empirical work have documented how Russian entities exploit social media infrastructures to influence political processes, including their attempt to interfere in the 2016 US presidential election through the Internet Research Agency (IRA) and wider campaigns targeting foreign audiences across Europe. These findings are supported by extensive academic literature analysing IRA-linked activity on Facebook, Twitter, and Instagram (e.g. Bastos & Farkas 2019; DiResta, Grossman & Siegel 2022; Lukito et al. 2020), as well as broader research on active measures and political warfare (Rid 2020).

Recent analyses of Russian disinformation production organisations (DPOs) demonstrate that these entities operate as part of a structured industry rather than as loosely organised campaign units. Studies of the IRA and its successor, the Patriot Media Group (PMG), show that the workforce expanded and contracted in ways closely aligned with major political events, including the 2016 US election and the Russian presidential elections in 2018. The IRA’s emergence in 2013–2014 coincided with Russia’s annexation of Crimea and hybrid aggression in Donbas, while its later decline aligned with the exposure of the “troll factory” to journalists. These organisations targeted both domestic and foreign audiences, conducting propaganda, agitation, and influence operations in the Soviet sense under one institutional roof (Poliakoff, 2025).

This organisational infrastructure has evolved further with the rise of ANO Dialog, which now operates as a state-financed, centralised, nationwide digital governance structure. Unlike the PMG, which relied on an oligarchic contractor model, ANO Dialog works directly with the Presidential Administration and maintains regional offices across almost the entire Russian and Russian-occupied territory. It has been linked to international operations such as “Doppelgänger”, and its domestic practices increasingly resemble features of Chinese-style digital authoritarianism, including centralised monitoring and coordinated propaganda dissemination.

Beyond these longer-standing actors, recent investigations show that Russian influence operations increasingly rely on proxy firms and AI-enabled techniques that expand the scope of traditional disinformation campaigns. The so-called Doppelgänger operation illustrates this shift: Social Design Agency and its affiliated entities created cloned news websites, fabricated bylines and AI-generated articles to impersonate reputable European media and seed manipulated narratives across France, Germany, the UK and the US. This activity has been documented both in US Department of Justice proceedings, which identify SDA as a contractor involved in covert malign influence operations, and in reports by independent research groups such as the Institute for Strategic Dialogue and Viginum, who detail how cloned domains, coordinated amplification and paid ads were used to undermine support for Ukraine. These campaigns increasingly integrate generative AI for content fabrication, automated translation, and large-scale narrative replication, a trend that ISD and Viginum describe as early forms of “LLM grooming”, in which influence actors attempt to manipulate or exploit model outputs to reinforce state-aligned propaganda. This evolution shows that Russian information operations now involve not only legacy DPOs such as the IRA, PMG or ANO Dialog but also technologically adaptive contractors capable of scaling cross-lingual and cross-platform manipulation.

Beyond organisational evolution, Russia has also adapted to platform governance regimes. Research shows that Russian state-aligned news outlets continued to reach large foreign audiences on Facebook before and after the full-scale invasion of Ukraine, despite EU sanctions and content moderation interventions (Kling & Poliakoff 2025). Studies of these information flows demonstrate the complexity of platform governance and the persistence of authoritarian content in non-Anglophone digital environments.
Against this empirical and conceptual background, the Dutch parliamentary elections of 2025 present a relevant case for assessing the presence and significance of Russian-linked information activity. The Netherlands is a highly digitalised media environment with a history of political contention around foreign influence. Based on the evidence from prior research, Russian actors typically exploit moments of heightened political attention, and foreign elections often serve as windows of opportunity for influence attempts.
To investigate this possibility, we conducted a targeted monitoring exercise during the Dutch election period using the OSAVUL platform.

Our assessment combined platform signals, cross-channel amplification patterns, text reuse detection, and a small-scale audit of search engine results to determine whether observed cases represented coordinated campaigning or isolated, low-significance events.

Research Questions

Guiding this investigation were two research questions:
RQ1: Whether any coordinated campaigning by Russian-linked entities occurred in the Dutch online election space.

RQ2: Whether the identified cases met the threshold for being considered reportable under prevailing platform policies.

Methodology

The analysis draws on a multi-step workflow designed to detect, verify and assess Russian-linked informational activity during the Dutch 2025 parliamentary elections. The first stage involved continuous monitoring through the Osavul platform, which identifies potential coordination signals, cross-platform amplification patterns and emerging narratives associated with known Russian propaganda infrastructures.

Building on these initial signals, we conducted a systematic manual verification process. This included targeted text comparison to identify near-duplicate or templated content, narrative alignment analysis to evaluate whether posts reproduced recognisable themes, and temporal sequencing to determine whether multiple actors engaged in coordinated posting behaviour. We also carried out a small-scale audit of search engine results (Google, Bing, DuckDuckGo, Brave) to assess whether cloned or low-quality websites were being artificially elevated in queries related to Dutch electoral topics. This allowed us to test whether amplification patterns reflected organic dynamics or deliberate manipulation consistent with previous Russian-attributed operations.

All detected cases were evaluated against two criteria: the presence of identifiable coordination (cross-account, cross-platform or cross-domain) and the threshold of reportability under existing platform policies. These assessments served as the basis for identifying the five cases described in the following section.

Findings

Case 1: Hate Speech Circulation Around a 2017 Geert Wilders Speech

The first detected case concerns the renewed circulation of a short clip extracted from a 2017 speech by Geert Wilders, in which he described Islam as a civilisational threat to Europe and linked Muslim immigration to the decline of Western freedoms. The original video was recorded on 21 May 2017 and remains available on YouTube (https://www.youtube.com/watch?v=IiHNXmRPnm8&t=413s); the specific segment that circulated during the 2025 Dutch elections begins at 5:02. The version detected in our monitoring appeared in a TikTok -style cropped format and was amplified primarily on X. The most recent instance observed during the election period was posted on 27 October 2025 (e.g. https://x.com/vladkruz64/status/1982939884613767341), with no subsequent reposts or commentary waves identified after that date.
A review of the amplification history shows that the clip has circulated episodically throughout 2024 and 2025, with earlier peaks unrelated to Dutch electoral events. The accounts sharing the clip during the 2025 campaign were small or mid-sized X profiles that typically disseminate anti-immigration or anti-Islam content. The amplification pattern shows that the clip was shared by a broad, heterogeneous set of accounts. According to OSAVUL’s classification, 13 accounts were identified as Russian-linked, compared to much larger clusters of approximately 190 US-based and 110 UK-based accounts engaging with the content. The Russian-classified accounts formed only a small minority within this wider pool, and their activity showed no internal synchronisation, no shared posting rhythm, and no clustered behaviour that would suggest coordinated participation. Instead, they appeared as individual actors contributing to a larger, organically driven wave of engagement dominated by Western accounts.
All instances identified during the election period were reported on X as hate speech or incitement. Platform moderation rejected all submissions. The activity captured here does not meet thresholds for coordinated or state-linked influence. The Russian-classified accounts participated only marginally.

For these reasons, this case is assessed as low-significance in the context of Russian-linked operations. It shows limited Russian participation within a much larger, primarily non-Russian amplification environment, and lacks indicators of coordination or intent necessary for reportability as a Russian influence operation.

Case 2: PolitNavigator and Arhano.ru Link Flooding Within the Pravda Network

The second case concerns a pattern of link flooding to two Kremlin-aligned propaganda websites, PolitNavigator and Arhano.ru, both of which have been repeatedly identified in OSINT, NGO, and journalistic investigations as components of the contemporary Russian information ecosystem.

PolitNavigator is a long-running pro-Kremlin outlet with roots in Crimea, active since at least 2014, known for publishing anti-Western and anti-Ukrainian narratives and operating firmly within the Russian propaganda environment. PolitNavigator is linked to Sergey Stepanov, a Russian journalist based in Sebastopol with suspected FSB intelligence connections; the platform serves as a key amplification node within the Pravda Network, cited as a primary source in nearly 42,000 network posts. Its English-language section and Telegram channel (@Politnavigator) demonstrate a consistent editorial line aligned with Kremlin messaging, systematically republishing content from Russian state media and affiliated channels.​

Arhano.ru is a smaller but stylistically comparable portal that regularly mirrors or reframes geopolitical events from a pro-Russian perspective. While appearing with lower frequency in mainstream OSINT datasets, it functions as part of the low-to-mid-tier infrastructure feeding the ecosystem known as the Pravda Network—a multilingual, cross-platform Russian disinformation infrastructure extensively documented by GLOBSEC (2023), the Atlantic Council's DFRLab (2025), Reset (2024), and VIGINUM (2025).​

According to BISI research (2025), the Pravda Network operates hundreds of websites globally, mimicking local news outlets to amplify pro-Kremlin narratives, comprising over 3.7 million published articles designed to replicate legitimate local news portals across Europe, the Americas, and Asia. The network systematically avoids original content creation, instead focusing on large-scale copy-paste amplification of narratives favourable to the Kremlin, sourced directly from Russian state media (Sputnik, RT, RIA), Telegram channels, government statements, and pro-Kremlin social media accounts, then translated via automated tools.​

During the Dutch 2025 election period, OSAVUL detected repeated sharing of materials from PolitNavigator and Arhano.ru that commented on, reframed, or distorted a Ukrainian article about the Dutch elections. A representative example was the circulation of [arhano.ru/archives/57960], which provided propagandistic commentary on the Ukrainian original (https://www.eurointegration.com.ua/rus/articles/2025/10/24/7223201/). These links were not primarily disseminated on mainstream social media but rather flooded across the open web, appearing on VK (e.g., Zello Novorossiya) and Telegram channels (e.g., Archanonews), where they were embedded into posts serving to amplify or legitimise the underlying narrative.

The distribution pattern follows a typical Pravda Network logic. Content was spread in three languages - approximately 50% English, 25% Dutch, 25% Russian - mirroring known Pravda Network practices of combining multilingual machine translation, recycled narratives, and cross-platform seeding to generate the appearance of broad relevance. Prior investigations document that the Pravda Network engages in search-engine grooming and LLM-grooming, deploying large numbers of near-identical articles and cloned pages to shape search visibility and language model outputs.​

This contextualizes why PolitNavigator and Arhano.ru appear together: both regularly feed the wider amplification loop, and their cross-posting behaviour reflects ecosystem strategy rather than targeted messaging toward Dutch audiences. According to DFRLab tracking, activity spikes in Pravda Network publications correlate with major news events such as election cycles, war developments, or arrests of high-profile Russian figures.​

Amplification during the Dutch elections was modest and internally contained. Activity ceased entirely after 27 October. The behaviour therefore aligns with routine ecosystem churn typical of Russian propaganda infrastructure rather than a targeted influence operation aimed at Dutch voters.​

Given its limited scale, lack of tailored messaging, and absence of coordinated cross-platform behaviour relevant to the Dutch information space, this case is assessed as non-reportable in the context of Russian interference in the 2025 Dutch parliamentary elections.

Case 3: Search Engine Manipulation via the Pravda Network

The third case illustrates a pattern of search engine manipulation characteristic of the Pravda-network ecosystem. The sequence began with a legitimate Reuters article published on 25 October 2025 under the headline “Dutch far-right leader Wilders says voters should decide on his future in government”. Shortly afterwards, the Telegram-only outlet REST Media reposted the story but with a modified headline: “Wilders, Dutch voters, not elites, should decide next government”. The two versions share a core keyword overlap - Wilders, Dutch voters, should decide, government - while REST Media inserted the ideologically loaded term “not elites”. This is consistent with REST Media’s previous activity in Moldova, where the outlet acted as a publishing bridge between mainstream wire reporting and pro-Kremlin reframing.
Following the REST Media post, the story entered the Pravda-network replication loop. According to OSAVUL’s timestamps, EU Pravda amplified the REST Media version seven minutes after publication, Global Pravda followed at eight minutes, and the Russia Today Telegram channel amplified it twenty-five minutes later. This pattern of near-simultaneous cross-posting reflects the network’s semi-automated practice of rapidly cloning or lightly rephrasing content across multiple low-credibility domains. Additional Pravda-aligned sites continued the amplification chain afterwards, reproducing the reframed version of the story across further websites and Telegram channels in the hours that followed. This temporal structure matches the network’s established technique of generating numerous near-identical pages to improve the likelihood of appearing in search queries attached to breaking news.

To evaluate whether these manipulations influenced search visibility, we conducted a small audit across Google, Bing, DuckDuckGo and Brave. As in other documented Pravda-network cases, the cloned articles did not appear for neutral or straightforward Dutch-election queries. They did emerge, however, when queries included ideologically coded terms such as “elites”. This outcome is consistent with the network’s approach to search-engine grooming, where content is not designed to enter mainstream visibility but to surface for users whose search behaviour already leans toward conspiratorial or anti-elite framings.

Although this case coincided with the Dutch election period and followed the characteristic structure of Pravda-network manipulation - rapid headline reframing, keyword overlap with legitimate reporting, and immediate multi-domain replication—its scale and impact remained limited. The activity did not target Dutch-language spaces and did not spread beyond the usual ecosystem of Pravda-network sites and affiliated Telegram channels. The pattern is therefore best understood as a representative example of low-effort search-engine manipulation rather than a coordinated attempt to influence Dutch voters.

Case 4 and Overall Assessment

Beyond the three cases described above, we detected an additional pattern of activity that exhibited a noticeably higher level of coordination and therefore warrants separate, more detailed treatment. This fourth case involves the subordinated segment of the Pravda-network and its interactions with a set of Dutch-facing amplification channels. In contrast to the low-significance patterns observed in the first three cases, this cluster showed more structured cross-platform behaviour, clearer temporal alignment between nodes, and a stronger link to Russian information infrastructures. Because a parallel research team worked on the same cluster and collected a substantially larger body of evidence, this case is be documented in a stand-alone report (LINK TO REPORT). We refer readers there for the full analysis.

Conclusions

For the remaining activity observed during the Dutch 2025 elections, the findings are consistent. Each case illustrates mechanisms associated with Russian-linked information operations - hate speech circulation, ecosystemic link flooding, and search manipulation - but the scale, targeting and coordination remain limited. Most signals did not meet platform thresholds for coordinated inauthentic behaviour or foreign influence, and none of the cases demonstrated attempts to penetrate Dutch-language information spaces in a sustained manner.

The cumulative assessment is that, while fragments of Russian-linked activity were detectable around the election period, they were either episodic, low-effort, or confined to the habitual churn of the Pravda-network ecosystem. The one exception, the coordinated fourth case, will be addressed comprehensively in the forthcoming dedicated report (LINK TO REPORT).

Bibliography

Bastos, M. T., & Farkas, J. (2019). “Donald Trump is my president!”: The Internet Research Agency propaganda machine. Social Media + Society, 5(3). https://doi.org/10.1177/2056305119865466

Council of the European Union. (2023). Council Implementing Decision (CFSP) 2023/… concerning restrictive measures in view of Russia’s actions destabilising Ukraine.

DiResta, R., Grossman, S., & Siegel, A. (2022). In-house versus outsourced trolls: Digital mercenaries and state influence strategies. Political Communication, 39(2), 222-253. https://doi.org/10.1080/10584609.2021.2003057

Doroshenko, L., & Lukito, J. (2021). Trollfare: Russia’s disinformation campaign during military conflict in Ukraine. International Journal of Communication, 15, 4662-4689.

Lukito, J., Suk, J., Zhang, Y., Doroshenko, L., Kim, S. J., Xia, Y., & Wells, C. (2020). “Foreign news” through a US lens: How Russian IRA content emerged on Twitter. Journalism Studies, 21(7), 874-893. https://doi.org/10.1080/1461670X.2020.1724187

Rid, T. (2020). Active measures: The secret history of disinformation and political warfare. Profile Books.

U.S. Department of Justice. (2018). United States of America v. Internet Research Agency LLC et al. (Indictment, Case 1:18-cr-00032).

U.S. Department of the Treasury. (2023). Treasury takes action as part of a U.S. Government response to Russian malign activities [Press release].