Social media platforms have turned into battlegrounds for influencing public opinion, often serving propaganda more than factual information.
They are being exploited to deliberately spread disinformation, especially in fragile regions where ethnic tensions and political insecurity create fertile ground for manipulation.
One such critical hotspot is north of Kosovo, due to its socio-political context which has now caught the attention of platforms like Telegram for the spread of false narratives and the mobilization of nationalist sentiments.
This research analyzes Telegram channels and content targeting this region, using open-source intelligence (OSINT) methods.
By tracking content shared through Telegram and its interaction with other social networks, well-coordinated campaigns have been identified that spread fabricated narratives aimed at deepening interethnic divisions, discrediting Kosovo institutions, and legitimizing an alternative historical narrative—primarily from Serbian and Russian sources.
The study is based on systematic analysis of materials, posts, and comments collected over the past three years.
The four northern municipalities bordering Serbia, predominantly inhabited by ethnic Serbs, have remained among the most tense areas since the 1999 war. Despite institutional efforts for integration this region remains fragmented and exposed to external influences, especially in the digital era of uncontrolled information.
Telegram, due to its anonymity, lack of moderation, and encrypted communication, has become one of the most widely used tools by disinformation actors. It serves as a breeding ground for nationalist narratives, anti-Western rhetoric, and messages that incite ethnic hatred and violence.
Serbian and Russian channels have increased their activity in recent years, turning their attention toward Kosovo, especially during periods of tension and alongside the war in Ukraine. According to the analyzed data, over half a million users follow pro-Serbian and pro-Russian Telegram channels targeting the Western Balkans, including Kosovo. Among the most influential channels in Kosovo are: “BUNT Je Stanje Duha” (Rebellion is a State of Mind), “Koridor”, “Bunker”, “Slovenski Medved” (Slovenian Bear), and “Srpska Sparta” (Serbian Sparta).
These channels are not merely alternative news sources but strategic instruments of disinformation and radicalization. They spread synchronized anti-NATO and anti-EU content aimed at undermining the legitimacy of Kosovo’s statehood and promoting a sense of Serbian historical victimhood. They also frequently identify and threaten Serbs cooperating with Kosovo institutions, labeling them as “traitors”.
Lynching and direct calls for violence
A concrete example of these campaigns is the “Koridor” channel, which operates in north of Kosovo and incites coordinated attacks against individuals, institutions particularly security ones, and initiatives promoting interethnic cooperation.
With over 10,000 followers, “Koridor” distributes images and messages with clearly threatening content. The channel promotes Serbian nationalist content, evident from posts in the Serbian language and narratives focused on Kosovo.
One post displays an armed Kosovo police officer with the caption: “How I wish I could fire every bullet at the target.”
Threatening post against the Kosovo police officer
This direct incitement to violence was widely shared and received thousands of reactions, many supportive.
The narrative of this channel is built on strong nationalist elements, often referencing Radio Television of Serbia (RTS), known for its propagandistic stance against Kosovo.
The comments are a toxic mix of nationalism, hate speech, and open calls for violence. Kosovo Serbs working for the police are labeled as traitors, dehumanized, and threatened with brutal murder.
One comment labels the officer as a traitor and “not a real Serb”, accusing him of working for Kosovo institutions.
Other comments make dangerous historical references (e.g., Operation Storm) ” to express a desire for revenge or future violence.
The use of the term “Kosovo (region)” instead of simply “Kosovo” aligns with the Serbian refusal to recognize Kosovo's statehood.
Given the historical tensions between Kosovo police and Serbian nationalist groups especially in the past three years such posts fuel radicalization and potential violence. Framing the police as a shooting target is dangerous, as they are the first responders in operations against illegal activities.
A comment such as: “Džukela, nije to Srbin” (That dog is not Serb) dehumanizes the officer, implying that serving in Kosovo's police strips him of his Serbian identity.
Another threatening comment: “Na današnji dan u ovoj terorističkoj uniformi i sa hrvatskom puškom” (On this day, in that terrorist uniform and with a Croatian rifle) labels the Kosovo Police as “terrorists” and links them to Croatian armament, portraying Croatia as an ally of Kosovo against Serbia.
Some commenters directly threaten to kill the officer.
A comment such as: “Voleo Bih da mu mu kundakom Lobanju smrvim” (I’d love to crush his skull with a rifle butt), revealing a desire for brutal execution.
The campaign against Kosovo police intensified after November 2022, when Serbs resigned from the Kosovo Police. Groups with thousands of members labeled other Serb recruits joining the police as traitors. The“Bunker” Telegram channel published photos and personal data of officers from Leposaviq, Zvecan, and North Mitrovica. In addition to revealing personal information, the channel criticized international organizations and foreign diplomats in Kosovo for calling to end the lynching campaign against Serbs.
In other cases, photos of ordinary citizens are posted accusing them of collaborating with Kosovo authorities, encouraging Telegram users to vent hatred against “traitors” and “alleged collaborators of Kosovo institutions”.
Foto e qytetarit serb i cili akuzohet për “tradhti”
In a post-dated March 2025, it was claimed that a Serbian citizen informed the Kosovo Police about alternative smuggling routes from Serbia and passed the information to Kosovo Special Police Units.
The route allegedly connects to Serbian territory. The implication is that the citizen helped Kosovo authorities block illegal routes used by criminal groups.
Kosovo authorities say these routes are used for illegal smuggling, paramilitary movements, and other activities challenging Kosovo’s sovereignty.
“Another traitor added to the list!” the post concludes implying that such a list of “traitors” exists, monitored by Telegram channels and potentially leading to physical attacks. Historically, such messages have been used to justify violence or social exclusion of Serbs cooperating with Kosovo institutions that Serbia does not recognize. Serbian nationalist groups on Telegram view cooperation with Kosovo authorities as betrayal, as they still consider Kosovo a part of Serbia.
This demonization of local collaborators is part of a strategy to intimidate the Serb community in the north and hinder any form of integration into Kosovo institutions. The accompanying comments testify to extreme rhetoric, with threats of violence, murder, and references to “new purges.”
“Prodao se Šiptarima” (He sold out to the Albanians), “Smeće špijunsko, seme ti se zatrlo!” (Smeće špijunsko, seme ti se zatrlo!” (Spy trash, may your entire lineage be wiped out!), “Na kojoj si granici izrode, sa kime se graničiš?” (What border are you on, traitor? Who are your neighbors?) " – are examples of such comments.
Some of them are directly call for murder: ““Biće likvidacije uskoro...” (There will be a liquidation soon...), “A knife at night. If not him, then his mother, father, and the others“, - a threat to the entire family.
Some comments reinforce Serbian Orthodox nationalism, claiming that betraying Serbia equates to abandoning the Orthodox faith.
BUNT – The center of the propaganda ecosystem
Another highly influential channel is “BUNT Je Stanje Duha” slogans, led by Dejan Berić, a Serbian volunteer in the Russian army.
It was created in 2020, initially under the name “Bunt Montenegro”, before later rebranding to “BUNT je Stanje Duha”. This suggests its origins and initial focus were tied to Montenegro, targeting the pro-Serb Montenegrin audience, before broadening its messaging.
The number of new members increased significantly after the start of the Russian invasion of Ukraine in February 2022.
Based on public discussions within the channel, a few user-generated posts included “+381” (Serbia) and “+382” (Montenegro) country codes. This indicates that the administrative base and primary contributors are not operating from Kosovo, despite the channel frequently focusing on Kosovo-related topics.
With over 110,000 followers and an average of 100 posts per day, “BUNT” serves as the central hub for narrative coordination among pro-Russian and pro-Serbian channels. Its content is supported and amplified by channels targeting north of Kosovo such as “Korridor,” “Bunker,” “Srpski Vestnik,” and “Istok Info,” which act as megaphones for BUNT’s messages.
“BUNT” at the center of the disinformation ecosystem (Source: TGStat)
According to TGStat data, in March 2025 alone, “BUNT” was cited 367 times across 57 different channels, reaching a monthly audience of over 745,000 followers. This reflects not only its popularity but also its capacity to influence and spread disinformation in a coordinated manner throughout the region.
These channels operate on a cyclical model that reinforces narratives. One channel posts an emotionally charged message, others repost or comment on it, amplifying the message. The result is a dangerous ecosystem where hate, disinformation and radicalization thrive.
"BUNT" - among the most cited channels in the north (Source: “TGStat”)
The other graphic, generated from data exported in JSON format from Telegram channels, shows the individuals/channels that most frequently share each other’s content. This illustrates the interconnection between different channels and how they typically source their content from the same or similar outlets.
The main channels on Telegram (left) and the channels from which the messages were forwarded (right). Source: JSON
Most shared channels. Source: JSON
False narrative about historical events
Such channels usually spread nationalist anti-NATO and pro-Russian editorial stances, promoting narratives that delegitimize Kosovo’s statehood and justify Serbian victimhood.
March 24 marks the anniversary of NATO’s bombing of the former Yugoslavia (FRY).
Even on the latest anniversary, "BUNT" published posts of posts referring to this event. In one of them, two large photos appear with anti-NATO messages. One banner includes the phrase: “SRBE BOMBE, PODRUMI I SVEĆE, SRBI VAM NIKADA OPROSTITI NEĆE” (“Serbs, bombs, basements, and candles - Serbs will never forgive you).
The second image includes a stylized anti-NATO symbol. The phrase “Hrabro za Kosmet” (“Bravely for Kosmet” - Kosmet being a nationalist term for Kosovo“) appears in the lower corner, showcasing nationalist tones.
Based on textual analysis, the post criticizes Serbia’s alignment with NATO and the EU, suggesting that Serbia should return to faith, prayer and Serbian traditions.
It presents Serbia and Russia as protectors of Orthodox civilization against Western influence. Through a strong nationalist narrative, Serbia is portrayed as a state resisting aggression from NATO and the West.
The post frames NATO’s 1999 intervention as a “terrorist bombing by criminalseven though the intervention aimed to prevent crimes and human rights violations during the war in Kosovo.
Comments on this post are a mix of nationalist sentiments, anti-Western narratives, and promotion of the Russian-Serbian alliance.
Anti-NATO post, including one with fake images from the Iraq war in 2003.
In another post, civilian casualties are exaggerated while Serbian war crimes in Kosovo are ignored. The entire post, using images of crying children, aligns with pro-Russian and anti-Western propaganda, aiming to reinforce Serbian nationalist narratives and justify opposition to NATO and the EU.
Manipulation with children’s photos on Telegram channels
These narratives are also amplified by other Serbian and Russian-language channels, such as “Srpski Vestnik”, which has over 11,000 followers.
How do users find these channels and in which online spaces people are talking about these channels?
Based on Google search, the channel “t.me/buntcg” has a connection to Kosovo, mentioning thousands of subscribers from central Serbia and north of Kosovo. It has significant cross-border appeal, tapping into Serbian communities abroad. The content from “BUNT je Stanje Duha” is frequently shared by some Facebook and Instagram profiles based in Kosovo, particularly those operating in the northern municipalities. Their activity tends to spike during sensitive political events such as the arrest of Serbs by Kosovo Police or protests in the north.
It is supported by channels like “Narodna Patrola”, “BUNKER” and Hrаbro za Kosmet, forming a tight-knit propaganda cluster.
Regarding international mentions it’s featured in outlets like “Pravda EN”, emphasizing its role in defending Kosovo on a global Serbian stage.
According TGStat, channels in the same nationalist network like: “BUNT je stanje duha,” “Hrаbro za Kosmet,” “Narodna Patrola,” and “Сербский Вестник” often post identical content within hours of each other. On February 13 “Hrаbro za Kosmet” reposts content at 14:33, and “BUNT je Stanje Duha” subsequently posts on the same topic at 18:19. The rapid coordinated pattern suggests a central messaging strategy, likely managed by the same or closely connected groups.
The Reçak massacre is one of the events where false narratives appear annually on Telegram channels. In a “Srpski Vestnik” post on January 15, 2025, the massacre is denied, and international actors who raised the alarm about it in 1999 are blamed. The message presents NATO’s intervention as illegal, claiming that the Reçak massacre was a “fabricated pretext” for the bombings. It is also falsely claimed that the former head of the OSCE Mission, William Walker, “prepared the pretext” for NATO’s bombing campaign.
The false narrative that labels the Reçak Massacre as a fabrication
“Slovenski Medved” linked to “BUNT”
Another pro-Russian channel, “Slovenski Medved”, which has 88,000 followers is linked to “BUNT”.
“Dear brothers and sisters, if you wish to support the strengthening of free speech and the revival of national thought, with daily updates on all domestic and international news, including the Russian Armed Forces in Ukraine and with a focus on Kosovo and M, join the Telegram channel — 🇷🇸 REBELLION IS A SPIRITUAL STATE,” reads the channel's description.
“BUNT” frequently republishes content from the channel “Bunker” created in March 2023, focusing on developments in the north of Kosovo.
In its attempt to push anti-Western narratives using religious sentiment, this channel spreads disinformation and manipulates photos from various places, presenting them as if they occurred in Serbia during the NATO bombing campaign.
The combination of fake quotes, manipulation of casualty numbers, and emotional imagery creates a defamatory anti-Western narrative, portraying Serbs as the only victims of aggression while ignoring the causes that led to the war.
According to statistics from “TelepathyDB”, “Bunker” posts gathered 6.749 million views and 247,000 user engagements between March 2022 and March 2025. Graphics show that the highest posting activity occurred in June 2023, a period when tensions escalated in the north after the appointment of Albanian mayors to municipal buildings previously managed by the Serbian List. As a result of violent protests, numerous members of KFOR, the Kosovo Police, and journalists were injured.
Activity of “Bunker” in June 2023, when tensions erupted in the north (Source: TelepathyDB)
Meanwhile, an analysis by “OpenMeasures” on “Bunker”, covering the period from March 2022 to September 2024, shows that there was a significant spike in Telegram posts on September 24, 2023.
This date marks the terrorist attack by a paramilitary group from Serbia, led by the former vice-president of the Serbian List, Milan Radoicic, who killed Kosovo Police Officer Afrim Bunjaku in Banjska, Zvečan.
During this entire situation, false information was also spread in an attempt to mislead public opinion in both Kosovo and Serbia.
The chart confirming the posting activity of “Bunker” on the day of the terrorist attack in Banjska.
According to data from Open Measures”, there are 36 other channels whose content is linked to Bunker, including “Kosovo is Serbia”, “Ukraine Russia”, and “SrpskiVestnik”.
36 other channels linked to “Bunker” (Source: Open Measures)
The rise of extremist far-right sentiments
Russian and Serbian disinformation campaigns play a critical role in increasing ethno-nationalism. These narratives incite anger and dissatisfaction, reinforcing extremist far-right sentiments and increasing the risk of violence.
In this uncontrolled informational ecosystem where there is no moderation whatsoever, nationalist and pro-Russian actors operate freely, using hate speech, calls for violence, and public shaming as tools of hybrid warfare.
This was also the case following the recent wave of actions by Kosovo authorities to take control of several public enterprises and other institutions that had, until now, operated under the Belgrade system.
Serbian List and senior Belgrade officials reacted immediately, calling it yet another attempt at institutional cleansing of Serbs. In one of the many recent reagimeve Serb List wrote on Facebook that “Kurti’s regime continues its campaign against all Serbian elements in the north”, while calling on the international community to act before the situation escalates. These messages were amplified in Serbian-language Telegram groups. One of them even called for resistance: regjimi i Kurtit po vazhdon fushatën kundër të gjithë elementëve serbë në veri”, tek i bëri thirrje bashkësisë ndërkombëtare të veprojë para se situata të përshkallëzohet. Këto mesazhe u amplifikuan nëpër grupet e Telegramit në gjuhën serbe. Në njërin prej tyre u bë thirrje për rezistencë.
“The Albanian terrorists closed the sports hall in KM. Do they also need to take over the schools and hospitals before someone comes out and makes a statement like they’ve done so far!? Or will the people organize and rise to defend Kosovo and M, just like they have defended it for the past 25 years!”, it is said in a shkruan në njërin prej post of “Koridor” channel.
These campaigns are coordinated, deliberate and based on a clear strategy to undermine the institutional integrity of Kosovo, hinder interethnic coexistence and preserve Serbia’s and Russia’s influence in the region.
The distributed narratives not only aim to recreate a parallel reality but also seek to mobilize the local community against Kosovo’s institutions through intimidation and the stigmatization of individuals who show signs of cooperation with state authorities.
