An investigation by the Balkan Investigative Reporting Network (BIRN) has uncovered evidence of coordinated social media activity linked to Serbia’s ruling Serbian Progressive Party (SNS), including organised sharing of politicians’ posts, the amplification of political messages and attacks targeting independent media and opposition figures.
BIRN analysed leaked data from the internal platform progress.rs and compared it with the public activity of social media accounts during two election campaigns in Serbia in 2026: the local elections in March and the snap parliamentary elections in October.
The investigation identified 339 instances in which activity on the social media platform X matched specific tasks recorded on progress.rs. It also found a connection between the platform’s administrator account and an internet network registered to the SNS headquarters in Belgrade.
The leaked platform data reportedly allowed users to assign specific tasks to groups of accounts, including deciding which posts should be liked, reposted or commented on, and how many points should be awarded for completing each action.
The analysis also examined activity on Instagram and TikTok, alongside thousands of articles published by Serbian news portals.
Key findings of the investigation
- 339 matches between online activity and assigned tasks: BIRN identified 301 reposts, 30 quote posts and eight replies that matched tasks listed on progress.rs. The activity involved 47 accounts, with 40 of them showing repeated matches.
- Connection to SNS headquarters: The platform’s main administrator account logged in four times from an IP address associated with SNS-NET, an internet network registered to the party’s headquarters. Another account’s first login, in January 2023, was also recorded from the same network. BIRN noted that these findings link the platform to the SNS headquarters but do not establish the identities of the individuals operating the accounts.
- More than 40,000 posts during the parliamentary campaign: Between September 9 and October 19, 2026, 213 analysed X accounts published a total of 40,591 posts, including original content, replies, quote posts and reposts. Around 74% of all reposts concerned just six profiles, including the official SNS account and those of Aleksandar Vučić, Miloš Vučević, Milenko Jovanov and Ana Brnabić.
- Nearly half a billion views: The accounts shared 6,186 different posts that collectively generated approximately 496 million views. BIRN stressed that this figure represents the total views of the original posts amplified by the accounts, not the number of individual people reached. It was not possible to establish how many views resulted directly from the network’s activity.
- Abusive comments targeting media and opposition: In a separate analysis of 1,140 replies directed at the accounts of N1, Danas, Nova, Bez Cenzure, Dveri and Kreni-Promeni, BIRN identified 488 instances of insults, disparagement or attempts to discredit the targets. Just 10 accounts were responsible for more than 93% of the comments analysed.
- Identical headlines across dozens of portals: During the parliamentary campaign, researchers identified 89 groups of articles with identical or nearly identical headlines, comprising 517 publications across 71 news portals. Most appeared on the same day. However, some were neutral news reports and official statements, meaning that similarities in headlines alone cannot establish that the publications were part of a coordinated political campaign.
- The same accounts active in both election campaigns: A total of 161 X accounts were active during both the March local elections and the October parliamentary campaign. They produced approximately 80% of the analysed content during the parliamentary campaign and 76% during the local elections, indicating that much of the activity came from the same group of accounts.
- Activity on Instagram and TikTok: During the parliamentary campaign, 42 Instagram accounts linked to the progress.rs database published 974 posts, while 21 TikTok accounts published 336. However, BIRN said there was insufficient data to confirm that these activities were carried out in response to specific tasks assigned through the platform.
Evidence of coordinated political messaging
BIRN’s findings document specific instances of coordinated activity on X and broader patterns of political messaging being amplified across social media and news portals.
However, the investigation cautions that the available evidence does not prove that every activity analysed was part of a single centrally managed network. Nor does it establish who issued each individual task.
The report is intended for social media platforms, regulators, civil society organisations and others monitoring political communication online, particularly during election campaigns.
The full BIRN investigation, including its methodology, data and documented examples, is available here.
