Cross-border influence targeting Romania’s vote and Moldova’s leadership

Cross-border influence targeting Romania’s vote and Moldova’s leadership

In our March 17 report, “The Romanian Presidential Elections 2024: Analysis of Information Operations and Long-term Influence Efforts,” we comprehensively examined the developments that ultimately led to the annulment of Romania’s presidential elections (link to our report here).

This week, in our Weekly Blog, we want to highlight a recent report by DFRLab[i], which analyzes a coordinated network of cross-platform accounts associated with these events.

DFRLab identified at least 215 accounts in the network: 116 on Facebook, 79 on TikTok, and 17 on Instagram. Between December 2024 and June 6, 2025, these accounts published a total of 8,514 posts, amassing at least 16 million views and 681,000 likes. Content focused on spreading anti-EU, pro-Russian, and anti-PAS narratives. Initially, the network supported presidential candidate Călin Georgescu, but after the annulment of the 2024 election, it shifted toward backing far-right candidate George Simion. It also targeted Moldovan President Maia Sandu, repeatedly accusing her of election interference. In parallel, the network amplified claims made by Telegram CEO Pavel Durov that France had attempted to suppress “conservative voices” in Romania.

The operators disseminated content in the form of slideshows, photos, videos, and text posts, coordinated across platforms using hashtags in Romanian and Russian. Particularly striking was the use of generative AI, including fake personas with Romanian-sounding names, AI-generated profile pictures and avatars, and AI-based video editing, which suggested an automated approach to content production and distribution. At least twelve Facebook accounts also presented themselves as “professional accounts” or “digital creators,” possibly with the intention of monetization. Posting activity surged in February, April, and May 2025, coinciding with key phases of Romania’s presidential campaign. A notable finding by DFRLab was that many accounts remained below Meta’s transparency threshold: only 55 accounts appeared in the official Content Library, while the rest had fewer than 1,000 followers. DFRLab concluded that this may have been a deliberate strategy to avoid detection, suggesting that the network’s actual reach could be significantly larger than current data indicates.[ii]

Passports and Moldovan Interference

In May 2025, the network significantly escalated its activity, with over 1,450 videos promoting the so-called “Moldovan Scenario.” These claimed that tens of thousands of Moldovans holding Romanian passports, allegedly directed by President Maia Sandu and PAS, were mobilized to interfere in Romania’s election process.

Figure 1 - Courtesy of DFRLab[iii]

Anti-PAS and Anti-Sandu Narratives

Another prominent narrative portrayed President Maia Sandu and PAS as corrupt, illegitimate, and warmongering. Posts claimed that Sandu was dragging Moldova into a foreign war, endangering national security, and acting in the interests of external powers rather than the country's best interests. At the same time, the network stoked tensions with Romania, labelled Sandu an “illegitimate president,” and called for her resignation.

Figure 2 - Courtesy of DFRLab[iv]

Victory Day vs. Europe Narrative

Figure 3 - Courtesy of DFRLab[v]

Narrative of unlawful arrests

Between March and May 2025, the network intensified its activity around Romania’s presidential elections by reinforcing pro-Georgescu messaging and supporting detained Gagauz Governor Evghenia Guțul. Following Georgescu’s arrest on February 25, 2025, posting activity spiked: in early March, the network amplified solidarity protests in Bucharest and published dozens of supportive messages. A further wave followed the Constitutional Court's bar on him from running in May. In parallel, the network pushed anti-EU and anti-Romania narratives, casting Georgescu as a victim of political repression. It also promoted content in support of Guțul following her detention on March 27, 2025, including Soviet-era symbolism such as the song “Katyusha” as a sign of solidarity. Pro-Russian politicians claimed her arrest lacked a legal basis, and several videos reached high viewership, with some TikTok clips attracting up to 300,000 views.

Stolen Accounts and AI Personas

DFRLab reveals that the network relied on both stolen or repurposed accounts and AI-generated fake personas. Several profiles that had originally posted authentic content, such as family photos, were later repurposed to spread inauthentic material. Fake identities appeared simultaneously across Facebook, Instagram, and TikTok, with coordinated posting patterns. Some of these accounts infiltrated local Facebook news groups to expand their reach.

Figure 4 - Displayed in DFRLab Report[vi]

To increase credibility, the operators heavily utilized generative AI for profile pictures, avatars, and video elements, as well as stock footage that, in some cases, dated back years but was repurposed as current protest footage. Tools such as DreamFace were used to generate synthetic faces that appeared as supposed real people in videos.

Figure 5 - Use of AI-Tools Displayed in DFRLab Report[vii]

DFRLab concludes that the network deliberately combined hijacked accounts, AI-generated material, and recycled stock footage to create the illusion of authenticity and lend credibility to its influence operation.

Inauthentic News Channel

The network also used ono.news, a news and marketing channel, to disseminate its content.

Figure 6 -  Displayed in DFRLab Report[viii]

While the accounts remained active on Telegram and TikTok, the channel appears to have been removed from Facebook. Initially, ono.news appeared on Facebook under the name Gabriel Matei, a profile that bore signs of being a fake persona before shifting into the identity of a supposed news outlet.

DFRLab found indications of extensive AI technology use: the TikTok and Telegram profiles utilized an AI-generated profile picture, and videos featured the watermark of D-ID, a company specializing in visual AI avatars. DFRLab concludes that ono.news was not a genuine media channel but rather a fabricated brand identity, leveraging fake identities and generative AI to appear credible and amplify the network’s narratives.

Conclusion

DFRLab’s analysis reveals that the network employed coordinated cross-platform activity to disseminate anti-PAS, anti-Sandu, and anti-EU narratives, gradually expanding its focus from Moldovan politics to Romania’s presidential election. The accounts generated at least 16 million views and 681,000 likes, though the actual impact remains difficult to quantify. Tactics included the systematic use of hijacked accounts, AI-generated personas, and recycled stock material to create an appearance of authenticity.

The investigation further demonstrates how the operation operated largely below Meta’s transparency threshold, thereby avoiding detection, and exposed significant discrepancies between publicly accessible content and the data available through Meta’s Content Library and API. These gaps highlight persistent weaknesses in platform moderation and disclosure processes that continue to enable covert influence campaigns.

We recommend reading the full DFRLab case study, which provides additional valuable details and context.

---

[Footnotes]

[i] DFRLab, Valentin Châtelet, 2025. Cross‑platform campaign accuses Moldova’s Sandu of meddling in Romanian elections. [online] Published 26 August 2025.

Available at: https://dfrlab.org/2025/08/26/cross-platform-campaign-accuses-moldovas-sandu-of-meddling-in-romanian-elections/

[ii]  Ibid.

[iii] Ibid.

[iv] Ibid.

[v]  Ibid.

[vi] Ibid.

[vii] Ibid.

[viii] Ibid.

---

DISCLAIMER

Copyright and License of Product 

This report (the "Product") is the property of Cyfluence Research Center gGmbH ("Cyfluence") and is protected by German and international copyright laws. The User is granted a limited, non-transferable license to use the Product solely for internal purposes. Reproduction, redistribution, or disclosure of the Product, in whole or in part, without prior written consent from Cyfluence is strictly prohibited. All copyright, trademark, and proprietary notices must be maintained.

Disclaimer of Warranties

The Product is provided "as is" without warranties of any kind, express or implied, including but not limited to warranties of merchantability or fitness for a particular purpose. Although Cyfluence takes reasonable measures to screen for viruses and harmful code, it cannot guarantee the Product is free from such risks.

Accuracy of Information 

The information in the Product has been obtained from sources believed to be reliable. However, Cyfluence does not guarantee the information's accuracy, completeness, or adequacy. The User assumes full responsibility for how they use and interpret the Product. Cyfluence is not liable for errors or omissions; opinions may change without notice.

Limitation of Liability

To the fullest extent permitted by law, Cyfluence shall not be liable for any direct, indirect, incidental, or consequential damages, including lost profits or data, arising from the use of or inability to use the Product, even if advised of such possibilities. Liability for intent or gross negligence remains unaffected under German law.

Indemnification

The User agrees to indemnify and hold harmless Cyfluence, its affiliates, licensors, and employees from any claims or damages arising from the User’s use of the Product or violation of these terms.

Third-Party Rights

The provisions regarding Disclaimer of Warranties, Limitation of Liability, and Indemnification extend to Cyfluence, its affiliates, licensors, and their agents, who have the right to enforce these terms.

Governing Law and Jurisdiction 

This Agreement is governed by German law, and any disputes shall be resolved exclusively in the courts of Berlin. If any provision is found invalid, the remaining terms remain in full effect.