Influence in Moldova: Coordinated Campaigns Ahead of Critical Elections

On 28 September 2025, Moldova will hold parliamentary elections. For a country of just 2.5 million people, the stakes are unusually high. The election will determine whether Moldova continues on its path toward the European Union or whether Moscow succeeds in reasserting its influence. This contest is no longer fought solely at the ballot box, but increasingly across digital arenas where political majorities are shaped and reshaped. 

The elections have also drawn attention from the EU itself, reflecting their broader significance for European security. On 10 September 2025, the European Parliament adopted a resolution condemning Russian hybrid interference in Moldova and calling for strengthened EU support to safeguard the electoral process. Commissioner Kos reinforced this stance in a speech announcing the readiness of EU Hybrid Rapid Response Teams to assist Moldova’s counter-FIMI efforts. 

With only a few days left before the vote, a recent report, Moldova: Country Election Risk Assessment (CERA), has gained relevance. Compiled by analysts from several organizations (DFRLab, Alliance4Europe, Debunk.org, and EU DisinfoLab) as part of the FIMI Defenders for Election Integrity Project (FDEI), this comprehensive assessment outlines the current political landscape, identifies key actors, and explores the various influence operations affecting Moldova’s information space. 

Given the significant impact of digital manipulation in the final stretch before elections, and as showcased so clearly by the case of the recent Romanian elections, the Moldova CERA report warrants close attention. This blog does not attempt to summarize all 80+ pages but highlights the central operations, structures, and narratives that may prove decisive in the upcoming vote. 

Political Context 

Moldova’s domestic politics are sharply divided. President Maia Sandu and her pro-European PAS party are pushing firmly toward EU integration, while pro-Russian forces gather around fugitive oligarch Ilan Șor, who is long associated with covert financing and orchestrated protest actions.ⁱ Between these poles stand smaller parties that present themselves as pro-European yet often amplify narratives originating from Kremlin-linked channels.ⁱⁱ This polarized environment provides fertile ground for external influence. 

Figure 1: Foreign actors operating in Moldova’s information landscape, courtesy of FDEIⁱⁱⁱ 

External Influence Networks 

The FDEI report, alongside others, shows that Russian-linked structures deliberately target Moldova’s information ecosystem. 

• Operation Matryoshka produces highly polished videos designed to resemble neutral think tank analysis, but which consistently frame EU membership as a threat. Distribution primarily runs through Telegram, X, and Bluesky, targeting Russian- and Romanian-speaking communities within Moldova.^iv 

  
  

• The Pravda network, also known as “Portal Kombat,” functions as a redistribution hub. Content from Russian state media and Kremlin-affiliated Telegram channels is translated and republished across dozens of websites posing as local outlets. Activity peaks coincide with sensitive moments such as U.S. Secretary of State Antony Blinken’s visit or the second round of presidential elections.^v 

  
  

• Storm-1516, a Russian digital influence network, follows an imitation strategy. It builds cloned domains of legitimate news outlets and fills them with fabricated stories. One Moldovan case accused Sandu of embezzling foreign aid, allegedly citing Mayor Ion Ceban. The article was entirely false but looked authentic, complete with stolen bylines, and circulated widely on Telegram.^vi Independent assessments, including VIGINUM, note the tactical overlap with Russia’s “Doppelgänger” operation but classify Storm-1516 as a separate network.

• Anonymous Telegram channels serve as a primary gateway for Kremlin narratives to reach Moldova. They aggregate, synchronize, and amplify manipulated content from the above networks, ensuring alignment with political events and pushing narratives into public debate.^vii 

  
  

Campaigns and Platforms 

These networks converge in concrete campaigns. 

• Following the ban on several pro-Russian TV stations, Moldova24 (MD24) emerged, hosted in Russia and backed by at least 16 mirror domains. It spreads content simultaneously across TikTok, Telegram, Instagram, and YouTube. 

  
  

• The U.S. platform Cameo was also exploited: purchased celebrity greetings were re-captioned to suggest calls for Sandu’s resignation, then circulated on Moldovan Telegram and Facebook channels as supposed “Western voices”.^viii 

  
  

• The Șor network illustrates the link between digital and physical mobilization. Under the hashtag #STOPUE, Telegram bots recruited referendum opponents. Participants uploaded ID documents and were paid to share content or join protests, with transactions routed through sanctioned Russian banks and the MIR payment system. This model was expanded via the Taito app, where protesters registered, signed contracts, and received up to $3,000 per month, four times Moldova’s average salary. These funds sustained the so-called “tent protests,” which appeared spontaneous but were in fact coordinated and financed.^ix 

  
  

• Artificial intelligence is also part of the toolkit. A deepfake video depicted Electoral Commission chair Angelica Caraman allegedly admitting to foreign interference. It spread on Telegram and was later amplified by Russian Foreign Ministry spokesperson Maria Zakharova, illustrating how anonymous digital manipulation can merge with official diplomacy.^x 

  
  

Narratives and Their Dynamics 

The report identifies consistent narrative lines. At the meta-level, Anti-EU, Anti-West, Anti-Establishment, and pro-Russian frames dominate.^xi Beneath them operate sub-narratives: that EU membership erodes sovereignty,^xii that NATO and the EU bring war and chaos, that Sandu is corrupt and incompetent, that democracy is hollow, and that elections are rigged anyway.^xiii The impact does not stem from single stories but from cumulative reinforcement across platforms and formats.^xiv 

Figure 2: Meta-Narratives and Sub-Narratives, courtesy of FDEI^xv 

Assessing the Impact 

Whether such campaigns ultimately shift votes is difficult to prove. The report is cautious, stressing the limited measurability of direct effects. Yet it warns by comparison: in Romania, similar combinations of disinformation, covert financing, and orchestrated protests contributed to elections being annulled.^xvi The risk in Moldova lies less in one decisive fake than in the steady erosion of trust and the demobilization of pro-European voters. 

Figure 3: Meta-Narratives and Sub-Narratives, courtesy of FDEI^xvii 

Responses and Their Limits 

Moldovan authorities have started to respond. In 2025, the electoral commission refused to register the pro-Russian “Victory” bloc after tracing its funding to Șor’s structures. The Supreme Security Council now designates electoral interference and illicit financing as national security threats, while foreign activists linked to destabilization are denied entry. Also, external initiatives have arrived, including programs such as M-MIIND, introduced in 2024 to reinforce independent media and experiment with approaches to countering foreign information manipulation and interference (FIMI).^xviii 

At the same time, Moldova’s institutions lack the resources to counter complex digital campaigns in real-time, a weakness highlighted by the report.^xix And this is not unique to Moldova: many Western European countries face the same challenge, struggling to match the speed and scale of hostile influence campaigns (HICs). 

Conclusion 

Moldova’s election serves as another reminder of how foreign interference has become an integral part of modern geopolitics rather than an episodic disruption. The country is not unique in facing these tactics, but its small size, polarized politics, and proximity to the EU–Russia fault line make it a prime case. 

The precedent of Romania, where similar methods of disinformation, covert financing, and orchestrated protests contributed to the annulment of the presidential election, shows how fragile electoral integrity can be when external manipulation intersects with domestic fragmentation. A CRC report on Romania’s annulled elections provides a detailed analysis of the influence efforts that fueled the situation. In the context of the upcoming Moldovan elections, this case study now offers valuable lessons, while shedding light on dynamics that are highly relevant for Moldova, where external interference threatens democratic processes. 

What the Moldova: Country Election Risk Assessment adds to that analysis is a systematic mapping of the evolving threat environment. By going beyond isolated incidents, it identifies the networks, narratives, and financial flows that drive hostile influence, and shows how digital propaganda, mobilization, and covert funding reinforce each other. This makes the report valuable not only for understanding Moldova but as a reference point for analyzing how HICs evolve across Europe. 

---

[Footnotes:]

[i] FDEI for election integrity (FIMI‑ISAC), Digital Forensic Research Lab (DFRLab), Alliance4Europe, Debunk.org, EU DisinfoLab, 2025. Country report Moldova: risk assessment (Jan 2025 – Jan 2027). Pp.62-64 [online] Available at: https://fimi-isac.org/wp-content/uploads/2025/09/Country-Report-Moldova-Risk-Assessment.pdf

[ii] Ibid. 8-13

[iii] Ibid. p.21

[iv] Ibid. p.20

[v] Ibid. p.20

[vi] Ibid. pp.23-24

[vii] Ibid. p.21

[viii] Ibid. p.23

[ix] ibid. 62-64

[x] Ibid. 24

[xi] Ibid. 31-42

[xii] Ibid. p.45

[xiii] ibid. p. 45-52

[xiv] ibid. pp.56-59

[xv] ibid. p.30

[xvi] ibid. p.27

[xvii] ibid. p.33

[xviii] ibid pp.70-72

[xix] ibid. pp.72, 82