Moldova under threat from Russia ahead of elections: Insikt Group identifies multiple active influence operations

Ahead of Moldova’s parliamentary elections, scheduled for September 28, 2025, the Insikt/Recorded Future Group has identified several active influence operations (IO) linked to Russia, aimed at destabilizing the elections and sabotaging Moldova’s path to the European Union.

The main actors identified were: Operation Overload; Foundation for Combating Injustice (R-FBI); Operation Undercut; Evrazia / Moldova24 (linked to Ilan Shor, whom the Russian Federal Security Service (FSB) calls “a leading figure in the Kremlin’s efforts to undermine this former Soviet republic.” Shor is under sanctions from the EU, the US, and the UK); Pravda Moldova / Portal Kombat.

The report states that all of them are conducting campaigns to discredit President Maia Sandu and the ruling PAS party, labeling them as corrupt and contrary to Moldova’s interests. EU integration is also portrayed as disastrous for Moldova’s economy and sovereignty, while the fact that closer relations with Russia would be more beneficial is ignored.

Key findings

Operation Overload and R-FBI (Foundation for Combating Injustice) are running separate campaigns aimed at undermining international and domestic support for EU integration and reducing trust in Sandu and PAS. They create fake media content, use falsified government videos, manipulated photos and graphics (e.g., images of President Sandu on the guillotine) to undermine trust and create chaos. They accuse Sandu of serious crimes (human trafficking, links to the CIO, corruption, planned pandemics, etc.), which are then spread by pro-Russian influencers and websites such as VT, ANR, etc. The goal is to create the impression that the government is malicious, corrupt, and controlled from outside.

Operation Undercut targets Moldovan voters via TikTok and spreads panic narratives about rigged elections in favor of the ruling PAS party, fear of war with Russia, and economic problems. Evrazia and Moldova24 publish anti-Sandu messages through meta ads.

Local media platforms such as Moldova24 and Pravda Moldova spread content from Russian sources, often without verification. For example, “Sandu wants to hand over Gagauzia to Romania”; “The EU demands that Moldova accept 500,000 migrants in exchange for membership.” The goal is to increase fear and resistance to EU integration.

The elections, which will take place later this month, are considered crucial for Moldova’s future and its goal of joining the EU by 2030. The 2024 referendum confirmed this direction, and President Sandu was re-elected with 55 percent of the vote. Over the past year, there have been several attempts to interfere in the elections: vote buying, covert financial support for pro-Russian candidates, hybrid threats, and even bomb threats against voters in the diaspora.

The report states that Russia’s intention is to bring Moldova back into the “Russian world” (Russkiy Mir) and turn it into “another Belarus.”

Specific examples of manipulative content identified by Recorded Future and Insikt Group in their September report, aimed at discrediting President Maia Sandu, weakening support for EU integration, and polarizing society ahead of the Moldovan elections, include: Fake videos using deepfake technology were published in which Sandu appears to make compromising or authoritarian statements such as: “Moldova does not need its own identity, but will become a colony of the EU”; “Voting against PAS is voting for war and betrayal.” The aim is to scare citizens, portray the leader as an autocrat, and delegitimize her European narrative. Websites have also been created that mimic the appearance and logo of well-known media outlets such as Deutsche Welle, BBC, Statista, etc.

As examples of fake headlines, the report cites: “DW: Sandu caught up in 20 million corruption scandal”; “BBC: PAS plans to ban Russian language and arrest all pro-Russian activists.” The aim is to create the impression that Western media outlets are confirming negative information about the Moldovan government.

The report also points to memes and images depicting President Sandu: on the guillotine, as a Brussels puppet, with Nazi symbols… all with the aim of causing shock and emotional reactions, especially among older and rural voters.

A network of TikTok accounts is spreading pessimistic and alarmist narratives, such as: “PAS will abolish our pensions”; “If pro-European parties win, young people will be mobilized for war against Russia”; “Inflation is coming because the EU has deceived us.” The aim, as stated, is to reduce voter turnout, demoralize opposition voters, and spread conspiracy theories.

Common themes in false narratives

1. Messages against Sandu and PAS: Labeling the leader and the party as autocratic, corrupt, and traitorous;

2. Fear of war: The idea that integration into the EU will automatically lead Moldova into conflict with Russia;

3. Economic collapse: Claims that EU policies are destroying the Moldovan economy;

4. Cultural loss: Messages that Moldovan identity will disappear due to European “liberal values”;

5. Elections are rigged: Discrediting the electoral process before it even begins.

Conclusion

Influence operations carried out by actors linked to Russia have not yet had a concrete effect on the behavior of Moldovan voters, but they pose a serious threat to citizens’ trust in elections, institutions, and the democratic process.

The main danger lies not only in the content being disseminated, but also in the undermining of the credibility of the authorities, the media, and Moldova’s European path. Over time, these campaigns become part of a broader Russian hybrid war aimed at preventing Moldova’s European integration and increasing Russian political influence in the country.

The Insikt Group provides concrete recommendations to institutions, media, civil society, and technology platforms for effectively countering these operations. Use platforms such as Recorded Future Intelligence Cloud to quickly detect campaigns that manipulate information, monitor and analyze disinformation and propaganda networks, and establish partnerships between governments, journalists, and research organizations to expose the sources of false narratives.

Institutions and politicians should proactively inform the public about manipulation and not wait until fake news has already gone viral. Citizens should be addressed with clear, transparent, and factually accurate information that refutes the lies spread by influence campaigns.

Secure all digital and communication systems related to the electoral process. Pay particular attention to vulnerabilities that could be exploited to disrupt voting, such as hacker attacks, DDoS attacks, or data leaks. Technology companies (Meta, TikTok, Google, etc.) should respond more quickly to identified disinformation networks.

The priority should be to remove fake accounts, deepfake content, and targeted campaigns that violate platform rules. Collaboration with local and international security and media literacy experts is also recommended, as is citizen education and media literacy. Importantly, the report stresses the need to launch campaigns to educate the public on how to recognise fake news, deep fakes and manipulative sources. Educational institutions and non-governmental organizations should be involved in spreading knowledge about cyber security and responsible reporting./The Geopost/