Executive Summary
In October 2024, Moldova held a simultaneous presidential election and constitutional referendum on whether to enshrine EU membership as a national goal. Russia mounted what Moldovan officials described as the most sophisticated and expensive interference campaign in the country’s post-Soviet history — combining a mass vote-buying scheme (paying citizens cash to vote against EU integration), coordinated disinformation campaigns across Telegram, TikTok, and Russian state television, and an unprecedented physical operation: paramilitary training camps in the Balkans where Moldovan recruits were trained by Russian-linked instructors in riot tactics, drone operation, and sabotage techniques. President Maia Sandu publicly stated that Russia had spent hundreds of millions of euros attempting to destabilize the election. Investigators confirmed that more than $39 million USD was funneled to over 138,000 Moldovan citizens through accounts linked to sanctioned Russian banks and the network of exiled oligarch Ilan Shor, who operated openly from Moscow. Despite the campaign, Moldova approved the EU referendum — narrowly — and re-elected Sandu. The operation is notable for its integration of financial coercion, information warfare, and physical subversion training into a single, orchestrated hybrid campaign.
How It Was Discovered
Moldovan intelligence services (SIS) and prosecutorial authorities began tracking the operation in mid-2024, as financial monitoring flagged unusual cryptocurrency and bank transfer patterns involving Promsvyazbank — a sanctioned Russian state bank — and a network of payment apps linked to Shor’s political infrastructure. The DFRLab documented in October 2024 how Shor-linked Telegram channels operated as a paid recruitment and coordination platform, with a chatbot called STOP UE (Stop EU) used to enlist activists and distribute payment instructions. The training camp dimension emerged through SIS counterintelligence operations that tracked Moldovan citizens crossing into Bosnia and Serbia for paramilitary courses in August and September 2024. Balkan Insight’s investigative reporting, published in July 2025, provided the first detailed account of life inside the camps based on interviews with participants and court documents from subsequent prosecutions.
The Vote-Buying Machine: Shor, Cryptocurrency, and 138,000 Citizens
Ilan Shor — a Moldovan oligarch convicted of bank fraud and currently in self-imposed exile in Moscow — served as the primary financial and organizational architect of the interference campaign. Shor operated multiple overlapping structures: a network of Telegram-based payment bots, a crypto payment app called App7 managed by his A7 group, and physical courier networks carrying cash from Russia and through transit countries including Azerbaijan and Belarus. Moldovan authorities confiscated over 20 million Moldovan lei (approximately $1.2 million USD) from organized groups of passengers traveling from Moscow to Moldova in the weeks before the election — a small fraction of the total estimated flow.
The scale was remarkable. Investigators documented that over 138,000 Moldovan citizens received payments from the network — roughly five percent of the country’s total electorate. Wallets tied to Shor’s A7 group received approximately $8 billion in stablecoin transactions since early 2024, used to build the payment infrastructure and compensate political activists, social media posters, and protest organizers. Between April 30 and July 28, 2024, Shor-linked Meta advertisers spent an estimated 45,000 euros on 1,505 targeted advertisements pushing anti-EU content to Moldovan audiences. The European Parliament formally condemned the interference in October 2024.
The Balkan Boot Camps: Drones, Incendiary Devices, and the Republika Srpska Connection
Alongside the financial campaign, Russian intelligence coordinated a physical training operation using the Balkans as a staging ground. In August and September 2024, Moldovan citizens were recruited — primarily through Shor-affiliated networks — and transported to paramilitary training camps in the Republika Srpska entity of Bosnia and Herzegovina (the predominantly Serb-governed entity), and later to a location near the village of Radenka in eastern Serbia. Recruits were required to surrender their phones and passports before training began. They were promised fees of $300 to $500 for ten days of training, paid in cryptocurrency.
Training curriculum included combat drills, riot control countermeasures, military-grade drone operation, and instruction in the use of incendiary devices. The instructor responsible for drone training was identified only as a Russian national called Viktor — his full identity was never established. Court documents from subsequent Moldovan prosecutions described him as linked to Wagner Group-adjacent networks. By February 2026, a Chisinau court had convicted five Moldovan citizens for attending the camps and participating in the destabilization plot. Republika Srpska politicians, including President Milorad Dodik, publicly denied the existence of the camps.
The Disinformation Layer: State TV, Fake Bomb Threats, and AI Content
The physical and financial operations were overlaid with a comprehensive information campaign. Russian state television — officially banned in Moldova but widely available via satellite in Transnistria and the autonomous region of Gagauzia — broadcast sustained narratives warning that a vote for the EU referendum was a vote to send Moldovan men to die in Ukraine. Shor-linked TikTok channels amplified these narratives to younger Moldovan audiences. On election day itself, coordinated fake bomb threats were phoned into Moldovan diaspora polling stations in Germany and the United Kingdom, forcing temporary closures and creating confusion among overseas voters. Investigators also documented interference with voter transportation: organized groups of voters were bused from Russia, Belarus, and Azerbaijan to cast ballots against the referendum.
The Balkans as a Staging Ground: Strategic Significance
The choice of Bosnia-Herzegovina’s Republika Srpska and Serbia as training locations was not incidental. Both territories have cultivated close political and intelligence relationships with Moscow. Republika Srpska’s governing party, the SNSD led by Milorad Dodik, has maintained overt alignment with the Kremlin and resisted EU sanctions compliance. Serbia, while formally an EU candidate state, hosts an active Russian intelligence presence and has declined to join EU sanctions against Russia. For Russian intelligence planners, these territories represent a geographic and political buffer — EU-adjacent territories where Russian-linked operations can run with limited host-country interference. The Moldova training camp operation is the most clearly documented case of Russia using Balkan soil for active-measures physical training directed against a European target [8].
Outcome: A Narrow Referendum Win and Ongoing Pressure
Moldova’s EU referendum passed — but narrowly, by approximately 50.4 percent, with diaspora votes ultimately proving decisive. Without the overseas vote, the referendum would have failed. President Sandu credited the resilience of Moldovan civil society and international partner support in countering the interference. The EU, in July 2025, sanctioned additional individuals and entities linked to the Moldovan destabilization campaign. Shor remains in Moscow, beyond extradition reach. The Balkan training camp network has been disrupted but not fully dismantled — Balkan Insight’s 2026 reporting confirmed that the instructors responsible for the camps have not faced prosecution. Moldova’s 2025 parliamentary elections saw continued Russian interference attempts, including a documented paid social media campaign tracked by the DFRLab, confirming that the 2024 campaign was not an isolated event but a sustained strategy.
Leave a Reply