Vote-buying by the tens of thousands, deepfaked officials, a fugitive oligarch’s fake-page empire, AI avatars reading Kremlin scripts, and a former warlord’s foundation inventing crimes for the president. A country of under three million became the test bed for every tool in Russia’s kit at once.
A year after Russia failed to stop Moldova from voting for Europe in a referendum, it came back for the parliament. The 2025 parliamentary election was, in a sense, the rematch, and Moscow treated it as one. What researchers documented in the run-up was not a single operation but a convergence, several distinct Russian influence assets working the same small electorate at the same time, each using a different technique. The election became an unintentional catalogue of the modern playbook, and studying it is the closest thing available to seeing that playbook laid out in full.
The convergence
The mapping comes largely from Recorded Future’s Insikt Group, whose analysts identified multiple, separately run networks pointed at Moldovan voters ahead of the September 2025 vote. The value of their work is in showing how the pieces fit, because no single tactic tells the story. Taken together, they show a state throwing its entire toolkit at one target and adapting as each element was exposed. Start with the money, because it is the oldest tool and still the bluntest.
Buying the vote at scale
The central figure is Ilan Shor, a fugitive Moldovan oligarch convicted of fraud and now based in Russia, whose political machine has been the through-line of Russian interference in the country. His vote-buying operations are not rumour. Investigators documented some fifteen million dollars in illegally transferred funds used to try to bribe roughly 130,000 voters against the EU referendum in 2024, with payments routed through a Russian bank and a Telegram-based system. Shor’s own framing was that these were not bribes but salaries, paid to citizens for the work of explaining the advantages of closer ties with the Eurasian bloc.
The digital scaffolding around this was just as industrial. The Moldovan watchdog WatchDog.MD identified more than two thousand auto-generated Facebook pages linked to Shor’s network, pages built with randomly generated names and profile photos stolen from dating sites, used to run well over a thousand advertisements and pour hundreds of thousands of euros into the information space. Vote-buying provides the incentive. The fake-page network provides the noise that makes the incentive look like a movement.
Faking the officials
On top of the money sat the fabrications. One network, tracked under the names Operation Overload and Matryoshka, specialised in impersonation. It manufactured content mimicking legitimate outlets such as the BBC, Deutsche Welle, AFP, and Euronews, and it produced deepfakes of Moldovan officials. Beginning in July 2025, it circulated fabricated videos of the government spokesperson Daniel Vodă, putting statements in his mouth he never made. The technique is designed to do two things at once: to spread a specific lie, and to erode the baseline assumption that a video of a public official saying something is evidence that the official said it.
A second network extended the fakery to the messengers themselves. Operation Undercut, attributed to the Social Design Agency, ran dozens of social accounts that used AI-generated video avatars, synthetic presenters with names like Aisha and Elena, to narrate Kremlin-aligned content to Romanian-speaking audiences. The avatars let the operation put a human face on its propaganda without needing a human, and without leaving a real person to be identified and exposed.
Inventing the crimes
The most lurid contribution came from the Foundation to Battle Injustice, an organisation founded by the late Yevgeny Prigozhin and now run by an associate operating under an alias. In the months before the vote it published a series of fabricated exposés against Moldova’s pro-European president, Maia Sandu, accusing her of involvement in human trafficking and in drug trafficking supposedly worth billions of dollars, and circulating a forged presidential decree. The allegations were invented whole. Their function was not to be believed in detail but to hang a permanent cloud over the president, so that even voters who doubted any single claim might come away with a vague sense that where there is that much smoke there must be fire.
Running quietly underneath all of it was the aggregator layer, a Moldova-facing arm of the Portal Kombat network churning out over a hundred and fifty thousand pro-Kremlin articles for Romanian speakers, an operation so aimed at machines rather than people that in one month it drew fewer than a hundred human visits while continuing to seed the data that search engines and AI systems draw on.
Why so much, for so small a country
Moldova is a country of under three million people. The scale of the effort aimed at it can look disproportionate until the strategic logic comes into focus. Moldova sits between Ukraine and the European Union, it has a breakaway pro-Russian region on its territory, and it made a public choice to pursue EU membership. For Moscow, a Moldova that turns back toward Russia would be a rare reversal of the westward drift along its borders and a propaganda victory it could point to for years. The country is small enough that a determined operation can plausibly move it, which is exactly why the operation was so large.
Outcome and what changed
It did not work. On 28 September 2025, Sandu’s pro-European PAS party won an outright majority again, and Moldova stayed on its westward course. International observers described a campaign marred by illegal funding, cyberattacks, and disinformation, and also described an election that produced a legitimate result. Faced with the fullest expression of the Russian toolkit yet documented against a single vote, Moldovan voters and institutions held.
That outcome deserves to be stated as plainly as the threat, because the reflex in this field is to catalogue the machinery of interference and imply that it is unstoppable. Moldova is the counterexample, and what changed is that there is now a worked example of resilience under maximum pressure. A small, heavily targeted country defended its election against vote-buying, deepfakes, fake-page armies, AI avatars, and manufactured scandal, and it did so through prebunking, quick official rebuttals, platform pressure, and a public that had learned from the previous round what was being done to it. The interference was real, sophisticated, and expensive, and it still lost. Resilience, the Moldovan case shows, is not a technology. It is a population that has seen the playbook before, institutions willing to name an operation while it is happening, and a refusal to treat exposure of the tactics as the same thing as surrender to them.
Leave a Reply