BANNER: Marina Tauber, leader of the opposition pro-Russian Shor Party, delivers a speech during a hearing of the Constitutional Court in Chisinau, Moldova, June 19, 2023. (Source: Reuters/Vladislav Culiomza)

An inauthentic Facebook campaign promoting Moldova’s pro-Russian Shor Party sought to undermine the country’s pro-European government. The network engaged in sponsoring posts by anonymous pages promoting the party, and utilized copypasta comments to undermine the Moldovan government and weaken its support for Ukraine. Many of the accounts in this network were later de-platformed by Facebook.

Moldova faces an ongoing hybrid war that encompasses propaganda, cyberattacks, energy and economic coercion, separatist movements, and political subversion. Both domestic and foreign actors seek to destabilize the country and undermine its legitimately elected pro-European government. The pro-Russian Shor Party, founded by convicted fugitive oligarch Ilan Shor, has organized street demonstrations since late 2022 to capitalize on the country’s worsening social and economic situation.

Moldova’s economy was hit hard by the effects of the Russian war in Ukraine, contracting by 5.9 percent in 2022. Moreover, as part of its blackmail using its primacy in energy provision throughout the region, Russia cut gas supplies to Moldova in half in 2022, resulting in a nearly six-fold increase in energy prices for Moldovans, driving inflation upwards to around 34 percent, and exacerbating social tensions. Pro-Russian political forces have exploited these economic hardships to fuel widespread discontent among Moldovans, with the intention of inciting mass protests and ultimately overthrow the current government.

The Shor Party orchestrated protests in the autumn of 2022 by erecting hundreds of tents on the pavement outside the presidential and legislative buildings in an attempt to force Moldova’s president, Maia Sandu, and her government to resign. The demonstrations resumed in February this year, but this time they were conducted more aggressively. On February 9, in a speech to the European Parliament, Ukrainian President Volodymyr Zelenskyy claimed that Ukraine’s intelligence had intercepted “Russia’s plan to destroy Moldova and establish control over the country.” This was followed by comments from President Sandu, who said that the country’s authorities had discovered a network of “subversives” plotting a coup d’état. The White House confirmed the claims, warning that Russia is “seeking to stage and use protests in Moldova as a basis to foment a manufactured insurrection against the Moldovan government.”

According to Facebook Ad Library data, between February 7 and April 28, 2023, at least fifteen pages promoted posts, messages, and videos featuring Ilan Shor, amplified pro-Russian narratives and called for protests and the overthrow of the government. The total spending for eighty-three ad posts was USD $26,961.

As noted by the Associated Press in February 2023, Facebook allowed Ilan Shor to run advertisements calling for unrest against the pro-European government, even though he and his political party were placed under US sanctions in December 2022. According to US law, companies based in the United States are legally forbidden from engaging in transactions with entities and individuals sanctioned by the US government.

Facebook eventually removed the ads, but not before they had already reached millions of people. In a game of cat and mouse, the group behind the operation set up new pages after each suspension and ran the ads through the new pages until Facebook once again removed them. The most recent ad dates from April 25–28, 2023, and reached millions of users and collected hundreds of thousands of impressions before it was removed.

In all fifteen cases, the ads were run by anonymous pages with little to no activity or identifying information, making it difficult to identify and flag them as fraudulent. Some of them were created recently, seemingly for the sole purpose of running advertising, while others were older and had changed their names between March 14 and 17, as revealed in their page transparency sections.

The Ad Library also indicated that suspicious accounts sponsored the ads. For instance, Glada Bakesu and Samira Birca, two accounts sponsoring the ads, both renewed their profile picture on November 4, 2022. The photos featured on both accounts are inconsistent with the rest of the gallery. Similarly, both profiles mentioned working at Istanbullu Gelin, a Turkish TV show produced by O3 Medya. However, these names do not appear in any open-source searches related to the TV show.

A potentially related online operation consisted of a large network of fake accounts. The DFRLab identified at least 138 fake accounts – some of which have already been removed or deleted – that posted identical messages and comments on Facebook. Most of their rhetoric is directed at highlighting the rising cost of living, attacking the Moldovan government’s pro-European stance, criticizing its support for Ukraine, and aggressively promoting the Shor Party and its leader.

Though their creation dates are unknown, many of the accounts first updated their profile pictures between September 2022 and April 2023, including some on the same day. This window corresponds to the time period when the Shor Party’s street protests took place.

Some accounts either hid their biographical information or locked their profiles, preventing any insight into their prior activity.

For some accounts, there was a gender discrepancy between the name, profile photo, and available account information. For example, the accounts “Gabriela Țurcanu” and “Anna Russo Anna Russo,” according to their photo and profile name, appear to be female accounts, but the locked account notifications indicated that they were registered as male accounts, stating “Only his friends can see what he shares on his profile” (emphasis added). Similarly, for the account “Dragos Stere,” the name and the profile photo is of a man, but the locked notice says “Only her friends can see what she shares on her profile” (emphasis added). This discrepancy could be the result of changing the account profile to avoid detection, as another common tactic in influence operations is to overhaul account profiles by changing a profile from male to female.

On a number of the accounts in the network, gender shifts were also apparent when comparing current and previous profile photos. For example, the account “Rustam Gutu” recently had a photo seeming to show a man, but its previous photo was clearly of a woman with very different facial characteristics.

All of the accounts that comprised the network had no friends. This lack of network connections with other users, when combined with their frequent trolling or copypasta comments as described below, indicates that the accounts were created for the purpose of posting the comments and with no intention to engage in social networking.

The account “Eunice Stere” appears to have appropriated or pivoted from a Vietnamese profile. Its only post was written in Vietnamese on January 1, 2023; it was was accompanied by a photo of a person leaning on a motorcycle who was clearly a different person than the one in the most recent profile photo. The only other activity, besides its recent profile photo change, was an indication that the account operator had “Moved to Nho Quan,” a town in northern Vietnam.

Additionally, the account listed a number, under “Zalo,” in its Intro information. As of 2022, Zalo was the most popular messaging app in Vietnam. It also listed Instagram and TikTok handles – both of which the DFRLab could not find when searching the respective platforms – in its Intro information. While its unlikely that this network operated out of Vietnam given that the Eunice Spere account was the only one to prominently feature Vietnamese content, Facebook has previously removed Vietnamese networks that targeted other countries.

A number of accounts in the network published posts including the phrase “Merhaba,” the Turkish word for “hello,” alongside a four-digit number. The numbers could correspond to accounts on another platform, such as calling app Merhaba, shopping app Merhaba Shopping, or chat app Marhaba. Alternatively, it could be a sign of automated posting using a script that caused a number of accounts all operated by the same entity to post sequentially.

Some accounts, including the Eunice Stere and Rustam Gutu profiles, appeared to have used AI-generated images with similar features indicating their questionable provenance, such as distorted or blurred eyes of different sizes. In some pictures, particular elements were poorly integrated, such as clothing details or the buildings in the background. These inconsistencies and artifacts are a common problem for many AI image generators. Moreover, the image’s watermark in the lower right corner indicates that the photos were generated by OpenAI’s DALL-E 2, which according to its description “can create realistic images and art from a description in natural language.”

The DFRLab also identified that some of the accounts’ profile photos were taken from elsewhere online. After conducting a reverse image search on Yandex for one of the pictures posted on the Facebook account “Eugenia Niculescu,” the account appeared to have repurposed a photo of Laura Jade Stone, a London-based fashion influencer.

On Facebook, Eugenia Niculescu claimed to be a Moldovan citizen angry with the Moldovan government. For instance, in one of the comments posted to Mișcarea Pentru Popor (“Movement for the people”), a page created for the anti-government protests, Niculescu commented: “We are too peaceful with idiots from PAS [the Pro-European party of President Sandu]; that’s why we live such hard times.”

Other profiles, such as those for “Gabriela Turcanu” and “Anna Kassapu,” posted copypasta comments identical to the language that appeared in Niculescu’s comment.

Some of the accounts’ comments appeared intended to discredit the pro-European stance of the PAS government and to suggest a link between high gas prices and the European integration process. One such copypasta comment read in Romanian, “All we get from PAS’s pro-European stance are European prices.”

Another bogus profile, “George Godeanu,” pushed the same idea, writing, “I thought Maia’s promise of European integration was about higher wages, education, and culture, but it appears that for PAS it was just about higher prices like in Europe; the rest remained like in Moldova.”

Since the anti-government protests organized by the Shor Party were aimed at growing gas prices, the comments coming from fake profiles typically reinforced these grievances. For instance, “Tatiana Donici” and “Nazario Voronin” posted copypasta comments saying, “I couldn’t pay my bills all winter, and now I’m already on the point of leaving the country to make money to pay my utilities and debts.”

Another example of copypasta comments referring to the price of gas came from “Rustam Parvu,” “Marina Videanu,” and “Rita Guzun,” who claimed to have experienced difficulties in paying bills using verbatim language: “During the heating months, November, December and January, I paid only for gas, 25,000 lei, because it is not my apartment, and I could not submit for the discount. This while I work at 2 jobs and I have a total income of only 12,000 lei per month. Now calculate how much money I have left for clothes and food.”

The accounts also aimed to incite hostility toward Ukrainians, spreading accusations that the Moldovan government prioritizes the needs of Ukrainians over Moldovans. For example, the accounts “Mihai Petcu,” “Emma Juravschi,” and “Virgilia Balan” posted the same copypasta comments on multiple posts, all saying in Romanian, “It is terrible what is happening in Moldova, but those from PAS care more about Ukraine than Moldovans.” Another copypasta comment by the accounts “Bernard Kassapu” and “Stanislav Gherman” stated that “PAS should be looking for ways to help its citizens survive instead of worrying about Ukraine.”

Most activity of this network was concentrated under posts to the official Facebook pages belonging to the Shor Party, party founder Ilan Shor, party vice president Marina Tauber, and the Movement for the People, an organizational page for the anti-government protests. While the DFRLab could not determine whether these accounts were involved in the Facebook campaign, they benefited from its artificial engagement that served to exaggerate the popularity of the Shor Party and its leaders.

On May 1, 2023, Moldovan authorities arrested Marina Tauber at the Chisinau International Airport as she tried to get on a flight to Tel Aviv, where Ilan Shor is currently avoiding his conviction by a Moldovan court. Tauber is the subject of a criminal case opened in July 2022, in which she was charged with forging the party’s financial management report and accepting money from a criminal group.

Following Tauber’s arrest, many of the fake accounts increased their copypasta trolling activities, targeting President Sandu with comparisons to Hitler and accusing her of abusing her office to attack political opponents.

On June 19, 2023, the Constitutional Court of the Republic of Moldova banned the Shor Party, declaring it illegal. The Government of Moldova had previously filed a complaint that stated that the party had acted in contradiction with the principles of the rule of law and served the interests of the Russian Federation in Moldova. Prior to the ban, the leaders of the Shor Party were sanctioned by the European Union, the United States, and the United Kingdom for conspiring with Russia to destabilize Moldova and overthrow its government.

Victoria Olari and Iain Robertson, “Inauthentic Facebook campaign promoted pro-Russian Shor Party messaging in Moldova,” Digital Forensic Research Lab (DFRLab), July 11, 2023, https://dfrlab.org/2023/07/11/inauthentic-facebook-campaign-promoted-pro-russian-shor-party-messaging-in-moldova/.