BANNER: Alexandru Musteața, director of the Security and Intelligence Service of the Republic of Moldova, speaks at a press briefing in October 2023. (Source: Security and Intelligence Service/archive)

An investigation by the DFRLab has revealed that anonymous Telegram channels, operating in Russian language and focusing on Moldova, have been disseminating false information about Moldovan political affairs and the nation’s pro-European government. While the content published by these channels mirrors the Kremlin’s adversarial stance toward Moldova, Telegram provides considerable anonymity for channel administrators, making it nearly impossible to determine whether the channels involved in this operation are controlled from beyond Moldova’s borders.

Given the anonymity Telegram offers, it is an effective platform for domestic information manipulation and foreign influence and interference. In this case, the Telegram channels identified by the DFRLab position themselves as legitimate news channels while predominantly spreading pro-Russian and anti-Western content in an attempt to undermine support for Moldova’s Western allies among the Moldovan public. On March 5, 2024, Alexandru Musteata, the director of the Security and Intelligence Service of the Republic of Moldova, announced that his team had obtained proof of Russia’s plans to undermine Moldova’s forthcoming referendum on European integration and meddle in the Moldovan presidential elections. He emphasized that Telegram and TikTok are the primary platforms for the dissemination of propaganda by foreign adversaries. According to Similarweb, Telegram is the second most popular messaging application in Moldova.

This issue of anonymous Telegram channels is indicative of a broader regional challenge. In February 2021, Ukraine’s Security Services uncovered a vast network of such channels directed by Russia’s Main Intelligence Directorate and arrested many involved with using the channels to fuel social unrest and protests in Ukraine. In 2020, the DFRLab reported on anonymous Telegram channels in Ukraine serving as a “gateway” to fringe media outlets that amplify false claims originating from anonymous channels. In 2020, the DFRLab also covered how anonymous Telegram channels attacked opponents of integration and spread pro-Kremlin narratives amid economic integration talks between Russia and Belarus.

The DFRLab found forty-one anonymous Telegram channels regularly posting news related to Moldova, incorporating pro-Russian and anti-Western messages in their publications. The DFRLab scraped more than 800,000 posts from these channels and archived them using OpenSearch for further examination. None of these channels contain any information about their ownership in their channel descriptions, names, or texts. While the DFRLab could not confirm that these channels are operated by the same individuals, the available evidence suggested that they actively promote each other’s content.

The DFRLab selected five topics and examined how Telegram channels framed messages around them. Specifically, the DFRLab looked at messaging around: (1) Moldova’s “militarization” and enhanced military cooperation with France; (2) false claims of Ukraine’s alleged plans to assault Transnistria Region; (3) Gagauzia’s request for Russia’s “protection;” (4) anti-government protests in Moldova, organized by pro-Russian groups in March 2023; and (5) the upcoming referendum on Moldova’s EU integration, as announced by President Maia Sandu in December 2023. Subsequently, the DFRLab selected relevant keywords to identify Telegram posts discussing these topics and found that channels published over 2,700 posts about these topics, which garnered over 8,911,000 views on Telegram in total.

Several factors may explain why the individuals operating these channels have chosen Telegram to disseminate messages. Telegram offers robust privacy protections for its users, particularly those managing channels, making it challenging to uncover their identities. Moreover, compared to mainstream social media platforms, Telegram takes a relatively hands-off approach to content moderation and combating disinformation, allowing malign actors to distribute messages more freely and with minimal risk of being moderated. This approach means that their content remains accessible for longer periods than on other platforms with more direct content moderation policies. The surge in Telegram’s popularity and use in Russia, Ukraine, and the surrounding areas following the invasion of Ukraine in 2022 likely also encouraged these actors to broaden their operations on the platform, capitalizing on Telegram’s rapidly growing user base. Furthermore, with the pro-Kremlin segment of Telegram’s ecosystem expanding and attracting a substantial following, malign actors likely see Telegram as a place where their messages will be amplified by pro-Kremlin channels from various communities, and that operators of these channels have a greater chances to increase their audience with the help of other channels, whether through coordination or organic amplification due to overlapping interests.

The anonymous Telegram channels have been actively disseminating messages about the supposed “militarization of Moldova” for over two years, with a particular increase in activity at the beginning of 2024. In late January 2024, disinformation circulated on Telegram, including on Tranistrian channels, falsely claiming that US-provided F-16s destined for Ukraine might be stationed in Moldova. This in turn would purportedly make Moldova a target for attacks, as Chisinau is accused of blatantly disregarding Moscow’s warnings. Moldovan authorities debunked the disinformation, saying that had been attributed to nonexistent statements from the Moldovan Minister of Defense. This period also saw the spread of a copypasta narrative on Telegram suggesting that “under the strict control of Western curators,” Moldova is pushed toward militarization and away from its constitutionally mandated neutrality.

The monitored anonymous Telegram channels actively crafted narratives about the ineffectiveness of the military equipment Moldova acquired recently, in particular the French air radar purchased in December 2023. This narrative gained momentum between February 11 and 16, 2024, following the Moldovan border police’s discovery of “Shahed” drone fragments on February 11 in the south of the country, with the channels ridiculing the radar’s failure to detect the drone. A similar narrative resurfaced on February 26-28, after Telegram channels reported another drone intrusion into Moldovan territory, a claim refuted by the Ministry of Defense in Chisinau. The anti-radar narrative intensified again between February 22-25, coinciding with Moldova’s announcement of its intention to purchase a second radar. The channel “МолдБриф” (“MoldBrief”) interpreted France’s weapons sale to be a betrayal of its agreements with Russia. Another of the channel’s posts discussed the previous deal involving the purchase of an air radar system from French company THALES, hinting at Moldova’s integration into Romania/NATO’s air defense system and broader military cooperation with France, including joint exercises.

At the beginning of March 2024, the channels criticized Sandu’s visit to France, which included the signing of a defense cooperation agreement between Paris and Chisinau, which provided for, among other things, the establishment of a military attaché office at the French Embassy in Moldova. The anonymous channels speculated that “France has withdrawn its troops from Niger and plans to replace Niger with Moldova,” declaring that “France is not exactly the NATO member state that can be entrusted with the security of Chisinau.” MoldBrief highlighted the construction of a new military base near Chisinau, speculating that it will serve as a location for a French military mission dedicated to training Moldovan forces. Additionally, there was speculation about the possible relocation of a French military contingent from Romania to this new base.

In the beginning of 2023, Russian authorities accused Ukraine of having an intention to assault the secessionist region of Transnistria in Moldova, and it was widely amplified by the anonymous Telegram channels analyzed by the DFRLab. Specifically, some of the channels claimed that Ukraine might initiate an operation against Transnistria on February 24, 2023, and propagated a narrative suggesting that Ukraine’s invasion would require approval or a formal request from the President of Moldova. The channels also suggested that any Ukrainian military action would need a request from Moldovan authorities and speculated an existence of a potential agreement between Sandu and Ukrainian President Volodymyr Zelenskyy to “to get rid of Transnistria”.

In March 2024, the channel “Гагаузская Республика” (“Republic of Gagauzia”) reinforced the narrative  by voicing concern over Moldova’s military preparations, positing that Western powers are preparing the country for war, specifically to address the Transnistrian issue through military means. Meanwhile, the channel “Смуглянка” (“Dark-skinned girl”) speculated on a potential quick military operation in Transnistria that would be comparable to the Nagorno-Karabakh campaign and that could be anticipated to last six days. This discussion extends to the potential involvement of Moldovan and Ukrainian forces in imminent military engagements, possibly against Transnistria, hinting at a larger strategic scheme led by the United States to diminish Russian influence in the region.

On Telegram, there was a noticeable escalation of the subject concerning the Gagauzia region in March 2024. The narratives spread by the pro-Russian anonymous Telegram channels also focused on the tensions in Gagauzia, attributing this to President Sandu’s supposed authoritarianism. According to the channels, Gagauzia and Transnistria are under significant pressure from the Moldovan government due to their pro-Russian stance, suggesting that the increased pressure could lead to a stronger response or a move toward independence or closer ties with Russia.

The overarching theme is the alleged economic and legal oppression of Gagauzia (and Transnistria) by the Moldovan government, described as an “economic, suffocating war.” The channels highlighted Gagauzia’s plea for assistance from Russia, indicating a request for support against what they describe as the Moldovan regime’s “provocations” and “repressive policies.” The narratives claim that the Moldovan authorities are violating the rights of Gagauzians and that there is a desire within Gagauzia to develop closer relations with Russia, positioning the latter as a protector of these rights. Indeed, the channels pushed the narrative that Gagauzia has always aspired to be part of Russia, with claims that such a moment is near.

However, this narrative is not new. In September 2022, amidst anti-government demonstrations in Moldova, discussions about the Gagauzia region’s separatism were spread on anonymous Telegram channels. The channel “Dark-skinned girl” claimed that the Moldovan central government’s marginalization of Gagauzia was leading the region to pursue greater economic and political autonomy. It warned that, given the rapidly evolving geopolitical landscape, Moldova risked permanently “losing” Gagauzia. Relatedly, the channel “Правда Гагаузии” (Truth of Gagauzia) suggested that Moldova was teetering on the edge of war and that Gagauzians were bewildered that the Moldovan government’’s actions seemed to go against national interests, particularly its failure to mend ties with Russia.

In an attempt to escalate anti-government feelings amid protests in March 2023, the Telegram channels also spread unconfirmed tales suggesting the Moldovan government had brought in foreign “saboteurs” and police officers to suppress dissent in Moldova. These channels circulated baseless accusations about an incognito foreign “saboteur,” allegedly in civilian attire, present during a Chisinau demonstration. They claimed President Sandu had enlisted individuals from foreign security agencies due to fears of a potential coup as well as insinuated that these foreigners might have detained protestors. The channel “Молдавский Vагон” (Moldavan Vagon) for instance, identified a “foreigner,” as seen in a photo taken at a protest, as an American with malevolent intentions toward Moldova. (There did not appear to be any attempt online to identify the person in the photo, however.)

Following this, some of the Telegram channels reported seeing a Romanian woman in Moldovan carabinieri attire at a demonstration. Moldova’s Ministry of Internal Affairs refuted claims of foreign law enforcement involvement and labeled such misinformation as attempts to destabilize the situation. The channel “Гагаузская Республика” (Gagauzian Republic) also called for people to participate in protests against the Moldovan government scheduled for October 2022.

After President Sandu announced plans for a referendum in December 2023 on Moldova’s potential accession to the European Union, the anonymous Telegram channels promptly launched a campaign to undermine the referendum by spreading manipulated and misleading information about it. For instance, the channels claimed that Sandu intended to rig the referendum’s results and accused her of coming up with an idea of referendum just in order to secure a second presidential term through deceit, leading at least one Telegram post to encourage its subscribers to vote against the referendum. The channel “Гений Карпат” (Genius of the Carpathians) suggested that Western nations feared Moldovans would vote against EU integration and allegedly advised Sandu against proceeding with holding the referendum. Despite this, the channel said that Sandu is determined to proceed with the referendum, despite the concerns of Western nations. Additionally, at least eleven of the anonymous channels reviewed by the DFRLab forwarded a post from Vladimir Bukarski, member of Moldovan socialist party, in which he listed ten reasons why Moldovans should have not boycott the referendum and instead vote against EU integration.

Additionally, the DFRLab discovered that operators behind at least eight Telegram channels are also managing Facebook pages under the same names. These Facebook pages disseminate messages that closely resemble their Telegram counterparts. For example, the SalutMoldova page alleged that President Sandu is promoting the militarization of Moldova. Similarly, Moldavian Mole suggested that a French radar system funded by Moldova’s national defense budget failed to detect drone debris falling within the country’s territory, questioning the radar’s effectiveness. The Cenzura.md page on Facebook shared several statements from individuals against a referendum on EU integration. Both Moldovan Mole and Cenzura.md reported on Eugenia Gutsul’s visit to Russia, echoing her statement that Gagauzia might consider secession from Moldova should the nation lose its independence.

Four of the eight Facebook pages have been relatively inactive, however. Independent Transnistria has published only one post since July 2020, while Moldavian piston has not posted content since November of that year. WTF Moldova page published its most recent post in May 2023, while Moldova Now, created in September 2023, has not yet published any content. Despite the four page’s limited use of Facebook, they’ve shown considerable activity on Telegram, suggesting they consider it more effective to disseminate content through that platform rather than persisting with publishing content on Facebook. This could also imply that channel operators concluded that Facebook’s content moderation policies would limit the potential success of their efforts on that platform. The DFRLab also identified four TikTok accounts bearing names mirroring Telegram channels. Overall, though, it appears that most channel operators prioritize Telegram as their main platform, focusing on cross-promotion through post forwarding and mutual mentions to achieve audience growth.

Channels may also count on amplification of their messages by online media outlets as it allows them to reach bigger audience. For example, when the channels alleged that foreigners were present in police cordons during the March 2023 anti-government protest, these claims were then referenced by multiple Russian media outlets, including TASS, Lenta, and Ria Novosti, among others.

The forty-one identified channels were established in or after 2017, and, as of March 26, 2024, the channel with the highest subscriber, “Приднестровец” (Pridnestrovets), count boasted over 73,000 followers. A review of the posting behavior across these channels indicated that they reached their peak monthly posting frequencies in October 2023 (27,269 posts), October 2022 (26,636 posts), and March 2023 (26,284 posts).

The surge in posts in October 2023 was likely linked to the to local elections that occurred on November 5, 2023. The increased activity in October 2022 is likely attributable to anti-government protests over increased electricity and gas prices and high inflation rate, and the heightened posting activity in March 2023 seemed to be associated with demonstrations organized by pro-Russian groups in Moldova.

The DFRLab discovered that, among the five topics identified above, anti-government protests in 2022 and 2023 were the most frequently discussed topic among the channels. Keywords associated with the protests during the periods when they took place in the country received 3,050 mentions, and posts containing those keywords accumulated over 9,894,000 views in total and were forwarded more than 31,000 times from the channels analyzed. At the time of the investigation, the topic of Moldova’s forthcoming referendum on EU integration attracted the least number of mentions, views, and forwards. However, disinformation surrounding the subject could intensify as the election period, scheduled for late autumn 2024, approaches.

The DFRLab also conducted topic modelling, using the statistical modeling technique known as Bidirectional Encoder Representations from Transformers (BERTopic), to identify broad topical trends – as separate from the five topics identified above – among the Telegram channels. The BERTopic analysis of the more than 800,000 posts from the forty-one channels revealed that the most frequently discussed topic by channels focused on the war in Ukraine and the activities of the Russian armed forces there. Additionally, the second most commonly discussed subject was the Moldovan socialist party, elections, and parliament members. The third most prominent topic of conversation was US military support for Ukraine. This was closely followed by discussions about elected officials, including Moldova’s president, prime minister, and other ministers. Lastly, the fifth most discussed issue across these channels pertained to the economic repercussions stemming from the conflict between Russia and Ukraine.

As mentioned above, while the identity of the operator or operators behind the channels remains unknown, the channels nevertheless broadly shared each other’s posts.

For instance, the channel “Молдавский пистон” (Moldavian piston) forwarded over 3,300 posts from the other forty channels, and these channels in turn forwarded over 4,200 posts from Moldavian piston. This indicates that, apart from aligning messages and pushing similar narratives, there was some intentionality behind how they promoted each other as well.

Givi Gigitashvili and Victoria Olari, “Moldova in the digital crosshairs of anonymous, pro-Russian Telegram channels,” Digital Forensic Research Lab (DFRLab), April 12, 2024, https://dfrlab.org/2024/04/12/moldova-digital-crosshairs-pro-russian-telegram-channels.