BANNER: Screenshots of sponsored posts on Instagram and Facebook announcing, “The concert is banned.” (Source: Instagram, left; Facebook, right)

On October 20, 2024, the Republic of Moldova will hold an election which could reshape its future. Moldovans will not only elect a new head of state but also vote in a constitutional referendum that will determine the country’s path toward European Union (EU) membership.

Since Russia’s February 2022 invasion of Ukraine, Moldova, like its neighbor, has made significant strides in aligning with the EU, gaining candidate status and initiating negotiations for full membership. However, Moscow’s ongoing interference threatens this progress. The Moldovan government has repeatedly warned of Russia’s “unprecedented onslaught” of hybrid tactics—ranging from disinformation campaigns to money laundering and corruption—to undermine the country’s elections and derail its European aspirations.

This DFRLab analysis scrutinizes an influence operation designed to undermine the pro-European government of Moldova by portraying it as enforcing censorship ahead of the EU accession referendum. The operation used Ukraine as a smokescreen, with the involvement of a Ukrainian artist and attempts by allegedly Ukrainian Facebook pages and accounts to create the illusion of a Ukrainian-led campaign. The organization’s attempt to appear Ukrainian in origin aimed to discredit both Moldova and Ukraine’s aspirations for EU membership.

In September 2024, billboards promoting a concert by Ukrainian artist Anastasya Prikhodko appeared at public transit stations in Chisinau. The posters featured the artist’s image and a cryptic title, “NU EC Yes,” in yellow and blue. This title has no direct translation in Romanian, Ukrainian, or Russian, raising suspicions about its meaning.

The choice of this coded title was puzzling, especially considering Prikhodko’s ongoing concert tour is named “Любила” (I used to love), raising questions about why the concert in Chisinau was promoted under the unfamiliar name “NU EC Yes?”

The situation escalated on September 23, when several pro-Russian Telegram channels reported that Moldovan authorities had allegedly canceled the concert and planned to ban Prikhodko from entering the country. These channels were the first to suggest that the title contained a hidden anti-EU message, interpreting “NU EC” as “NO EU”—with “NU” being Romanian for “NO,” and “EC” being a common abbreviation for the European Union (EU) in Ukrainian and Russian (but not Romanian; the use of mixed languages added to the message’s cryptic nature). This sparked speculation that the concert’s title subtly opposed Moldova’s and Ukraine’s European integration.

Pro-Russian Telegram channels linked the alleged ban to Prikhodko’s political stance. Despite her vocal support for Ukraine’s armed forces, the singer was also critical of Ukraine’s EU aspirations. Prikhodko recently published a video on TikTok opposing Ukraine’s accession to the EU, further fueling the speculation surrounding the concert.

However, later statements from Prikhodko’s public relations team contradicted these reports. “The Moldovan authorities did not ban the concert,” They clarified for Point.md. “It was Anastasia’s personal decision. The concert was scheduled for October 6 in Chisinau, and Anastasia was preparing for it. Unfortunately, we cannot provide further details at this time. We will make an official statement on the matter later.”

The confusion surrounding the concert and its sudden cancellation raises more questions than answers. DFRLab began investigating whether the coded title, the involvement of pro-Russian channels, and the geopolitical context surrounding Moldova’s EU referendum were evidence of something more malicious than a cultural event gone awry.

The DFRLab uncovered suspicious details about the concert, which was promoted through a Facebook event titled “Anastasia Prikhodko la Chișinău” (“Anastasia Prikhodko in Chisinau”). The event was managed by a Facebook page with the exact same name, which was created on September 11, 2024—the same day the event was announced.

The DFRLab also noted a discrepancy regarding the concert’s location. Posts published on the Facebook page indicate the venue as Club Skal, while in the event description created by the same page, the location is listed as Studio Night Club. This inconsistency is also evident on ticket-selling websites. For instance, on AFISHA.md, the concert is listed at Studio Night Club, while on Mticket.md, the same concert, with the same date and time, is listed at Club Skal. After the scandal around the concert gained public attention, both platforms halted ticket sales.

Although the Facebook event was created to promote the concert, the DFRLab did not find any sponsored posts promoting this concert on Facebook. Only three accounts responded to the event invitation. Most of the promotion was done outdoors, with posters at public transport stations in Chisinau.

On October 6, after the concert’s cancellation, the page behind the event posted a message on Facebook hinting that the authorities banned the concert. The page stated the only explanation they managed to obtain informally “lies in the artist’s public stance on Ukraine’s Euro-integration processes, which might influence the upcoming Euro-referendum in Moldova.” The page sponsored the post about the “banning” of the concert on both Facebook and Instagram; the Facebook page’s Transparency section did not disclose the ad.

The DFRLab also uncovered a Facebook page titled “Yes NU EC,” which shares an identical name and visual identity with the controversial slogan linked to the concert. The page’s introduction reads, “Молдова и Украина – путь в ЕС” (“Moldova and Ukraine – the path to the EU”), while the details section states: “The start of negotiations for Ukraine’s and Moldova’s accession to the EU is an investment in peace and security, but the path to the EU for these countries will not be swift!” The page was created in July 2022 and has maintained the same name since then. It has amassed a significant following, with 87,000 likes and 116,000 followers. Although the page has a Moldovan address listed in the About section, the Page Transparency section reveals that the primary location of its managers includes Ukraine, with six administrators from the country.

Until June 2024, the page exclusively featured content related to Ukraine, mainly consisting of videos reuploaded from Ukrainian bloggers. However, starting on August 16, 2024, the page began posting about Moldova, with a particular focus on Ukrainian refugees in the country. While many posts provide neutral general news, some promote anti-EU sentiments or express hesitation towards EU integration. For instance, one post featured a video of Prikhodko with the caption: “Anastasia Prikhodko is categorically against Ukraine’s accession to the EU. Indeed, the European path was imposed in Ukrainian politics without any dialogue with the electorate, leaving many Ukrainian citizens dissatisfied. A similar mistake must be avoided in Moldova, where a referendum on EU membership is scheduled for October this year.” The page has also promoted pro-Russian narratives against the referendum, targeted Moldovan President Maia Sandu, and featured entertainment content produced by pro-Russian propagandists from Типичная Молдова (Typical Moldova), further fueling suspicion that the platform is being used to influence public opinion in Moldova against EU integration.

The page also veered into other issues in Russo-Moldovan relations. On October 4, it published a post about the blocking of Russian platforms Yandex and RUTUBE by Moldova’s intelligence services—referring to this action as a “purge of the information space” and stating that “it is clear that dissenting voices will not be tolerated.” They also highlight the “controversial” cancellation of Prikhodko’s concert as part of a broader effort to control media and public discourse in Moldova.

Despite its many likes and followers, the Yes NU EC Facebook page shows notably low engagement. A closer examination reveals that most comments and likes on posts originate from accounts which appear to be inauthentic. This is exemplified in a post that states, “Sad numbers: in the last four years, 309,000 Moldovan citizens have left the country.” All the comments on this post were made by profiles claiming to be from Moldova, and most of them updated their profile picture on September 4-5, 2024, with some stealing photos from real social media profiles. This suggests a possibly coordinated effort to inflate engagement using fake accounts.

Adding to the suspicion, between August 19 and September 3, 2024, the page experienced a sudden influx of reviews aimed at artificially boosting its rating. Most of these reviews were made by seemingly inauthentic profiles claiming either to be from Moldova or Ukrainians interested in Moldovan news, further suggesting an orchestrated effort to manipulate the page’s reputation and credibility.

For example, an account using the Ukrainian name Агнія Володимирова (Agnya Volodimirova), claiming to be from the Ukrainian city of Lutsk, left a review stating, “I have relatives in Moldova and lots of friends. I visit regularly and love this cozy country!!”However, a Yandex image search reveals that her profile picture is also found on the Russian sales website avito.ru and Vkontakte under the name Юлия Пучкова (Yuliya Puchkova).

Other accounts that reviewed the Yes NU EC page, such as Марта Минаева, Дарья Шведова, Dorian Grey, Оливия Генералова, Зоя Аверина, Алина Доценко, were created on August 26-27, 2024. Many of these accounts openly feature the flags of Moldova and Ukraine in their photo galleries.

As of October 1, 2024, the Yes NU EC page began running paid promotions on Facebook, seemingly attempting to increase its follower base.

While DFRLab cannot definitively attribute the Yes NU EC campaign to any specific actor, the patterns observed suggest a coordinated influence operation. The indirect involvement of a Ukrainian artist in the campaign and the coordinated inauthentic activity on the Yes NU EC Facebook page raises serious suspicions that this was part of a broader campaign targeting Moldova’s European aspirations under the guise of Ukrainian activity. One of the key objectives of this operation appears to be stirring anger among Moldovan citizens by portraying the government as intolerant of dissenting views and engaged in censorship. The frequency and transparency with which these accounts display their Ukrainian ties suggest a deliberate attempt to give the impression that Ukraine is behind this operation, tarnishing Ukraine’s image and fueling mistrust among Moldova’s population in advance of the upcoming EU referendum.

Victoria Olari, “Mysterious cross-border influence campaign sparks election controversy in Moldova,” Digital Forensic Research Lab (DFRLab), October 8, 2024, https://dfrlab.org/2024/10/08/mysterious-cross-border-influence-campaign-sparks-election-controversy-in-moldova/.