Banner: Moldovan incumbent President Maia Sandu launches her election campaign in Chisinau, August 22, 2024. (Source: Reuters/Vladislav Culiomza)

In the lead-up to Moldova’s presidential elections and European Union accession referendum on October 20, 2024, pro-Russian actors have actively worked to sway public opinion. Their manipulation efforts include the dissemination of forged letters, the creation of a Telegram chatbot offering financial incentives to vote against EU membership, the running of anti-referendum ads on Meta platforms, and even a social media campaign featuring a bus tour around Europe. These efforts aim to exploit societal divisions in Moldova and spread disinformation, ultimately seeking to influence the referendum results.

The presidential election will be the first since the European Commission agreed to initiate accession talks with Moldova, making it a pivotal moment for determining the country’s future trajectory and evaluating its internal resilience in the face of external pressures. Evidence suggests that the Kremlin has ramped up hybrid threat activities ahead of the election and referendum, specifically aiming to disrupt Moldova’s efforts toward EU integration and weaken the re-election prospects of the current pro-Western president, Maia Sandu.

On October 10, the messaging service Telegram blocked fifteen channels and ninety-five chatbots linked to the Victory Bloc—a political bloc established by an oligarch in exile, Ilan Shor—for illegal political financing, voter bribery, and vote-buying. Law enforcement requested details from Telegram about the chatbots’ administrators, IP addresses, and phone numbers for criminal investigations into large-scale illegal party financing and money laundering.  

The next day, Meta announced that it removed a network of inauthentic assets targeting Russian-speaking audiences in Moldova for violating its Coordinated Inauthentic Behavior policy. The operation involved about a dozen fake Russian-language news brands posing as independent outlets across various platforms like Telegram, Odnoklassniki (or ‘OK,’ a Russian-language social networking site), and TikTok. The network aimed to drive people to its off-platform channels, mainly on Telegram, and offered incentives like money, food, and concert tickets to gain followers. Meta’s investigation found links to individuals in Russia and Moldova’s Transnistria region, which is occupied by the Russian military.

These actions appear to be linked to an effort that began days earlier, on September 29, less than a month before the presidential elections and the referendum set for October 20, 2024. That day, the leader of the Victory Bloc, Ilan Shor—who was sentenced to fifteen years in prison in Moldova and is now hiding from justice in the Russian Federation—launched a Telegram chatbot called ‘STOP UE/СТОП ЕС’ (“Stop EU” in English) aimed at recruiting ‘ambassadors’ against the referendum.

In the promotional message for the chatbot, Shor claimed that “European integration will definitively destroy our country” and urged people to join his team to convince as many individuals as possible to vote against the EU, emphasizing that “all work will be paid.”

The greeting message of the chatbot promises 500 lei ($28 USD) just for registering, 2,000 lei ($110) for “completing minimal tasks,” and 5,000 lei ($280) if the majority of individuals registered at the user’s polling station vote “against” Moldova integration into EU and in favor of the presidential candidate of the Shor coalition, whose name is not specified. As just one example of the type of activities for which registered users can earn bonuses, the chatbot says that “for each Facebook post, but no more than 10 posts per month, you will receive 150 lei ($8).”

The chatbot also informs users that a personal bank account will be opened to transfer funds to each registered user. Additionally, the bot generates a “guide on contracts” with a non-governmental organization called Evrasia, which began its activities in April 2024. According to the Evrasia website, it is led by Aliona Arshinova, a member of the State Duma of Russia and vice president of the ruling party United Russia, which is on the list of international sanctions. The official organizational filing list Nelli Parutenco, a former accountant of the Orhei City Hall during Ilan Shor’s tenure as mayor, as the director. On September 13, Evrasia and Parutenco were sanctioned by the US State Department for orchestrating a scheme to transfer money to Moldova under the guise of humanitarian assistance; according to the sanction announcement, this money “was intended for a vote-buying campaign for pro-Kremlin candidates, thereby undermining democracy in Moldova.”

The chatbot also provides information about the use of MIR cards, which have been used since spring 2024 by the Shor group to transfer financial supplements from the Russian Federation to pensioners and public officials in the southern regions of Moldova, namely Gagauzia, Taraclia, and Orhei. Seeking to assuage any legal concerns, the chatbot assures new users that their activities do not constitute electoral corruption and that they will have the support of a team of lawyers. At the same time, they are warned not to interact with the police without the organization’s lawyer and that they are “categorically not to give the phone” to law enforcement bodies.

The STOP UE/СТОП ЕС bot is not the first tool of this kind used by Shor’s group. So-called activists of the Victory Bloc are gathering people to vote against the referendum and in favor of the still-to-be-determined presidential candidate supported by the political bloc using similar methods across the country. DFRLab reviewed a similar chat created specifically for residents of a neighborhood in Chisinau, intended to recruit activists against the referendum, in exchange for financial compensation. Additionally, Moldovan journalists have reported on several identical chatbots in various localities in northern and southern Moldova, particularly in Balti and in the autonomous region of Gagauzia. 

The registration mechanism in all cases is the same: the bot requests the user’s phone number and location data, followed by a photograph of their identity document and identity verification through a facial scan. To continue using the bot, the user must agree to the terms of use which specify that “user comments and other posts must not contradict the laws of the Russian Federation.” Subsequently, the user becomes a “volunteer” for the Evrasia organization, and a few days later receives a message about the opening of a bank account for receiving funds in their name at Promsvyazbank, a state-owned Russian bank that was internationally sanctioned just days after Russia’s February 2022 invasion of Ukraine.

On October 3, Viorel Cernautseanu, head of the General Police Inspectorate, stated during a press conference that the police were aware of cases involving 130,000 citizens, registered only in September, who received cash transfers from the Russian Federation exceeding $15 million. Authorities claim that this money was reaching the accounts of Shor group local leaders, sympathizers, and activists through PromsvyazBank.

Although Moldovan authorities blocked ninety-five chatbots on Telegram, the STOP UE/СТОП ЕСbot was not affected. Individuals from the blocked chatbots were encouraged to join it. As a result, in the final days prior to the election, the number of users for this bot increased from 16,000 to more than 20,000.

The bot was also promoted through sponsored posts on Meta. Ilan Shor was included on the United States sanctions list on October 26, 2022 for “actions related to systemic corruption and Kremlin-backed interference in the Moldovan elections,” which means that as a US company, Meta is not legally allowed to do business with him. In June 2024, the company blocked Shor’s Facebook and Instagram pages and those of three others affiliated with him after they were attributed to “dangerous organizations and individuals.”

Even so, on October 5, a page named Patriotism și Progres în Moldova (“Patriotism and Progress in Moldova”) started running three ads simultaneously urging people to access the chatbot. The posts camouflaged the bot with a short video, featuring young people in motion, urging users to become “participants of an important change” by clicking on the link, which opened the bot page in Telegram. Identical ads also ran on another page named Moldova În Mișcare (“Moldova In Motion”). However, although Ilan Shor announced in his post on Telegram that the chatbot has already gathered “over 800,000 patriots from all over the country,” in reality the data from the chatbot shows that it had gathered around 20,000 users at the time of publishing.

The DFRLab identified three other pages that ran ads throughout September promoting Ilan Shor’s videos introducing the electoral program of the Victory Bloc and urging citizens to vote against the referendum. These ads were previously shared on the oligarch’s Telegram channel. On October 3 and October 8 respectively, the pages Orizonturi Deschise (“Open Horizons”) and Moldova Chronicle launched two simultaneous ads in both Romanian and Russian with the description, “The program that will change life for the better.” Shor’s video was disguised under a graphic featuring the word “Program,” a list of adjectives describing it, and a prompt to click a link that led to a YouTube video containing promises of free gas, investments, and an anti-LGBT law in exchange for a vote against EU integration.

On October 7, another page called Patrioții Moldovei (“Patriots of Moldova”) began running four ads, all dedicated to Ilan Shor’s team. One of these promoted the video which the oligarch shared on Telegram on September 29, in which he promised pension supplements and other promises along with the call to vote against the referendum.

DFRLab also identified five other pages that ran ads on Meta attributed to the Victory Bloc, most of which addressed the topic of the referendum on Moldova’s integration into the EU, bringing the total number of pages discovered by DFRLab to ten. All of these pages exhibited inauthentic behavior and disguised themselves as neutral news sources, similar to thirty-six pages previously identified by DFRLab which promoted similar messages from the Shor group. The ten pages analyzed by DFRLab were eventually blocked by Meta; according to Meta’s ad library, the company also blocked twenty-two similar pages between September 8 and October 7. Those pages ran ads totaling €36,500 during that period.

Another effort to influence Moldova’s election involved forged letters, which had objectives in common with Victory bloc but with no publicly known evidence connecting the two operations. In September and October 2024, various state institutions received several forged letters spreading disinformation, mostly about the European Union. These letters, attributed falsely to various official bodies of the European Union and Moldovan government, aimed to create confusion, undermine trust in state institutions, and provoke unrest among the population. It is worth noting that all these letters were debunked by the institutions they targeted.

September 9: Workers in both state institutions and private companies reportedly received a fraudulent letter, falsely signed by the Ministry of Labor and Social Protection. The letter claimed that, due to high emigration rates, Moldova would be bringing in migrants from the Middle East to address labor shortages. It also outlined specific requirements for organizations, such as mandating that at least thirty percent of their employees be migrant workers and requiring employers to accommodate migrants’ religious practices.

September 24: A fake letter was distributed to the email addresses of various educational institutions, purportedly from the Ministry of Education. The letter stated that universities were mandated to introduce extra hours of sex education and to create shared bathrooms for students who do not conform to traditional gender identities. It also included instructions to allocate one hour a week for lectures on nonbinary identities.

September 26: Another letter falsely represented itself as a response from the European Commission to Moldovan authorities’ requests for support in the agricultural sector. Distributed to civil servants of the Ministry of Agriculture and Food Industry, the letter claimed that the EU had reviewed the Moldovan government’s request for financial assistance and decided against providing it.

October 2: A forged order sent to town halls and several NGOs via email claimed to be from Stratulat Grigore, State Secretary at Moldova’s Ministry of Environment. The letter claimed that incinerators would be constructed in multiple districts of Moldova to handle waste imported from Romania and Ukraine for subsequent disposal on Moldova’s territory.

October 4: A forged document allegedly issued by the European Union Partnership Mission in Moldova was reportedly sent to individuals working within Moldovan security and law enforcement institutions and falsely claimed that, as part of the conditions for Moldova’s accession to the EU, Moldovan male citizens between the ages of 18 and 45 would need to be mobilized into a volunteer military corps of the European Union, which would be deployed in Ukraine for training and joint operations against Russian aggression.

October 8: A forged order falsely claiming to be from the Ministry of Culture of Moldova began to circulate online. It approves days off for participants of a so-called “LGBT festival” and directs employers to prepare “the necessary payments to cover employee absences.”

By targeting different sectors such as agriculture, education, labor, and national security, these letters aimed to create confusion, sow discord, and undermine trust in public institutions and the European Union. The false narratives embedded in these documents attempt to paint a picture of an unstable country vulnerable to external manipulation.

Another initiative with similar goals is the “Nu Acum” (“Not Now”) campaign, which attempts to rally public support for a ‘no’ vote in any upcoming EU referendum. It promotes skepticism and opposition to Moldova’s integration into the European Union.

A core component of the campaign is its website, nuacum.eu, which serves as a hub for disinformation and manipulative content. The website not only calls for Moldovans to reject European integration, but also actively recruits volunteers to support the cause.

The campaign is particularly active on social media, leveraging platforms like Facebook, Instagram, Telegram, YouTube and X to amplify its message. Its frequent posts portray European integration as a negative outcome for Moldova. To bolster its visibility, short video clips and banners featuring the Nu Acum slogan have appeared across platforms like YouTube and various pro-Russian websites through paid online advertisements, further spreading the message and increasing its reach.

On September 25, Moldova’s intelligence services requested that internet providers to block access to the nuacum.eu website for users within Moldova. Meta has also blocked the campaign’s pages on Facebook and Instagram; later, X also banned the campaign’s account. Despite these efforts, the campaign continues to find ways to disseminate its message. Its presence on platforms like Telegram, and its use of alternative channels, such as pro-Russian websites, ensures that the Nu Acum narrative persists in some segments of the population.

Daniela Calmis, Victoria Olari, and Givi Gigitashvili, “Malign interference in Moldova ahead of presidential election and European referendum,” Digital Forensic Research Lab (DFRLab), October 18, 2024, https://dfrlab.org/2024/10/18/malign-interference-moldova/.