Banner: Romanian presidential candidate Calin Georgescu makes statements to the press in Izvorani, Ilfov county, near Bucharest, November 26, 2024. (Source: Inquam Photos/Octav Ganea via Reuters Connect)

An unprecedented decision by Romania’s Constitutional Court to annul the first round of the country’s presidential election followed the unexpected victory of Calin Georgescu, an independent, ultranationalist, and pro-Russia candidate, who caught many Romanians and the international community off guard.

After Georgescu won the first-round ballot with almost 23 percent of the vote, questions quickly swirled about the role that social media, particularly TikTok, played in Georgescu’s rise. His victory was so surprising that there were nearly two million Google searches for his name on election night alone.

The court annulled Georgescu’s first-round victory following the release of declassified intelligence documents that alleged likely state-backed cyberattacks, as well as covert, coordinated, and paid-for influence campaigns across social media. Romania will re-run the presidential election in the new year.

To better understand what role social media platforms may have played in this political crisis, the DFRLab investigated election discussion patterns prior to the vote, particularly on Telegram and TikTok. Telegram served as an unofficial but closely linked command hub for the Georgescu campaign. A central channel, known as “Propagator,” distributed more than 1,800 pieces of campaign material and actively coordinated further amplification across individual Telegram channels for each of Romania’s 41 counties. The central channel also provided detailed instructions for additional content generation and strategies for sharing on different platforms, especially TikTok and Facebook.

This coordination was felt across TikTok. It became the primary hub for public consumption of campaign content, particularly via Georgescu’s TikTok account, which successfully amassed more than 540,000 followers by the time of the first-round vote in late November. That month, his account recorded significant growth in terms of subscribers (2,541 percent), likes (1,496 percent), comments (1,581 percent), and shares (1,146 percent), despite a 29 percent decrease in video uploads to his account in November compared to the previous month. Ultimately, it resulted in Georgescu’s top dozen campaign hashtags generating 1.4 billion total views across the platform in Romania, across the European Union, and beyond.

As Romanian and EU officials investigate potential illegal behavior associated with the country’s election, the coordination efforts via Telegram are a central component for how Georgescu’s campaign was able to reach so many eyeballs across other social media platforms.

Such political coordination is not inherently illegal. But the sophistication of the online coordination, including the use of paid-for social media influencers via the online platform FameUp to promote Georgescu’s message without disclosing such political payments, is a reminder that online tactics to circumvent internal platform policies and the EU’s nascent Digital Services Act are continually evolving.

Much coverage of these extraordinary events in Romania have included reference to foreign influence by Russia. While Russia has a long history of influencing and interfering in elections across the region going well beyond manipulating online spaces, this analysis is limited to verifiable dimensions on the online campaign that promoted Georgescu. Further and different analysis is required to accurately assess Russian influence in Romanian elections.

Calin Georgescu presents himself as an anti-establishment candidate, despite his previous career as a senior government official.  He appealed to “Christians,” “patriots,” and “sovereigntists” with his ultra-nationalist rhetoric.  Georgescu’s political message tapped into widespread fears of globalization and the loss of national sovereignty. He positioned himself as a defender of Romania’s cultural and spiritual identity. These narratives overlap with similar anti-establishment candidates that have similarly used such messaging to garner electoral victories across Europe in 2024.

The rapid rise of Georgescu, during the presidential campaign in November, sparked suspicions of potential interference by foreign state actors in Romania’s presidential elections. The scale and coordination of his campaign, coupled with its sudden surge in visibility, led to growing suspicions of external involvement aimed at influencing the outcome. To date, no ties to Russian-affiliated groups have been found, and Georgescu denies any affiliation with Moscow.

In the aftermath of the first round of voting, outgoing President Klaus Iohannis convened the National Security Council to address the potential risks of foreign interference. This high-level meeting highlighted the gravity of the situation and underscored the broader implications for national security and the integrity of Romania’s democratic processes.

Days later, President Iohannis declassified intelligence documents from the country’s security services. These documents reportedly contained critical information about Georgescu’s campaign, including allegations that a separate Romania national, based in South Africa, spent roughly 1 million euros on a TikTok-based political ad campaign to boost Georgescu, and that 85,000 cyberattacks – most likely supported by a foreign government – targeted the country’s election infrastructure. Romania’s intelligence agencies did not provide concrete evidence for these allegations. The disclosure of these documents marked a pivotal moment. It led the Constitutional Court of Romania to annul the presidential elections—an unprecedented event in the country’s history since its return to democracy after the end of the Cold War.

Telegram played a key role in coordinating Georgescu’s presidential campaign. His campaign leveraged a highly coordinated network of thousands of so-called “volunteers” operating through Telegram channels and groups. At the center of this operation was the channel “Propagator -Implică-te și tu, Renașterea României, Harnă Apă Energie, Călin Georgescu” (“Propagator – Get Involved, The Renaissance of Romania, Food Water Energy, Calin Georgescu”). The Propagator channel, which deleted its previous content on December 6, functioned as a command hub to provided content and instructions to participants. It distributed pre-edited materials, such as video clips from Georgescu’s public appearances, formatted and ready for immediate sharing on platforms like TikTok. Before channel owners erased its content, the DFRLab was able to archive much of the material offline.

The Propagator Telegram channel first appeared on June 15, 2024, five months before the first round of the presidential elections. It quickly claimed that Romanian Public Television had censored Georgescu. To counter this alleged censorship, the channel encouraged followers to use their “creativity” to spread Georgescu’s message across social media platforms such as Facebook, Instagram, TikTok, and YouTube. This early mobilization laid the groundwork for cross-platform coordination and amplification that would prove pivotal during the first round of the presidential election.

Subscribers received detailed, step-by-step instructions on how to download videos from the channel, customize these videos with titles, and share them across other social media. Additionally, the channel urged its “volunteers” to invite other Georgescu supporters to subscribe, further expanding the campaign’s digital reach and network of activists. At its peak, the channel had almost 8,000 subscribers.

In total, Propagator shared more than 1,800 photos and videos w with members for distribution across other social media platforms. To prevent platform algorithms from flagging content as spam or repetitive, group moderators repeatedly emphasized the importance of users editing or personalizing the materials before posting. This personalization created the illusion of unique, original content, significantly increasing the likelihood of bypassing algorithmic filters. It also allowed the seemingly organic but coordinated content to flood TikTok and influence the platform’s recommender systems to independently amplify pro-Georgescu material.

Channel moderators also published a video tutorial showing members how to use tools like CapCut and Filmora to edit clips effectively. Social media platforms tend to favor content edited within their ecosystems, rewarding it with greater visibility and a higher likelihood of appearing on feeds like TikTok’s For You Page. Propagator capitalized on this platform preference by emphasizing user-generated variations of the materials to ensure broader reach and sustained engagement. The personalization of videos also helped avoid detection and ensured the coordination continued without facing account bans or content suppression.

The Propagator channel was the tip of the iceberg in Călin Georgescu’s vast network of interconnected Telegram groups. On July 20, the channel published a list of 41 separate Telegram groups for each of Romania’s counties. These channels bore the title of Georgescu’s so-called “national project,” named “Water, Food, Energy,” followed by the county name. It instructed members to also subscribe to the group corresponding to their county of residence. This created a localized structure to organize and mobilize supporters at a regional level ahead of the presidential election

The DFRLab discovered references to regional Telegram groups on Georgescu’s Linktree profile, which he actively promoted across his social media accounts on Facebook, Instagram, TikTok, and YouTube. This cross-platform integration amplified the reach of his campaign and facilitated easier access for supporters to join the localized groups that would be used effectively to promote cross-platform coordinated messages during the electoral campaign.

At the time we began our investigation in late November 2024, attempts to access the links to each regional Telegram channel returned the error message, “The invite link is invalid or has expired.” This suggests the groups may have been deleted, restricted, or otherwise rendered inaccessible to outsiders.

The Propagator channel aimed to foster a sense of community. Its operators frequently addressed followers as “Darlings” and created the impression that supporters were part of something significant and meaningful.

Posts often included calls to action, urging supporters to actively promote the campaign by creating and sharing edited video clips featuring effects, music, and descriptions across major social media platforms. One post emphasized the ease of participation. “It doesn’t take more than 30 minutes a day to make two posts and share them on 3-4 networks—TikTok, Instagram, Facebook, Twitter,” it stated. “Call on others to get involved and share the link; every promotional action helps us all.”

On August 20, Propagator shared a collection of old portraits of Georgescu for supporters to disseminate and promised new, exclusive graphics for group members. The following day, it published a 47-second video of Georgescu, titled “Message for Members,” which strongly suggested direct coordination between Georgescu and the channel.

On August 22, the channel informed followers of an impending announcement described as “the most important message.” Over the next few days, it built anticipation with countdown posts that emphasized the cross-platform nature of Georgescu’s campaign, including one on August 25 stating, “One day left. Romanians will know the truth! Be active on Mr. Georgescu’s official FACEBOOK account. The announcement that will shake up the political scene is coming tomorrow.” This was followed by another cryptic message on August 30: “The political class will be shaken very soon. You will be the first to receive the information at the right moment.”

On September 1, the channel delivered its big “announcement.” Georgescu had officially declared his candidacy for the presidential elections. In another video, he appealed to national pride, quoted scripture, and framed his campaign as a divine mission. He also launched an initiative to collect the 200,000 signatures required for his official registration, further mobilizing his online and offline supporters.

On September 7, Propagator released new photos of Georgescu as campaign materials for supporters to customize and disseminate across social media. Once again, the channel author emphasized the exclusivity of the images, while reinforcing the narrative of divine purpose and collective mission: “Attention! These images were sent exclusively to the members of this group. Purpose: spread them on all social networks, add audio featuring any topic addressed by Mr. Georgescu. Be creative, be brave! God is with us.”

Georgescu’s parallel TikTok campaign was particularly impactful.  A DFRLab search conducted on December 6 revealed Georgescu’s TikTok account had amassed 6 million likes and 541,800 followers. An analysis conducted using Exolyt’s TikTok analytics and social intelligence tool showed that prior to November 1, Georgescu’s account garnered minimal activity and engagement. Once November began, though, the account experienced a near-instant engagement surge that was driven at least in part by the Telegram channels encouraging it.

Supporters of Georgescu, including many active within the affiliated Telegram channels, sought to exploit TikTok’s algorithms to amplify his visibility by coordinating repetitive comments and boosting engagement on unrelated posts, including those from rival candidates and major media outlets. Videos referencing Georgescu garnered millions of views, illustrating the apparent effectiveness of this strategy. Previous research earlier this year by POLITICO and Northeastern University into TikTok’s recommender systems – complex content algorithms used to display posts in people’s feeds – demonstrated that the company’s internal systems actively over-promote similar content that is already trending on the platform.

By flooding TikTok with pro-Georgescu messages, his supporters were able to tilt TikTok’s algorithms to over-index on promoting Georgescu-linked content to the platform’s Romanian users. The approach undeniably boosted engagement; the more difficult question is whether the substantial increase in pro-Georgescu content on TikTok was artificial or authentic. In the redacted documents published by Romania’s intelligence agencies, TikTok reportedly confirmed to Romanian officials that they failed to detect a paid-for campaign of pro-Georgescu influencers on the platform. Officially, Georgescu has stated that he did not spend money on TikTok promotion.  

A December 2024 investigation by Recorder.ro, a local media outlet, demonstrated TikTok’s vulnerability to algorithm manipulation. Romanian entrepreneur Levi Elekes created a fictional political character, then used coding techniques to artificially boost a video’s reach to one million views in one hour. He also generated fake comments and likes that exploited TikTok’s algorithms to recommend the fictitious character in its search bar.

The Recorder.ro experiment showed how TikTok’s algorithm, designed to surface trending content, can be strategically exploited through coordinated actions to generate momentum around specific topics or figures. These efforts go beyond merely creating content. The aim is to create the appearance of organic interest through systematic engagement that can then lead to similar content trending across the platform.

Systematic and coordinated likes, comments, and shares created a surge of activity that caught the algorithm’s attention. As engagement grew, TikTok’s algorithm treated the content as organically popular. That created a self-reinforcing feedback loop where increased visibility drove further engagement and broader distribution, effectively turning the platform into an unwitting amplifier of the coordinated campaign.

The DFRLab analyzed the engagement history of several randomly selected videos posted to Georgescu’s TikTok account in October and November, researching metrics that included views, likes, comments, shares, and follower growth. We observed an almost mechanical precision in some metrics during October and November, which strongly suggests the possibility of algorithmic exploitation. Organic engagement typically fluctuates based on user behavior and content appeal. However, we observed repeated, steady bursts of engagement during this period, suggesting possible manipulation.

The examined TikTok videos showed similar pulsing patterns of engagement, particularly in WhatsApp shares (green) and favorited videos (pink), often occurring at similar time intervals. These indicators suggest the possible employment of automated systems rather than organic human engagement to amplify pro-Georgescu content across social media.

Individual videos showed steady but cyclical engagement, disproportionate activity in some metrics, and a lack of organic growth patterns. For example, some videos exhibited consistent increases in likes without a corresponding increase in views. This discrepancy further raises the possibility of algorithmic exploitation through automated means, similar to the tactic demonstrated by Recorder.ro, which trigged artificial likes and published automated comments to make the video appear more popular than it genuinely was. The use of automated systems to manipulate the perceived popularity of content that would run counter to TikTok’s terms of service, which prohibit such activity.

Hashtag boosting was another key tactic in Georgescu’s TikTok campaign. Posts featuring certain hashtags gained significant traction through coordinated efforts to comment, share, and engage. That increased the likelihood of Georgescu’s content appearing in TikTok users’ feeds and search suggestions—even on unrelated posts by competing candidates or media outlets.

According to our analysis, the twelve most popular hashtags promoted by Georgescu’s campaign amassed a total of 1.4 billion views on TikTok. The most prominent hashtag, #calingeorgescu, appeared in 51,700 videos, generating 783.7 million views.

For comparison, Romania’s population is 19 million people.

Pro-Georgescu comments also appeared on TikTok videos unrelated to him, such as content from other candidates, celebrities, or news channels, according to our analysis. This tactic furthered efforts to ensure Georgescu’s name was frequently recommended in TikTok’s search bar as a trending topic. It created the illusion of widespread support, artificially inflating his presence on the platform.

The combination of Telegram and TikTok proved to be very successful for the campaign, but it utilized other platforms as well. On September 7, a Telegram post asked followers to invite their friends to follow and like Georgescu’s Facebook page. It provided a tutorial to guide user through the process and appeals to their sense of community and shared purpose in supporting the campaign. “Hello, dear friends! I want to show you a simple and effective way to invite your friends to follow and like Călin Georgescu’s page,” the Telegram post read. “It’s a small gesture, but one that can make a big difference! I have prepared a short video tutorial for you where I show you exactly how to send invites to those who are not yet followers of the page. It’s very easy, and every step counts to support this community! I warmly invite you to watch the video and invite as many friends as possible to join! Thank you for your continued support and for being a part of this community!”

Screenshot of a Telegram post by Propagator explaining how to invite friends to follow Georgescu’s Facebook page. (Source: Implică-te și tu, Renașterea României)

But the interplay between Telegram and TikTok remained central to his campaign’s online engagement strategy. For example, on September 17, the Telegram channel shared a link to a TikTok video featuring an audio clip of Georgescu, then asked followers to distribute it. The video was posted by TikTok user Cristina Preda (@cripreda) and used an audio file originally uploaded by the TikTok account @numenou11.

At the time of the investigation, the @numenou11 TikTok account no longer had any public-facing videos, yet maintained more than 15,000 followers. Our analysis revealed that the account was highly active in September and October 2024, however. During this period, @numenou11 uploaded ninety-five videos, averaging approximately three videos per day. These videos followed a structured pattern. Each featured clips of Georgescu delivering key messages from various public appearances, paired with uniform cover images, campaign hashtags, and carefully crafted captions. The account’s content focused exclusively on political messaging to promote Georgescu’s campaign.

The @numenou11 TikTok account achieved remarkable engagement and reach over a period of two months. Between August 6 and October 8, 2024, it amassed nearly 2.2 million views, as well as more than 237,100 likes, 11,100 comments, and 22,800 shares. This raises reasonable suspicions about potential manipulation of engagement metrics. Notably, the first video featuring Georgescu appeared on August 6, 2024, one month before Georgescu announced his candidacy.

Engagement data reveals a pattern that suggests artificial manipulation that likely involves a combination of automated bot activity and coordinated amplification efforts. From August to September, the account displayed an unusually regular pattern of interactions, with downloads, shares, and other metrics following a near-mechanical consistency. Such precision is highly atypical for organic social media engagement, which tends to be more sporadic and varied.

Another telling indication came in late September when the account experienced a dramatic spike in engagement across all metrics, particularly WhatsApp shares. Unlike genuine viral content, which usually grows incrementally with fluctuating levels of interaction, this sudden increase suggests amplification through automated means.

The strategy of the pro-Georgescu Telegram channel establishing regional Telegram groups closely mirrors the tactics employed by pro-Russian actors during Moldova’s recent elections. During the October presidential campaign, Moldovan authorities uncovered and blocked over 95 regional chatbots on Telegram named after Moldovan counties. These chatbots, associated with the pro-Kremlin network of Ilan Shor, played a central role in disseminating content, managing communications, and mobilizing local supporters, not unlike the Propagator channel in collaboration with Georgescu’s county-based groups in Romania.

In both instances, by creating localized groups, these campaigns ensured that content and messaging could be tailored to specific regional concerns in ways that enhanced its resonance and increased the likelihood of organic engagement. This approach not only amplified their reach, but also ensured a steady stream of dynamic, personalized content that platforms were more likely to favor algorithmically. In doing so, they created the illusion of a purely grassroots movement while maintaining tight control over messaging and strategy. In both instances, Telegram was the primary hub for distributing instructions, materials, and updates.

Victoria Olari, “Rise of unknown Romanian presidential candidate preceded by Telegram and TikTok engagement spikes,” Digital Forensic Research Lab, December 12, 2024, https://dfrlab.org/2024/12/12/romania-candidate-telegram-tiktok/.