Banner: Ilan Shor. (Source: Shor Party)

A coordinated network of thirty-nine Telegram channels named after Moldova’s administrative regions has emerged as part of an influence campaign affiliated with Ilan Shor, a pro-Russian Moldovan politician previously linked to disinformation activities. Created in May 2024, these channels, which also target the autonomous areas of Transnistria and Gagauzia, have amassed over 17,000 subscribers. The channels display patterns of automation and synchronized messaging designed to manipulate Moldovan public opinion.

Evidence points to the use of artificial intelligence and automated tools in the creation and management of this network, which is consistent with modern hybrid information warfare tactics. Our findings indicate that Russia is the probable point of origin for this coordinated influence operation.

All thirty-nine channels share distinctive characteristics that reveal their coordinated, centralized nature despite pretending to represent different Moldovan localities. Each channel operates automated chatbots programmed to simulate authentic local community engagement, posting daily greetings, local news items, and political commentary customized with regional names to create a false impression of organic local discourse. The profile pictures across these channels are generated by AI.

The content analyses revealed that the network employs a deliberate “soft engagement” strategy through its daily morning and evening greeting posts, which serve as a relationship-building tool rather than explicit propaganda. Each channel consistently posts familiar “Good morning” and “Good night” messages, typically accompanied by visually appealing images of cute animals, serene nature scenes, or local landmarks. In this way, it maintains regular posting schedules to keep the channels active in followers’ feeds and softens the overall tone of the channels, diluting the political messaging.

The network likely employed advanced language models to create and adapt content from Russian to Romanian, as evidenced by consistent linguistic patterns and systematic message variations across regional channels.

Analysis of the dataset reveals systematic translation errors that consistently appear across different regional channels. For example, multiple channels simultaneously distribute identical messages with the same distinctive errors. For example, a goodnight message shared in Russian and Romanian across multiple regional channels says “”Спокойной ночи, столица! Отличного начала рабочей недели! Пусть она будет продуктивной, интересной и принесёт вам много позитивных эмоций!” (Good night, [city name]. Have an excellent start to the work week! May it be productive, interesting, and bring you many positive emotions!️”. In Romanian the text begins with formal (“Sa aveti un inceput minunat”) then abruptly switches to informal (“Lasă-l să fie productiv… să-ți aducă”) and uses masculine pronouns (“Lasă-l”) for the feminine noun “săptămână” (week). These linguistic inconsistencies appear systematically across regional channels, where automated translations maintain semantic meaning while exhibiting identical grammatical errors, missing diacritical marks, and unnatural phrasing for native Romanian speaker. Particularly example is the formal construction “Fie ca” that directly mirrors Russian syntax “Пусть” when expressing wishes, rather than natural Romanian expressions like “Să aveți” or “Vă dorim.”

Another example likely represents a translation failure. In this case, the text after the divider remains entirely in Russian rather than being translated into Romanian, as is typically done in bilingual posts. The only modifications are minor wording changes—such as “бросился” replaced with “прыгнул” and “наркологического диспансера” abbreviated to “наркодиспансера”—but no actual Romanian translation was provided. This error was replicated across multiple regional channels, suggesting that an automated system likely failed to process the message correctly yet still distributed it through the network.

Through an extensive analysis of over 56,000 Telegram messages across thirty-nine channels, the DFRLab discovered a highly coordinated information distribution network. The forwarding patterns reveal a hierarchical structure where certain channels act as content originators while others serve as amplifiers. The channel Кишинев 🇲🇩 Chișinău ~ Arcul de Triumf (Chisinau 🇲🇩 Chisinau ~ Arch of Triumph) emerges as the primary source, with messages consistently forwarded exactly 38 times each–a level of precision that indicates orchestrated sharing rather than organic content spread.

A temporal analysis of posts showed that nearly 12,000 posts were synchronized to the seconds. This level of precision is highly unlikely to occur naturally, further supporting the notion that the network utilized automated scripts or AI tools. The temporal analysis revealed nuanced synchronization patterns, suggesting a centrally managed distribution network.

We collected 56,276 messages from the channels in our dataset and excluded non-text posts, leaving 41,967 remaining messages. Over 2,500 identical messages were posted across the channels (excluding short messages like “Good morning” or “Happy holidays”). The approach taken by the network focused on establishing credibility by sharing local news and posting updates on regional events, community activities, and entertainment, likely to create a sense of trustworthiness. The channels establish credibility by providing community updates and then pivot to sharing anti-government rhetoric. The network’s anti-government narratives cluster around several key themes. Corruption allegations feature prominently, with messages portraying President Maia Sandu’s anti-corruption initiatives as political theater. Alleged government incompetence forms another central narrative, with coordinated messaging highlighting economic failures, attributing rising prices and energy insecurity to the government’s Western orientation. The channels simultaneously promote pro-Russian alternatives, emphasizing historical ties between Moldova and Russia while positioning European integration as an economic and cultural threat to ordinary Moldovans. The duplication of content across the channels suggests coordinated message amplification.

The network actively promoted alternative political figures and amplified support for Ilan Shor and other pro-Russian figures, portraying them as the only viable alternative to the current government. It also disseminated Kremlin-aligned propaganda, spreading false claims about NATO’s presence in Moldova and the so-called threats of European integration. Nearly half of all analyzed messages (19,327) contained geopolitical content, presenting international relationships through a specific lens that challenges Moldova’s current pro-Western foreign policy orientation. These messages often connect local issues to broader geopolitical narratives.

Messages across the network consistently frame Moldova’s path toward EU integration as a serious threat to national sovereignty, with claims like “Referendumul va da Occidentului o parte din suveranitatea Moldovei” (The referendum will give the West a part of Moldova’s sovereignty) appearing repeatedly. This sovereignty narrative intertwines with portrayals of Moldova’s government as willing to sacrifice national interests to appease Western powers while rejecting beneficial relations with Russia. The channels systematically position Russia as Moldova’s natural historical, cultural, and economic ally that genuinely understands the country’s needs, while characterizing Western countries as exploitative partners pursuing their own agenda at Moldova’s expense. Economic messaging reinforces this narrative by attributing Moldova’s financial difficulties directly to its pro-Western orientation, suggesting that renewed Russian ties would deliver better economic conditions and reduced living costs. The geopolitical framing extends to electoral processes roccess, with channels promoting claims that Western countries—particularly EU members—systematically interfere in Moldova’s elections to ensure pro-European candidates succeed, while simultaneously dismissing or downplaying any concerns about Russian influence in the same electoral processes.

Russian-origin influence operation

Despite presenting as local Moldovan channels, the network operated in a coordinated manner with apparent centralized management and content creation. The analysis carried out on TGStat, a Telegram analytics platform, revealed that the network’s channels indicated Russia as their location, which contradicts their claims of being locally operated in Moldova. As noted, many posts appeared to be originally written in Russian and then machine-translated to Romanian.

Furthermore, the network coordinates the promotion of a website called “Salut,” which claims to expose “anti-national figures” in Moldova and portrays itself as advancing transparency and justice in the country’s political landscape.

The investigation identified identical promotional messages across multiple channels, describing the website as an “independent platform” operated by the “Salut” youth movement. These messages emphasized the website’s purported mission of protecting Moldova’s sovereignty while exposing individuals allegedly undermining the country. The platform claimed to maintain detailed dossiers on various public figures, including politicians, deputies, government officials, and judges, with a specific focus on President Sandu, Prime Minister Dorin Recean, and other government representatives.

A domain analysis for SalutMld.su revealed that the domain and its associated IP address are registered with a Moscow-based company, further contradicting claims of Moldovan origin.

Victoria Olari, “Telegram network seeks to manipulate Moldova’s local political discourse,” Digital Forensic Research Lab (DFRLab), March 6, 2025, https://dfrlab.org/2025/03/06/telegram-network-moldova/.