Banner: Moldova President Maia Sandu, who is routinely targeted for her pro-Europe policies. (Source: Imago Images via Reuters Connect)

In an increasingly digital battlefield, Moldova has found itself at the center of an orchestrated influence operation seeking to manipulate public discourse, discredit pro-European leadership, and amplify opposition figures. Over the course of several months, a sprawling network of fake Facebook accounts flooded social media with thousands of coordinated comments, linking back to a Telegram channel that served as the nerve center of the campaign.

A DFRLab investigation uncovered the scale and structure of this operation, revealing a highly organized, well-resourced disinformation campaign operating across Moldova’s online ecosystem. By leveraging inauthentic accounts, automation, and aggressive messaging strategies, the operation sought to erode trust in democratic institutions, amplify opposition figures, and stoke anti-European sentiment.

The investigation began after we identified an unusual pattern of identical comments appearing across Moldovan Facebook pages. A deeper dive into these interactions led to the discovery of a Telegram channel called ZAPRESCHENNYY KANAL (ЗАПРЕЩЕННЫЙ КАНАЛ, or “Forbidden Channel”), which had been created on October 13, 2024. This channel appears to function as the central hub for a broader influence operation spanning multiple platforms. The name Forbidden Channel appears intended to convey that its content consisted of hidden truths allegedly being suppressed by the Moldovan authorities.

Using the platform analysis tool Osavul, our technical analysis revealed:

A detailed analysis of the network’s activity revealed multiple indicators of inauthentic behavior. Many of the accounts bore names that did not align with common Moldovan naming conventions. Instead, they used Western or Latin American-sounding names, such as “Toni Ozminkowski” and “Alisa Diaz Sanchez.” Other accounts mimicked authentic Romanian names but were written in Cyrillic instead of Latin script. Additionally, a number of Telegram-based accounts used seemingly random alphanumeric strings as names, such as fa1ezltj4mvupqp and ge63ay8p6rfpvvr. Notably, many of these alphanumeric accounts followed consistent prefix patterns (“fa-“, “ge-“, “sp-“), suggesting they were created in bulk using automated tools. These naming anomalies indicate that the accounts were either automated bots or mass-generated fake profiles designed to execute coordinated influence operations.

Another likely indicator of inauthenticity is that Telegram accounts with alphanumeric strings often included bios written in Arabic, containing religious invocations. These bios typically feature phrases praying for blessings, relief, and divine assistance, such as “O Allah, grant me a life in Your pleasure and a death with a good ending,” or “O Allah, grant me a relief so astonishing that the heavens and the earth marvel at it.”

Beyond their peculiar naming conventions, these accounts displayed an extreme level of activity inconsistent with ordinary users. One Telegram account, Рудик Нефнев (“Rudik Nefnev”), posted 989 comments, averaging nearly 99 comments per day. Another account, ge63ay8p6rfpvvr, posted 192 times per day, while fa1ezltj4mvupqp averaged more than 105 comments per day, highlighting the unusually active nature of the network.

While Facebook served as the primary battleground for public engagement, the ZAPRESCHENNYY KANAL Telegram channel functioned as the campaign’s central content hub. All 15,284 comments posted by the network contain URLs pointing directly to this channel, underscoring its role as the primary dissemination point.

Even though 96% of the accounts operated on Facebook, their comments accounted for only 40 percent of the campaign’s activity – a total of 6,095 comments. This could be explained by Facebook content monitoring policies, which likely resulted in a higher detection rate of inauthentic accounts than on Telegram. Moreover, most Facebook accounts posted only a single comment each, and as of March 17, 2025, had either been deleted or deplatformed by Meta.

Meanwhile, despite making up less than four percent of the network, Telegram accounts were responsible for 60 percent of the campaign’s activity (9,189 comments), suggesting that Telegram played a dominant role in content distribution and audience mobilization.

The most frequently targeted Telegram channels included:

This pattern highlights the campaign’s reach and its strategic focus on specific Telegram communities frequented by Russian speakers and Gagauzians.

Many accounts showed suspicious activity patterns. For instance, account “Йемен Пркофьев” (“Yemen Prkofiev”) published 141 posts on December 6, 2024 then went dormant. That same day, the account “sp6zulihv5gidzt” made 134 posts, then also went dormant. Meanwhile, “trigsmontrachet” uploaded 135 posts during a 24-hour period overlapping January 16-17, 2025 before going silent.

At the heart of the campaign is a series of consistent narratives aimed at shaping public opinion. The primary target of these efforts is Moldova President Maia Sandu and her pro-European government. Posts framed Sandu as corrupt, incompetent, and controlled by foreign interests. Many of the comments accused her of “selling out Moldova to the West” or suggested that her policies were driving economic hardship.

Alongside the anti-Sandu rhetoric, the campaign also attacked Moldova’s European integration efforts, portraying the European Union as a malevolent force that sought to erode the country’s sovereignty. At the same time, the campaign sought to boost convicted pro-Kremlin politician Ilan Shor, portraying him as a popular figure who stood against corruption and fought for the interests of ordinary Moldovans.

Through narrative analysis, DFRLab identified extensive content duplication across the network. For instance, we identified twelve distinct message templates that were each reused across multiple platforms. The most frequently recycled message, “Dragi concetățeni, vă îndemn să o opriți pe Maia Sandu. Ea este un dușman al țării noastre” (“Dear fellow citizens, I urge you to stop Maia Sandu. She is an enemy of our country”), appeared verbatim 95 times across five different sources. A text claiming electoral fraud in Russian, “Стало известно о том, что ЦИК сфальсифицировал результаты референдума у 40 000 граждан Молдовы. Кто ответит за этот беспредел? (“It has become known that the CEC falsified the referendum results for 40,000 Moldovan citizens. Who will be held accountable for this lawlessness?”) was posted 44 times. Most sets of verbatim messages followed a consistent formula: an inflammatory claim about the Sandu government, followed by a link to the ZAPRESCHENNYY KANAL Telegram channel, often with standardized hashtags like #stopSANDU.  

The campaign also used tailored hashtags in English. These included:

Campaign content strategically targeted different Moldovan demographics with tailored messaging, exploiting Moldova’s vulnerabilities.

An economic grievance narrative exploited Moldova’s economic challenges to undermine support for the government. Example: “Пока Санду и ПАС продолжают разворовывать бюджет, заложенный на строительство дорог, Шор со своей командой строит новые объекты по всей стране.” (“While Sandu and PAS continue to plunder the budget allocated for road construction, Shor and his team are building new facilities throughout the country.”)

An electoral fraud narrative undermined trust in Moldova’s democratic institutions. Example: “Tot ce spune Sandu este o minciună! Referendumul a fost fraudat! Diaspora din est a fost lipsită de dreptul la vot!” (“Everything Sandu says is a lie! The referendum was rigged! The diaspora from the east was deprived of the right to vote!”)

An identity threat narrativeexploited linguistic and ethnic tensions. Example: “Санду восхваляет нацистский режим Гитлеровской Германии и загоняет наших детей на могилы румынских оккупантов.” (“Sandu praises the Nazi regime of Hitler’s Germany and drives our children to the graves of Romanian occupiers.)

An Ilan Shor rehabilitation narrative portrayed Shor positively despite his criminal conviction. Example: “Шор один из немногих политиков, который хоть что-то делает для нашего народа. Именно поэтому его запрещают.” (“Shor is one of the few politicians who at least does something for our people. That’s why he is banned.”)

Victoria Olari, “Cross-platform campaign sows anti-Europe division in Moldova,” Digital Forensic Research Lab (DFRLab), March 26, 2025, https://dfrlab.org/2025/03/26/cross-platform-campaign-sows-anti-europe-division-in-moldova/.