{
	"id": "24fb8870-10a9-4994-a317-268cad06137f",
	"created_at": "2026-04-06T00:10:01.78998Z",
	"updated_at": "2026-04-10T03:36:23.293852Z",
	"deleted_at": null,
	"sha1_hash": "c4e7449e9f4f36634eb07ecd100540a17eea566f",
	"title": "Russian Influence Assets Converge on Moldovan Elections",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 12309679,
	"plain_text": "Russian Influence Assets Converge on Moldovan Elections\r\nBy Insikt Group®\r\nArchived: 2026-04-05 16:52:38 UTC\r\nExecutive Summary\r\nAhead of Moldova’s September 28, 2025, parliamentary elections, Insikt Group is observing multiple active\r\nRussia-linked influence operations (IOs) seeking to destabilize the elections and derail Moldova's European Union\r\n(EU) accession. As of this writing, the IOs analyzed in this report are unlikely to have achieved any substantial\r\nsuccesses in shaping public opinion or guiding discourse around the upcoming elections.\r\nThe Russian IOs and corresponding networks analyzed in this report — Operation Overload, Operation Undercut,\r\nFoundation to Battle Injustice, Portal Kombat, and other Russian influence assets — are consistently projecting an\r\nunfavorable view of Moldovan President Maia Sandu and the ruling Party of Action and Solidarity (PAS) to\r\nalmost certainly manipulate international and domestic public perceptions by framing Moldova’s sitting leadership\r\nas corrupt and counter to Moldova’s interests. Additionally, these operations are portraying Moldova’s further\r\nintegration with the EU as disastrous for its economic future and sovereignty, and Moldova as a whole as at odds\r\nwith European standards and values. Further, the content being amplified by these IOs suggests that Moldova is\r\npolitically and economically more closely aligned with Russia than with the EU, and that a closer relationship\r\nwith the Kremlin is a more favorable alternative.\r\nSince at least April 2025, Operation Overload (Matryoshka, Storm-1679) has almost certainly engaged in a\r\nvilification campaign against President Sandu, while also projecting Moldova as incompatible with the rest of\r\nEurope. Likewise, the Foundation to Battle Injustice has also published multiple inauthentic investigations with\r\nthe key goal of damaging the credibility of President Sandu and PAS. During this timeframe, a Russia-linked IO\r\nwe track as Operation Undercut has actively dedicated much of its resources to an anti-Sandu, anti-PAS, anti-European integration effort targeting Moldovan social media users, including activity we attribute to Operation\r\nUndercut on TikTok for the first time. This report also highlights recently reported covert Facebook pages\r\nassociated with Moldovan oligarch Ilan Shor’s “Evrazia” organization, as well as the Shor-linked television\r\nnetwork actively attempting to grow influence in the country, Moldova24. Finally, our research examines ongoing\r\nactivities from Pravda Moldova, a pro-Russian media aggregator hyper-focused on Moldovan political affairs and\r\npart of the Portal Kombat ecosystem that was recently identified as engaging in poisoning the output of artificial\r\nintelligence chatbots.\r\nAs the September 2025 parliamentary elections approach, Insikt Group assesses that Russia-linked IOs, including\r\nboth the well-documented networks discussed in this report and any newly emerging ones, will very likely scale\r\nup in volume. Despite limited evidence that these operations have meaningfully influenced voter behavior, they\r\nstill pose broader risks to media integrity and public trust. Narratives undermining election security or integrity\r\ncould reduce voter turnout, while media engagement with inauthentic content — rather than exposing the tactics\r\nbehind it — may amplify malign messaging. To mitigate these risks, we recommend monitoring the sources\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 1 of 32\n\nidentified in this report using the Recorded Future Intelligence Operations Platform to inform public messaging,\r\nbolstering election-related cyber defenses, and continuing to proactively expose malign IOs to reduce their\r\npotential impact.\r\nKey Findings\r\nMultiple Russia-linked IOs are actively attempting to destabilize Moldova’s September 2025 parliamentary\r\nelections and degrade public confidence in the current pro-Western Moldovan leadership.\r\nOperation Overload and the Russia-based non-governmental organization (NGO) Foundation to Battle\r\nInjustice are almost certainly engaging in separate campaigns to negatively shape international opinion\r\ntoward Moldova’s European integration aspirations and to decrease public support of Moldovan President\r\nMaia Sandu.\r\nOperation Undercut is very likely attempting to condition Moldovan audiences to expect rigged elections\r\nin favor of PAS, exploit pre-existing fears of a conventional war with Russia, and amplify economic\r\nconcerns for voters.\r\nIOs associated with Ilan Shor’s Evrazia organization and Moldova24, a very likely Shor-sponsored Russia-state-backed television network, are disseminating anti-Sandu messages targeting Moldovan audiences\r\nthrough social media advertising on Meta.\r\nThe very likely sole function of Pravda Moldova’s website is to serve as a high-volume amplifier and\r\nlaunderer of pro-Kremlin media content to Moldova’s Romanian-speaking population as part of Portal\r\nKombat’s ecosystem.\r\nBackground\r\nMoldova’s September 2025 parliamentary elections are expected to decisively influence the country’s long-term\r\nfuture, especially the continued trajectory toward EU integration by its 2030 target date. This strategic direction\r\nwas affirmed in late 2024, when Moldovan voters narrowly approved a constitutional referendum endorsing EU\r\nmembership. This referendum coincided with the reelection of incumbent President Sandu, who secured\r\napproximately 55% of the vote. However, the 2024 election was subject to substantial attempted Russian\r\ninterference, including systematic vote-buying, covert financial support for pro-Russian candidates, malign IOs,\r\nhybrid disruptions targeting electoral infrastructure, and physical interference via bomb threats aimed at diaspora\r\npolling stations. With the 2025 parliamentary elections effectively a “last-chance” to slow or entirely derail\r\nMoldova’s EU membership, Russian IOs and potential destabilization activities are likely to escalate.\r\nCovert IOs Seek to Bring Moldova Back into “Russian World”\r\nInsikt Group is actively tracking multiple Russia-linked IOs that target Russian- and Romanian-speaking\r\naudiences within Moldova, as well as broader international communities. These operations are almost certainly\r\ndesigned to delegitimize Moldova’s electoral integrity by promoting narratives alleging electoral fraud, inflaming\r\ntensions regarding diaspora voting, and discrediting the PAS. Additionally, the operations seek to weaken public\r\nsupport for Moldova's EU integration, exacerbate economic anxieties among Moldovan citizens, and exploit pre-existing ethnic and linguistic divisions.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 2 of 32\n\nCollectively, these influence activities very likely align with the Kremlin’s strategic objectives toward Moldova,\r\nspecifically advancing its post-Soviet reunification doctrine of Russkiy Mir (“Russian World”) and seeking to\r\ntransform Moldova into a \"second Belarus.\" While initially an effort to promote Russian culture and language\r\nabroad, Russkiy Mir has since evolved into an expansionist vision of uniting Russian-speaking populations in\r\nformer Soviet states regardless of internationally recognized territorial boundaries. As a former Soviet state and as\r\na result of its significant Russian-speaking minority, Moldova remains susceptible to targeted IOs. In recent years,\r\nRussian IOs targeting Moldova have included efforts to provoke separatist sentiments in the autonomous region of\r\nTransnistria and coordinated attempts ranging from social media influence to bribery tactics to influence the\r\noutcome of Moldova’s 2024 presidential elections. Meanwhile, Russia’s attempts at economic coercion, namely\r\nthrough the disruption of gas supplies, sought to pressure Moldova into favorable political concessions, including\r\nlikely attempts to slow its path toward European integration.\r\nOperation Overload and Foundation to Battle Injustice Vilify Maia Sandu\r\nRussia-linked IO Operation Overload (Matryoshka, Storm-1679) and the Russia-based “Foundation to Battle\r\nInjustice” (R-FBI, FBR) are almost certainly engaging in separate campaigns to shape negative opinion among\r\ninternational audiences toward Moldova’s European integration aspirations and to smear the reputation of\r\nMoldovan President Maia Sandu. Currently, Insikt Group assesses that both Operation Overload and R-FBI are\r\noperating in parallel ahead of the September 2025 parliamentary elections; however, we do not have evidence to\r\nsuggest that Operation Overload or R-FBI are coordinating their efforts. Further, we have not observed attempts\r\nfrom either network to cross-amplify content.\r\nOperation Overload\r\nOperation Overload is a Russia-linked IO consisting of inauthentic news and fake fact-checking content that\r\nimpersonates legitimate news sources. First documented by CheckFirst and Reset.Tech in June 2024, Operation\r\nOverload’s primary objective is to overwhelm journalists, researchers, and fact-checking organizations with non-credible leads distributed through persistent, spam-like story verification requests. As evidenced in Bellingcat\r\nfounder Eliot Higgins’s recent post of Operation Overload-administered email accounts sharing falsified\r\n“egregious news” from Moldova to his inbox (Figure 1), journalists, researchers, and fact-checking organizations\r\nalmost certainly remain a priority target audience for the operation. Insikt Group coverage of the operation ahead\r\nof the 2024 United States (US) election assessed that Operation Overload also sought to directly influence the\r\ngeneral public, both through the inadvertent laundering of its claims through trusted media organizations that fact-check the operation’s content, and by directly injecting inauthentic media into the mainstream using Telegram and\r\nsocial media.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 3 of 32\n\nFigure 1: Screenshot of a spam email sent to Bellingcat founder Eliot Higgins containing Operation Overload\r\nsocial media posts (Source: Bluesky)\r\nNarratives\r\nAutomated social media accounts engaging in coordinated inauthentic behavior (CIB) are almost certainly\r\npromoting Operation Overload content with a substantial emphasis on degrading the public reputation of President\r\nSandu and public perceptions of Moldova with regard to European compatibility and EU integration. Since at least\r\nApril 2025, inauthentic news and other media content we attribute to Operation Overload have almost certainly\r\nsought to damage President Sandu’s reputation. The operation regularly attempts to portray President Sandu as\r\ncorrupt, featuring videos containing fabricated headlines and falsified investigative research that makes claims\r\nsuch as, “$79 million has been found on the cryptocurrency wallets of Maia Sandu’s aides,” and “Maia Sandu’s\r\nalleged mistress has $24 million in assets … that were corruptly obtained by Sandu [per fake Bellingcat\r\nresearch].” A video impersonating German broadcaster Deutsche Welle that Insikt Group documented in April\r\n2025 falsely claimed that Veronica Dragalin, former head of Moldova’s Anti-Corruption Prosecutor’s Office, was\r\npreparing to distribute material implicating Sandu to “300 European media outlets.” Other inauthentic media\r\npieces we attribute to Operation Overload sought to drive a wedge between or create the appearance of a growing\r\npolitical rivalry between President Sandu and EU High Representative Kaja Kallas, suggesting that President\r\nSandu was seeking to take Kallas’s position.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 4 of 32\n\nFigures 2 and 3: Operation Overload videos posted to social media in April 2025, impersonating the BBC and\r\nDeutsche Welle (Source: Recorded Future)\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 5 of 32\n\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 6 of 32\n\nFigure 4: Operation Overload video impersonating Deutsche Welle, suggesting a potential political rift between\r\nKaja Kallas and Maia Sandu (Source: Social media)\r\nStarting July 8, 2025, Insikt Group observed a series of Operation Overload-produced deepfakes impersonating\r\nMoldovan government spokesperson Daniel Vodă, which are designed to appear as official government rebuttals\r\nof earlier “investigations” that the same network had fabricated. These deepfakes are almost certainly intended to\r\ncreate a closed-loop narrative undermining the Moldovan government while also attempting to lend false\r\ncredibility to Operation Overload’s initial inauthentic media pieces. These videos, which repurpose authentic press\r\nmaterial, add AI-generated audio, and weave in fabricated narratives, are very likely also intended to erode public\r\ntrust in the Moldovan government ahead of the September 2025 parliamentary elections.\r\nFigure 5: Operation Overload deepfake of Moldovan government spokesperson Daniel Vodă, published July 9,\r\n2025\r\n(Source: Social media and YouTube)\r\nBeyond videos, Operation Overload’s static influence content includes deceptively edited screenshots of social\r\nmedia posts, manipulated headlines of print media, and fabricated graphical imagery, such as photojournalist-https://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 7 of 32\n\ndocumented political graffiti in public spaces. For example:\r\nOne post impersonating the statistics portal Statistica presented a falsified graph depicting President\r\nSandu’s “plummeting approval rating” linked to increased TV appearances between January and April\r\n2025.\r\nA separate post featured an edited Vogue magazine cover, falsely claiming that President Sandu had the\r\nsixth-most expensive presidential wardrobe.\r\nAnother series of images, designed to appear as photojournalist posts for French media, depicted\r\nsuperimposed graffiti in public spaces showing President Sandu beneath a guillotine, in an electric chair,\r\nand with her head in a noose, with the date of June 1, 2025, beside each image. While the date appeared\r\narbitrary, it was very likely intended to manufacture public fear by implying the possibility of unrest, a\r\ncoup, or an assassination attempt against President Sandu.\r\nFigures 6 and 7: Left: Operation Overload impersonation of Statistica; Right: Russian Telegram channel\r\n@shkvarka2 shares two inauthentic graffiti in Chișinău showing President Sandu being executed via hanging\r\n(Source: Social media and Telegram [archive])\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 8 of 32\n\nFigures 8 and 9: (Left) An Operation Overload impersonation of French news magazine La Tribune dated June\r\n21, 2025; (Right) La Tribune’s legitimate June 21, 2025 front page (Source: Bluesky [archive, frontpages.com])\r\nBeyond character attacks on President Sandu, Operation Overload also attempts to portray Moldova as a central\r\nhub of European crime and diametrically opposed to Western values, very likely in an attempt to diminish its\r\nappeal to European audiences. For example, Operation Overload’s impersonations of Euronews and Agence\r\nFrance-Presse (AFP), shown in Figures 10–12, suggest that Moldova is “the largest hub for cybercriminals,” is\r\n“one of the largest logistics hubs for drug trafficking,” and is “the most homophobic country in Europe.” Similar\r\nnon-credible storylines impersonating Western media remain ongoing and will very likely persist throughout\r\nMoldova’s election period.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 9 of 32\n\nFigures 10, 11, and 12: Various Operation Overload impersonations of Euronews accusing Moldova of criminal\r\nand discriminatory activities (Source: Recorded Future)\r\nInfrastructure\r\nWe continue to observe Operation Overload-attributed media often appearing first in Russian Telegram channels,\r\nfollowed by CIB amplification exclusively on one social media platform, and attempted seeding on Bluesky.\r\nMainstream social media promotion included automated resharing, liking, and amplification through “quoted\r\nreplies” toward target groups (journalists, researchers, and fact-checkers), consistent with Operation Overload’s\r\ndissemination techniques throughout 2025. Beginning in late May 2025, we observed the network posting content\r\nto TikTok. The network’s social media accounts are often suspended; however, replacements soon take their place,\r\nnecessitating constant efforts to detect and report new accounts.\r\nInsikt Group considers the overwhelming majority of Operation Overload content promoted within the network to\r\nfall in the Brookings Breakout Scale’s Category 2, including nearly all of the content specific to Moldova. There\r\nare isolated instances, however, where Operation Overload media impersonations garnered Category 3\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 10 of 32\n\nconsideration, and some have even reached what we would assess as Category 5 (amplification through celebrities\r\nand other well-known public figures).\r\nThe success Operation Overload achieves in reaching its target audience very likely emanates from the\r\ncampaign’s secondary exposure from sources that debunk its non-credible stories versus organic reach from the\r\ninitial posts. The corrective reports inadvertently push the operation’s artefacts out of echo chambers and into\r\nmainstream media. Even though the coverage is “hostile” to Operation Overload, this coverage nonetheless\r\nconstitutes a Category 4, or cross-medium breakout, when analyzed via the Breakout Scale.\r\nFoundation to Battle Injustice (R-FBI)\r\nR-FBI is an ongoing Russia-based IO ostensibly dedicated to exposing alleged human rights violations and\r\ninjustices committed primarily by Western governments. R-FBI poses as an “independent non-profit organization”\r\nin support of addressing “human rights violations”; the organization, however, leverages non-credible, long-form\r\ninvestigative reporting to accuse prominent international opposition leaders, particularly during major election\r\ncycles, of serious criminal activities, including terrorism, electoral fraud, human trafficking, and sexual abuse of\r\nminors. These reports are then laundered through a network of pro-Russian influencers and websites previously\r\nidentified as promoting Kremlin propaganda, such as Jamie McIntyre’s Australian National Review (ANR,\r\naustraliannationalreview[.]com), the London Times (londontimes[.]live), and Veterans Today (VT,\r\nvtforeignpolicy[.]com).\r\nR-FBI was founded and initially financed in 2021 by deceased Russian oligarch Yevgeny Prigozhin, although\r\nmanagement of the organization has since been transferred to Oksana Vovk, known now as Mira Terada. Based on\r\nInsikt Group investigations, in addition to public reporting from researchers at Clemson University and\r\nVIGINUM, R-FBI is also closely involved with a separately tracked Russian IO we refer to as CopyCop (Storm-1516).\r\nNarratives\r\nBetween late May and mid-June 2025, R-FBI published two investigative articles accusing President Sandu of\r\nengaging in illicit activities and political corruption schemes (Figures 13 and 14, below). On May 31, 2025, VT\r\nrepublished an R-FBI article claiming President Sandu and “affiliated organizations” were trafficking Ukrainian\r\norphans, “under the pretext of medical treatment and adoption” into the “hands of pedophile networks and sexual\r\nslavery” across Europe. A separate article, republished by VT from R-FBI on June 19, 2025, claimed President\r\nSandu and political allies earned “at least $4.5 billion” via large-scale illicit schemes involving “drug trafficking,\r\nUkrainian weapons, and modern slavery.” Both articles were written by Brazilian R-FBI contributor Lucas Leiroz,\r\nalso tracked as an amplifier of CopyCop content. Leiroz has previously authored numerous articles featured in\r\nRussia state-sponsored media outlets, as well as in outlets previously assessed as associated with Russian\r\nintelligence, such as InfoBrics (BRICS Portal) and the Strategic Culture Foundation.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 11 of 32\n\nFigures 13 and 14: R-FBI investigative pieces republished in VT; these articles are later used as citations in\r\nsocial media (Source: VT [archive one, archive two])\r\nOn July 1, 2025, R-FBI published a third investigative article on Moldova, claiming President Sandu had signed a\r\n“secret decree” dated June 4, 2025, allowing law enforcement to “kill citizens without fear of punishment.” The\r\ndecree, according to R-FBI, was a deliberate decision to “suppress the expected mass protests in the fall of 2025,\r\ncaused by the economic crisis and expected accusations of election fraud.” R-FBI provided an alleged copy of the\r\ndecree (classified as Nr. 224-S-X), which Insikt Group found no record of on the official website of the President\r\nof Moldova. R-FBI attempted to mitigate this discrepancy by stating in its article that the document was obtained\r\nfrom anonymous sources in the president’s office. Additional scrutiny of the document image, particularly its off-center header and incorrectly aligned Article 2, leads Insikt Group to assess the document as very likely a forgery\r\nintended to damage President Sandu’s credibility and undermine the president’s anti-corruption platform.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 12 of 32\n\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 13 of 32\n\nFigure 15: A very likely forgery of a Moldovan presidential decree providing immunity to law enforcement for the\r\nuse of force against protestors and instances of civil unrest (Source: R-FBI [archive])\r\nInfrastructure\r\nLikely due to the result of social media platforms’ shadowbanning direct links to R-FBI’s website, fondfbr[.]ru, R-FBI is almost certainly using secondary sources through a network of intermediaries and influencers to launder its\r\ninvestigations, namely via VT, but also via websites associated with ANR. Insikt Group also located limited\r\nsecondary and tertiary amplification through the pro-Kremlin media publication EurAsia Daily (EADaily) and a\r\nfringe Swedish publication that sporadically re-publishes R-FBI investigative pieces called “Bakom Kulisserna”\r\n(“Behind the Scenes”).\r\nPro-Kremlin social media personalities who have previously amplified CopyCop content are almost certainly also\r\nthe leading amplifiers of R-FBI’s anti-Sandu articles, resulting in each claim receiving hundreds of thousands of\r\nsocial media views. In addition to Leiroz, these individuals included Chay Bowes, Raphael Machado, and social\r\nmedia personalities “Johnny Midnight”, “Peacemaker”, and “Sprinter Observer”. The extent of R-FBI article\r\namplification against President Sandu is a Category 3 on the Brookings Breakout Scale, consisting of multiple\r\nplatforms with multiple breakouts. Similar to Operation Overload, R-FBI has achieved isolated instances of\r\nCategory 4 amplification, given the numerous prior press coverage of R-FBI and its fabricated investigative\r\npieces.\r\nFigures 16 and 17: Screenshots of Chay Bowes and Johnny Midnight posts discussing R-FBI’s story republished\r\nin VT\r\n(Source: Social media)\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 14 of 32\n\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 15 of 32\n\nFigures 18 and 19: R-FBI articles republished to EADaily and Bakom Kulisserna (Source: archive one, archive\r\ntwo)\r\nOperation Undercut Targets Moldovan TikTok Users\r\nIn early June 2025, Insikt Group identified a series of TikTok accounts promoting anti-PAS, anti-Sandu content in\r\nRomanian, which we currently attribute to Operation Undercut. Over the course of this investigation, we\r\nidentified an additional network of approximately 70 active social media accounts (as of late June 2025) posting\r\nthis content in parallel to accounts on TikTok (Appendix A). We note that many of these accounts have since been\r\nsuspended; however, we continue to identify replacement accounts on a rolling basis.\r\nOperation Undercut is an IO almost certainly conducted by the Russian company Social Design Agency\r\n(Агентсво Социального Проектирования, or “SDA”) since at least December 2023. Historically, Operation\r\nUndercut has generated very little online engagement and very likely has achieved minimal impact on its target\r\naudiences. Previously, Insikt Group observed Operation Undercut primarily using inauthentic social media and\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 16 of 32\n\n9gag accounts likely operated by humans or simulating human activity, which includes posting during typical\r\nMoscow workday hours and halting activity during major Russian holidays.\r\nNarratives\r\nOperation Undercut is very likely attempting to condition domestic Moldovan audiences to expect rigged\r\nelections in favor of PAS, stoke fears of a potential conventional war with Russia, and provoke economic concerns\r\nby magnifying priority economic issues for voters, such as inflation, agricultural collapse, and child-welfare costs.\r\nThis network of Operation Undercut accounts consistently publishes content that is generally negative toward the\r\nPAS and President Sandu. Themes include framing Moldova’s EU aspirations as economically ruinous,\r\namplifying likely non-credible claims of alleged Moldovan political corruption, and predicting a future socio-political collapse should Moldova continue its current trajectory.\r\nInfrastructure\r\nInsikt Group identified at least four Operation Undercut TikTok accounts attempting to impersonate Moldovan\r\ncitizens or Romanian-speaking individuals in Eastern Europe. One account, “Bella Popescu”, claimed to be a\r\nphotographer and film editor. The second account, “dorinrobu5”, dedicated its account to “news,” “reviews,” and\r\n“relevant, fresh information.” The third account, “Gergely Dezir”, described itself as an account dedicated to\r\n“peace and politics.” A fourth account we assess as likely part of the network, “moldova457u”, began posting\r\nsimilar Operation Undercut-style AI-generated videos in late June 2025. Each of the TikTok videos we observed\r\nstated in their descriptions that the videos were constructed using CapCut, a video editing software popular with\r\nvideo creators and social media influencers. This network is also very likely using VEED’s “Gen-AI studio”\r\navatars, “Aisha”, “Elena”, and “Marcus”, to periodically narrate and lend credibility to Operation Undercut\r\ncontent.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 17 of 32\n\nFigure 20: Operation Undercut using Veed avatar “Elena” to narrate anti-Sandu, anti-PAS video on social media\r\n(Source: Social media)\r\nEach of the clips posted to TikTok contains hashtags very likely chosen to garner potential viewers interested in\r\nMoldova and Moldovan politics (#stirimoldova, #moldovaștiri, #UE), as well as generalized hashtags used to\r\nreach a broader audience, such as #TikTokNews, #Trump2020, and #gaza. The posts’ associated captions,\r\nhowever, reflect an anti-EU perspective and are consistent with pro-Russian messaging targeting domestic\r\naudiences that seeks to erode trust in Western institutions and sow disillusionment with European alignment.\r\nCompared to the curated TikTok accounts, the secondary network of social media accounts we identified on\r\nmainstream social media contained usernames incorporating Indian, Bangladeshi, and Sanskrit names and posted\r\ncontent in Romanian. Several of these accounts also held verified badges, indicating that their administrators had\r\npaid for premium features on the social media platform. After these accounts were suspended by the platform,\r\nreplacement accounts with Western names, still posting in Romanian, took their place in late June 2025. Based on\r\nrolling platform suspensions and the emergence of new accounts, Insikt Group assesses that the administrators of\r\nOperation Undercut will likely continue attempting to establish a persistent presence on social media.\r\nAlthough these accounts did not have a notable following, we observed the network persistently attempting to\r\nengage in hashtag hijacking to increase the visibility of its posts to wider audiences. To do so, Operation Undercut\r\nalmost certainly continues to engage in localized hashtag use to identify and hijack trending hashtags among\r\nRomanian-speaking audiences in Moldova, very likely using commercial off-the-shelf social media monitoring\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 18 of 32\n\ntools. While the accounts do regularly achieve more than 100 views per post, we have not observed any\r\nmeaningful engagement with broader audiences. However, viewership statistics of Operation Undercut activity on\r\nTikTok specifically indicate that the posts regularly receive thousands of views each; one post from Bella Popescu\r\ncalling on President Sandu to resign garnered more than 113,000 views.\r\nFigures 22 and 23: Sample Operation Undercut-operated social media accounts, now suspended (Source: Social\r\nmedia)\r\nAlthough the operation continues to fail in its attempts to significantly impact public opinion, it likely has\r\nimproved its online engagement since our prior investigation through its expanded social media use on TikTok.\r\nOperation Undercut activities are currently a Category 2 on the Brookings Breakout Scale, consisting of a\r\nmultiplatform operation with no recorded breakout beyond the network.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 19 of 32\n\nFacebook Pages Linked to Ilan Shor and “Evrazia”\r\nIn May 2025, Moldova-based think tank WatchDog.MD published a report highlighting 146\r\nanonymous Facebook Pages it determined to be affiliated with fugitive Moldovan oligarch Ilan Shor, and used to\r\npromote pro-Shor political advertisements, in addition to another 315 “stand-by” pages. In all, WatchDog.MD\r\nidentified this network as part of a larger network consisting of 2,167 auto-generated Facebook pages created to\r\n“influence political processes in the Republic of Moldova and other European states.” Many of these pages have\r\nrandomly generated names, incorporating photos later found to have been stolen from Eastern European dating\r\nwebsites. WatchDog.MD attributed this activity to Russia-based actors.\r\nNarratives\r\nWatchDog.MD’s preliminary investigation determined that networks of anonymously operated Facebook pages\r\nrunning commercial advertisements and likely connected to Shor presented themselves as media or news pages\r\nwith patriotic names similar to other Moldova-related pages Meta disclosed in October 2024, such as “Authentic\r\nMoldova”, “Today’s Chișinău”, “Гагаузия вперед” (“Gagauzia Forward”), “Moldova вперед” (“Moldova\r\nForward”), “My Dream Moldova”, “Orhei Today”, and others. Posts and paid ads praise Ilan Shor and Shor-managed organizations, such as “A New Life”, the “National Salvation Committee”, and the “Movement for the\r\nPeople”, while labelling PAS as corrupt or incompetent. WatchDog.MD indicated that between October 2022 and\r\nNovember 2024, Shor spent nearly 470,000 euros across over 1,400 Facebook advertisements, cautioning that the\r\n“actual amount may be even higher.”\r\nInfrastructure\r\nAutomated infrastructure very likely powers the entirety of the miscellaneous pro-Shor Facebook Pages.\r\nWatchDog.MD traced 2,167 Facebook pages built from randomly concatenated keyword strings (“Gourmet Gurus\r\nCrafty Creations Motivational Moments”, “Travel Junkies Business Builders Neighborhood News”, or\r\n“WealthWave Innovations”), with dozens of clones sharing the exact same title. Profile photos are likely\r\nmisappropriated from Eastern European dating and “cam sites,” and the same images frequently resurface across\r\nmultiple page aliases. Early iterations of the network were openly administered from the Philippines, Vietnam,\r\nTimor-Leste, and the United Arab Emirates (UAE), with ads paid in USD or Polish zloty, indicators which\r\nWatchDog.MD used to attribute the network as operating outside Moldovan jurisdiction.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 20 of 32\n\nFigure 24: Example placeholder “WealthWave Innovations” Facebook Pages; Insikt Group found that similar\r\npages were sponsoring advertisements for Ilan Shor-backed Evrazia’s “Discover Russia 2025” program (Source:\r\nFacebook)\r\nInsikt Group’s independent review found that in mid-May 2025, the majority of these Facebook Pages remained\r\ndormant, with little information from which to discern plans of potential future activity or planned purposes. We\r\ndid find, however, that several of the previously mentioned WealthWave Innovations-named pages were\r\nadvertising a “Discover Russia 2025” program, facilitated by the Shor-backed Russian NGO “Evrazia.” In\r\nOctober 2024, the Organized Crime and Corruption Reporting Project (OCCRP) concluded that Evrazia was\r\nbribing Moldovan citizens to vote against the EU referendum. In all, OCCRP stated that $15 million USD in\r\nillegally transferred funds from Evrazia was used to attempt to bribe 130,000 voters to vote against the\r\nreferendum, organized through Telegram. Shor reportedly argued he was engaging in legal activity, stating he was\r\npaying Moldovans “salaries” in return for their work in “explaining to people the advantages of the Eurasian\r\neconomic space.”\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 21 of 32\n\nFigure 25: Now-inactive Facebook ads from mid-May 2025 from “WealthWave Innovations” advertising Shor-backed “Evrazia” and its “Discover Russia 2025” program (Source: Facebook Ad Library).\r\nFigure 26: An “about us” page highlighting Evrazia’s “Discover Russia 2025” program\r\n(Source: Evrazia[.]su [archive])\r\nSince February 2025, Insikt Group has tracked the growth of Moldova24 (MD24), a Russia-based and likely\r\nKremlin-backed television network geared toward Russian-speaking individuals living in Moldova. MD24’s\r\nRussian connections and attempts to reshape opinion in Moldova were first detailed during the October 2024\r\nelection cycle when the Security and Intelligence Service of Moldova (SIS) ordered national internet service\r\nproviders (ISPs) to block two of MD24’s primary news domains, moldova24[.]online and\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 22 of 32\n\npwa[.]moldova24[.]online. Moldovan authorities later also blocked Telegram accounts belonging to Russian\r\noligarch Shor, which included Telegram accounts associated with MD24.\r\nFigure 27: Moldover24’s home page featuring a 24/7 livestream of the network (Source: MD24 [archive]).\r\nNarratives\r\nMD24 launched in September 2024 with the almost certain aim of influencing Moldovan public opinion among\r\nRussian speakers favorably toward pro-Russian policies and a closer diplomatic relationship with Moscow. MD24\r\nnews articles and its 24/7 broadcast platform, which are hosted on its core website, moldova-24[.]online,\r\nfrequently criticize Western policies, highlight Moldova’s economic difficulties, and question the West's motives\r\nin deepening its ties with Moldova. MD24 news coverage often includes biased reporting, emotional language,\r\nand selective coverage, and very likely seeks to promote skepticism toward Western institutions, particularly the\r\nEU and the US.\r\nAn emerging theme emanating from MD24, consistent with shared narratives from pro-Kremlin sources, is to\r\nundermine public confidence in Moldova's electoral process and the credibility of PAS specifically. MD24 has\r\npublished multiple articles promoting skepticism, distrust, and suspicion regarding Moldova’s voting procedures\r\nwith the diaspora vote, which accounted for one-fifth of the total vote during the October 2024 election and leans\r\nheavily toward Sandu. MD24 has amplified allegations of intended or planned electoral fraud among diaspora\r\nvoters, asserting a deliberate PAS strategy to artificially inflate votes from abroad. Simultaneously, MD24 claimed\r\nPAS was intentionally discriminating against or otherwise suppressing pro-Russia Moldovan voters, specifically\r\nthose residing in Russia and Transnistria. Domestically, MD24 published articles suggesting PAS was intimidating\r\nopposition figures and, with help from the EU, sought to bribe the electorate in order to win votes.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 23 of 32\n\nFigure 28: MD24 articles published in mid-June 2025 suggesting plans of voter fraud emanating from foreign\r\nballot stations\r\nin support of PAS (Source: MD24 [1, 2, 3]).\r\nInfrastructure and State-Sponsored Support\r\nInsikt Group assesses that Russia's state-sponsored media outlet RT has very likely supported the development of\r\nMD24 through covert means. This includes actively hosting its website and website mirrors through IP space that\r\nis not currently directly associated with RT or its parent organization, RIA Novosti, but is the same IP space that\r\nhosted RT content dating back more than five years, in addition to content created by RT personnel. Furthermore,\r\nit is likely that RT personnel supported the launch of MD24 and its ongoing operations through physical means,\r\nsuch as providing suitable studio space in Moscow, equipment, and possibly guidance on broadcast operations.\r\nMD24 is also likely under RT’s editorial influence, using minimal direct citations between the organizations to\r\nmaintain a veneer of independence despite clear ties to shared infrastructure.\r\nIn February 2025, Insikt Group provided Recorded Future customers with a Threat Actor Profile of MD24 and its\r\nconnections to Russian state media infrastructure, several months ahead of findings published by other research\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 24 of 32\n\ngroups. Independent public reporting from the Atlantic Council’s DFRLab in June 2025 corroborates our initial\r\nfindings of MD24 as largely supported by the Russian government and pro-Kremlin actors. According to Insikt\r\nGroup’s investigation, MD24 was available in more than a dozen domains initially hosted at the Russia-based IP\r\naddress 91[.]218[.]228[.]51, owned by AS210079, which is operated by Eurobyte LLC. This has since been\r\nupdated to a different Eurobyte-owned IP address, 95[.]181[.]226[.]185, as of July 2025.\r\nDomain Create Date\r\nmoldova24[.]space 2024-07-17\r\nmoldova24[.]press 2024-07-17\r\nmoldova-24[.]online 2024-07-17\r\nmoldova24[.]online 2024-07-17\r\nmoldova24[.]org 2024-07-17\r\nmoldova-24[.]live 2024-07-17\r\nmldvideo24[.]space 2024-09-11\r\nmldvideo24[.]tech 2024-09-11\r\nmldvideo24[.]site 2024-09-11\r\nmldvideo24[.]online 2024-09-11\r\nmldvideo24[.]pro 2024-09-11\r\nnewseday[.]site 2024-10-08\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 25 of 32\n\nDomain Create Date\r\npremiumlive[.]site 2024-10-08\r\nnlive-24[.]online 2024-10-08\r\nnlive24[.]ru 2024-10-08\r\nTable 1: MD24-associated domains (Source: Recorded Future)\r\n—\r\nRT is very likely to have covertly supported the administration of these domains, based on historical registration\r\ndata indicating shared infrastructure between MD24 and RT-affiliated websites. Most of these domains do not rely\r\non RT’s or typical affiliated DNS infrastructure (nsX[.]rttv[.]ru, nsX[.]sputniknews[.]ru, nsX[.]rian[.]ru), nor do\r\nthey display registration details linked to ANO TV-Novosti or Rossiya Segodnya, which are typically associated\r\nwith RT and its affiliates. Some of these websites include:\r\npoiskblizkih[.]com (an RT database to reconnect Donbas families impacted by Russia’s war against\r\nUkraine)\r\nputinspeaks-rt[.]com\r\nRTdoc[.]tv (a website for RT Documentary content launched in early June 2024, very likely to coincide\r\nwith the 2024 International Documentary Film Festival)\r\nktech[.]team — notably, ktech[.]team belongs to KTEX, an organization that advertises various IT\r\nsolutions, and its Taxpayer Personal Identification Number (INN), 9710109376, is registered to Sergei\r\nKukota, director of RT Balkan\r\nBeyond its network of websites, MD24 also maintains YouTube and TikTok accounts used to share its various\r\nnews segments.\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 26 of 32\n\nFigure 29: MD24’s active TikTok channel (Source: TikTok [archive])\r\nFigure 30: MD24’s most recent YouTube channel (Source: YouTube [archive])\r\nIn addition to the above, Insikt Group identified both active Facebook and Instagram accounts affiliated with\r\nMD24 that ran more than 210 Meta advertisements combined between mid- and late June 2025 (According to the\r\nAd Library, this number is approximately 440 total advertisements as of August 2025). Based on available data of\r\nmore than 300 advertisements, Insikt Group can estimate that as of August 2025, MD24 advertisements have\r\nreached at least six million impressions since June 2025 –– reflecting the number of times the ad was displayed on\r\na screen, which may include multiple views by the same person –– the majority of which were reportedly located\r\nin Chișinău, Gagauzia, and Transnistria, per Meta’s Ad Library. The majority average payment per advertisement\r\nreportedly was less than 100 euros.\r\nMD24’s Facebook account, used to sponsor political advertisements and post MD24 news content, launched\r\nMarch 29, 2025, initially under the name “Frumusețea Pământească SPO” (“Earthly Beauty SPO”) before\r\nupdating with the name “Moldova24” and MD24 graphics. Its associated Instagram account has the handle\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 27 of 32\n\n@alinanorman9, despite using MD24 graphics, and exclusively posts MD24 news segments. This account is\r\nlikely a disposable profile used entirely for hosting posts that will be used as ads on Instagram.\r\nFigure 31: MD24’s likely throwaway Instagram account used for Meta advertisements (Source: Instagram\r\n[archive])\r\nThe Instagram-specific ads included hashtags such as #moldova, #md24, and a number, which, based on\r\n@alinanorman9’s posts, indicates its position in a series of internally tracked numbered ads. The advertisements\r\non Facebook included captions such as “People support Hutsul,” “PAS is a gathering of impostors,” “Sandu\r\nhumiliated the children of Gagauzia,” and “Moldova will be better off without PAS.” Per Meta policy for political\r\nadvertising, the administrators were required to provide additional contact information; Insikt Group found that\r\nthey had used disposable contact information, including the email address\r\njasonrobertson1978[@]antimmail[.]com.\r\nPortal Kombat Presses On in Moldova\r\nPortal Kombat is a Russia-aligned influence network targeting international audiences with pro-Kremlin influence\r\ncontent, aggregated primarily through networks of websites, most notably its “Pravda” ecosystem of hyper-localized websites. Its flagship website in Moldova, md[.]news-pravda[.]com (Pravda MD) is a fully automated\r\nnews aggregator that systematically scrapes and republishes articles, posts, and official communications from a\r\ncurated list of pro-Kremlin sources ranging from Russian partially or wholly state-controlled media outlets, such\r\nas RT, Sputnik, Pravda[.]ru, TASS, and RIA Novosti. The network also republishes official press releases and\r\ncommunications from Russian government ministries, local administrations, and other state institutions, and\r\nregularly republishes commentary from pro-Russian Telegram sources and pro-Kremlin “bloggers.”\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 28 of 32\n\nFigure 34: Most frequently cited sources for over 151,000 articles published on Pravda MD, md[.]news-pravda[.]com\r\n(Source: Pravda Dashboard via CheckFirst)\r\nNarratives\r\nPravda MD very likely functions as a high-volume amplification node that launders Russian state media and other\r\npro-Kremlin narratives to Romanian-speaking audiences in Moldova. The website and broader Portal Kombat\r\nsources do not produce original reporting, but rather republish content plagiarized from the above-mentioned,\r\nRussia-aligned sources. The content from these sources consistently questions President Sandu’s credibility, anti-corruption measures, and PAS’s broader political platform. Likewise, these sources erode support for EU\r\nintegration and attempt to further drive social fragmentation while laying the groundwork to delegitimize\r\nMoldova’s September 2025 parliamentary elections should the Kremlin view the results as unfavorable.\r\nNotably, Pravda MD, in line with Russia’s broader objectives, very likely seeks to exploit Moldova's internal\r\nethnic and regional fault lines, particularly in the autonomous region of Gagauzia and the Russia-controlled\r\nbreakaway region of Transnistria. Insikt Group further assesses that the underlying goal is to fuel separatism,\r\nundermine the authority of the central government in Chișinău, and create internal crises that Russia can leverage\r\nin pursuit of drawing Gagauzia and Transnistria closer into Russia’s geopolitical orbit. Further, according to the\r\nEuropean Council on Foreign Relations (ECFR), citing a May 2025 interview with a high-ranking Moldovan\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 29 of 32\n\ngovernment official, Pravda MD and the Pravda ecosystem at large were assessed as being used as a tool in\r\nRussian attempts to engage in the “online penetration of the [Moldovan diaspora].”\r\nFigure 35: A July 2, 2025, Pravda MD article featuring Victory Bloc member Yuri Vitnyansky arguing that if\r\n“PAS wins the elections, Moldova will face a massive psychological fall and a new wave of migration” (Source:\r\nPravda MD [archive])\r\nFigure 36: A July 2, 2025, Pravda MD article originally published by Sputnik News Moldova, blaming PAS for\r\nMoldova’s “burdensome tax regime” (Source: Pravda MD [archive])\r\nInfrastructure\r\nThe European External Action Service (EEAS), in its third Report on Foreign Information Manipulation and\r\nInterference Threats, highlighted three Portal Kombat domains created to target both Russian and Romanian-speaking audiences in Moldova, md[.]news-pravda[.]com, moldova[.]news-pravda[.]com, and the now-defunct\r\npravda-md[.]com. The outlet also maintains a Telegram channel; however, the subscriber account currently only\r\nhas nineteen subscribers.\r\nDespite the volume of generated articles, Pravda MD’s viewership is likely low; Similarweb statistics indicated\r\nthat md[.]news-pravda[.]com only received 86 visits in April 2025. In comparison, its host page, news-https://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 30 of 32\n\npravda[.]com, received more than 365,500 website visits, with over 42% of its social media traffic originating\r\nfrom Reddit. It is possible that these page views are cumulative across all of Pravda’s localized webpages.\r\nWhile the results of Pravda’s website viewership are mixed, there are broader concerns about the volume of\r\ncontent created by the network potentially poisoning secondary sources, particularly large-language models\r\n(LLMs) with access to the internet. Joint research by DFRLab and CheckFirst found hyperlinks to Pravda-network\r\ndomains on Wikipedia rose sharply after February 24, 2022, reaching 1,907 links on 1,672 pages in 44 languages;\r\nspecific Moldova-related content at the time of the analysis was limited. The same study counted more than 3.7\r\nmillion Pravda articles on the open web. Analysis from The American Sunlight Project (ASP) categorizes this\r\ntechnique as “LLM grooming.” Without remediation, ASP argued, LLM grooming “poses a growing threat to the\r\nintegrity and reliability of the open internet.”\r\nAccording to Recorded Future data, we identified at least one occasion in which a Portal Kombat domain was\r\ncited as a source in a mainstream news report; however, due to numerous investigative pieces highlighting the\r\nPravda ecosystem, we therefore assess that Portal Kombat’s typical breakout scores no higher than a Category 4\r\non the Brookings Breakout Scale.\r\nMitigations\r\nCustomers can use the Recorded Future Intelligence Operations Platform to track each of the IOs discussed\r\nin this report, including Insikt Group coverage of these operations’ emerging narratives, tactics, techniques,\r\nand procedures, which is provided with access to the Recorded Future Geopolitical Intelligence module.\r\nTo minimize unintended amplification of IOs, media and research organizations should archive\r\ninfrastructure to preserve forensic evidence without boosting visibility and reach, and strip viral content of\r\nengagement-boosting elements, such as hyperlinks, hashtags, or other media.\r\nOrganizations deploying public-facing AI chatbots or other large-language models should integrate\r\nmultilayer content-filtering frameworks that block or flag inputs from domains linked to known IOs.\r\nImpersonated entities, particularly media organizations, should continue engaging with social media\r\ncompanies and domain registrars to seize or remove content impersonating their brand, or leverage services\r\nprovided by Recorded Future to request takedowns of brand impersonation attempts.\r\nOutlook\r\nAs the September 28, 2025, parliamentary elections approach, Insikt Group assesses that Russia-linked IOs,\r\nincluding both the well-documented networks discussed in this report and any newly emerging ones, will very\r\nlikely scale up in volume. Insikt Group assesses that these operations are likely less intended to secure a clear pro-Russian majority than to decrease voter turnout, particularly among the diaspora vote, fracture the pro-European\r\nbloc, and cast doubt on the legitimacy of the result should such a result be unfavorable to Russia’s foreign policy\r\nobjectives. International-facing IOs, coupled with coordinated intimidation of diaspora voters through polling\r\nplace bomb-threat hoaxes and narratives discrediting overseas voting — mirroring Moldova’s 2024 presidential\r\nelection — are very likely poised to suppress a constituency that historically tilts strongly toward PAS.\r\nIn conjunction with IOs, Moscow will very likely use other forms of Russian hybrid warfare aimed at coercing\r\nMoldovan voters, building off recent operations. Gazprom’s winter gas cut-offs, previous targeted cyberattacks\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 31 of 32\n\nagainst the Central Election Commission, a documented surge in Russia-attributed cyber intrusions against\r\nMoldova’s 2024 election cycle, and intelligence warnings of a manufactured crisis in Transnistria and Gagauzia\r\nall signal a readiness to amplify economic hardships and security anxiety in Moldova in the hope of tilting the\r\nbalance of the election in the Kremlin’s favor.\r\nCurrent polling still shows PAS leading by a margin large enough to form a governing bloc, and Chişinău has\r\ninvested heavily in cyber defense, energy diversification, and enhanced, robust policing. These resilience\r\nmeasures make a decisive electoral victory in favor of the Kremlin unlikely. Nevertheless, even in the wake of an\r\nelection result perceived by the Kremlin as unfavorable, Russia may pivot toward more overt destabilization\r\nactivities aligned with its broader Russkiy Mir objectives, such as inciting protest violence in Russian-speaking\r\nregions like Gagauzia and Transnistria, or exploiting regional instability to further consolidate territorial control\r\nconsistent with its post-Soviet reunification ambitions.\r\nAppendix A: Key Infrastructure Observed\r\nSource: https://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nhttps://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections\r\nPage 32 of 32",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"https://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections"
	],
	"report_names": [
		"russian-influence-assets-converge-on-moldovan-elections"
	],
	"threat_actors": [
		{
			"id": "f9806b99-e392-46f1-9c13-885e376b239f",
			"created_at": "2023-01-06T13:46:39.431871Z",
			"updated_at": "2026-04-10T02:00:03.325163Z",
			"deleted_at": null,
			"main_name": "Watchdog",
			"aliases": [
				"Thief Libra"
			],
			"source_name": "MISPGALAXY:Watchdog",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "29766ed4-2a41-49b1-b6f9-7b3a918db21f",
			"created_at": "2024-09-20T02:00:04.589212Z",
			"updated_at": "2026-04-10T02:00:03.702787Z",
			"deleted_at": null,
			"main_name": "Storm-1679",
			"aliases": [],
			"source_name": "MISPGALAXY:Storm-1679",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "8d4b4b62-c221-412d-bf8e-243cddc728cd",
			"created_at": "2026-02-04T02:00:03.7163Z",
			"updated_at": "2026-04-10T02:00:03.956172Z",
			"deleted_at": null,
			"main_name": "Storm-1516",
			"aliases": [
				"CopyCop"
			],
			"source_name": "MISPGALAXY:Storm-1516",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434201,
	"ts_updated_at": 1775792183,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c4e7449e9f4f36634eb07ecd100540a17eea566f.pdf",
		"text": "https://archive.orkl.eu/c4e7449e9f4f36634eb07ecd100540a17eea566f.txt",
		"img": "https://archive.orkl.eu/c4e7449e9f4f36634eb07ecd100540a17eea566f.jpg"
	}
}