By Andra-Lucia Martinescu (Principal Investigator) and Marius Dima (Cognitive AI & Data Architecture)
This article is part of the PROMPT series
We tend not to look back when electoral outcomes swing favourably, not for one political party, but for the integrity of democratic processes themselves, with their web of procedures, safeguards and, above all, legitimacy. Yet precisely such moments demand reflection, ideally from as many vantage points as disciplines.
Throughout this investigation, we kept returning to the same question: to what extent are democratic integrity and resilience facets of the same coin, particularly in fragile democracies? The balance is delicate, but the two are inseparable. Understanding the nuances in between, integrity safeguards democratic rules, while resilience allows societies and institutions to withstand multifaceted threats. However, if left unchecked, defensive measures pursued in the name of resilience (i.e. tightening information controls) risk undermining the very norms they seek to protect. Conversely, a rigid insistence on procedural aspects without the capacity to adapt may expose democracies to fast-moving, hybrid pressures that relentlessly target democratic legitimacy and public trust.
Analysing disinformation around Moldova’s parliamentary elections
This article builds on an in-depth analysis for the PROMPT EU Consortium, covering Moldova’s parliamentary elections from June 2025 to the September 28th vote. Beyond the digital forensics of hostile interference, our findings were constructed as a battle plan, not only tracing how influence operations unfolded in real time and across the different phases of the campaign but examining distinct clusters of behaviour that shaped the informational terrain. Temporal bursts of near-simultaneous, multilingual posts, often geolocated far beyond Moldova, revealed a centralised scheduling logic typical of coordinated disinformation. As expected, while much of the activity was linked to or originated in Russia, dissemination relied on transnational proxy networks, camouflaged to appear organic and resonate with diverse publics beyond traditional voting constituencies.
Narrative clusters around separatist Transnistria, diaspora voting, or economic austerity did not remain local. Rather, they synchronised Moldova’s electoral environment with information operations targeting Romania and Ukraine (amongst other localities), thereby converting domestic contestation into a regional pressure instrument. In doing so, hybrid influence circulates through shared digital and linguistic spaces within a borderless ecosystem where fault lines, social grievances, and algorithmic infrastructures converge. The infrastructures of public life (i.e.: social media platforms, diasporic networks, linguistic corridors) extend well beyond the jurisdiction of any single state. This means that while democratic legitimacy is built locally, its erosion can be orchestrated remotely, amplified by actors and algorithms that operate with deniability across a vast, digital terrain where borders hold little meaning.
Despite these pressures, there is room for optimism. Firstly, civic mobilisation has become more interconnected than ever, with positive spillovers across the region. Secondly, the diagnosis and analysis of informational threats are increasingly matched by the development of new technological capabilities that inform responses in real time. Collaborations within PROMPT and beyond enabled the deployment of at least four such instruments, ranging from in-depth semantic analysis, which helped us identify coordinated campaigns by matching the language used, to deep actor profiling and neural-symbolic networks that exposed amplification before it oversaturated the information space. Thirdly, interdisciplinarity allowed us to move beyond siloed conversations into a pragmatic exchange of ideas and good practices.
However, it is not just about exposing hostile operations seeking to undermine democracies from within, but also about actively engaging with invisible forces that possess state-level capabilities and deep funding to inflict destabilisation. For grassroots civic networks, this may seem overwhelming, ‘like a raindrop in the ocean,’ in the words of a volunteer. Sustaining morale and unity of scope in an informational war of attrition, designed to exhaust participation, remains a challenge. From the ethical confines that govern democratic societies, where transparency, due process, and the protection of rights and freedoms serve as checks and balances, responses may not mirror the ruthlessness and opacity of the enemies we face. We turn to insights from Moldova to identify the relevant TTPs (Techniques, Tactics, and Procedures) driving hybrid interference.
A vote on the fault line of Europe
Moldova entered the 2025 parliamentary elections at a moment of rare consequence. In a parliamentary republic, where control of the legislature determines both government formation and strategic direction, the vote became a critical juncture, whether Moldova would consolidate its European path or succumb to Russian influence. The outcome delivered a measure of clarity. The pro-European Party of Action and Solidarity (PAS) secured an outright majority with 55 of 101 seats, a mandate sufficient to govern without coalition partners and to stabilise the political landscape, at least for now.
In retrospect, the campaign unfolded across a fragmented political landscape, with 15 political parties, 4 electoral blocs, and 4 independent candidates vying for control of the legislature. On the cusp of voting, the Central Electoral Commission (CEC) barred the Moldova Mare (Greater Moldova) party, led by former prosecutor Victoria Furtuna, amid sweeping investigations into vote-buying schemes tied to Russia, the fugitive oligarch Ilan Shor, and proxy infrastructures such as the Evrazia foundation. Though the platform assumed a ‘sovereignist’ (populist) rhetoric, the probes revealed direct coordination with Russian curators and substantial illicit funding.
Simultaneously, Irina Vlah’s party Inima Moldovei (Heart of Moldova), of the Patriotic Electoral Bloc (a coalition of pro-Russian, post-communist factions led by former president Igor Dodon), was also struck from the ballot, with the Court citing bribery and illegal financing. Vlah was the former governor of autonomous Gagauzia, an ethnically layered Turkic enclave of Orthodox belief that, in the aftermath of Russia’s 2022 invasion of Ukraine, emerged as the preferred staging ground for Russian influence operations, and a stronghold for Ilan Shor’s profusely funded destabilisation efforts. Gagauzia’s territorial status has long been gamed to undercut Moldova’s fragile sovereignty, echoing the 1990s when its externally managed separatist mobilisation unfolded in tandem with Transnistria’s, albeit with different outcomes.
Had no party secured an outright majority, coalition building would have become critical, but also the most volatile outcome shaping the next government. Power-sharing experiments had repeatedly collapsed under the weight of mistrust, corruption and competing geopolitical loyalties. Past uneasy alliances oscillated between (at times) reformist, European-leaning platforms and opportunistic political arrangements of the old guard, newly emergent elites, or oligarchic clans, all variously bound by crippling corruption schemes and the long reach of Russia’s patronage networks. At their most malign, these coalitions periodically resuscitated bids for reintegration into Russian-led structures, triggering parliamentary dissolutions and prolonged episodes of institutional paralysis.
Under the incumbent administration, which has retained a governing majority since the July 2021 snap parliamentary elections, when the Party of Action and Solidarity (PAS) secured 63 out of 101 seats, the country experienced, for the first time since independence, an uninterrupted pro-European alignment between the parliament and the executive, and the first legislature to explicitly associate its agenda with the European integration process. Roughly one in eleven laws passed over the four-year mandate carried the EU imprint. Politically, it went even further by reaffirming an irreversible commitment to European integration (since 2024 also enshrined in the Constitution).1
Moldova moved tangibly westward, securing EU candidate status in 2022 and formally opening accession talks in June 2024. Brussels has since kept the enlargement track active. This geostrategic tilt was reinforced on the security and energy fronts; Moldova’s grid was synchronised with continental Europe in March 2022, and the expansion of gas interconnectivity with Romania (Iași-Ungheni-Chișinău) provided alternatives to Russian supply. In parallel, Moldova served as a transit corridor in the EU’s Solidarity Lanes to facilitate Ukrainian exports.
Yet, in line with Russia’s reflexive-control doctrine,2 Moldova’s policy achievements were deliberately reframed as vulnerabilities to legitimise their reversal: EU accession as loss of sovereignty, security cooperation as provocation, and support for Ukraine as evidence of external manipulation.
These distortions extended beyond policy. Narratives surrounding governance, social cohesion, and electoral integrity were relentlessly targeted, ensuring that democratic participation itself became a site of contestation and mistrust. Moldova was not merely a receptacle of propaganda but an operational theatre of Russia’s hybrid strategy, where the information domain could be weaponised to shape choices before they were even made.
Selected TTPs: how interference was executed
The disinformation ecosystem surrounding Moldova’s parliamentary elections did not resemble a single campaign but a layered, cross-platform environment. Components of the same machinery, Telegram channels seeded narratives, cloned ‘news’ sites recycled them globally, TikTok swarms amplified emotional mobilisation, proxies on Facebook, X, or YouTube reinforced circulation, while local influencers lent local legitimacy. Rather than operating in isolation, these elements fed into one another as ‘evidence’ of public sentiment, forming a circular system designed not only to persuade but also to surround voters and broader publics with a sense of permanent crisis.
- Templated amplification and temporal bursts
A first salient pattern was templated amplification: near-identical scripts pushed in tightly compressed windows to simulate spontaneous or widespread outrage. In the Transnistria voter-suppression campaign alone, over 260 posts across multiple platforms recycled the same core allegation, of ethnic and political disenfranchisement. Activity peaked in mid-September with 55 posts in a single day and a spike of 15 posts in one hour.
The messaging travelled in synchronised bursts rather than as a slow, deliberative conversation. Russian-origin and affiliated Telegram channels, such as Rybar and The Islander, seeded the initial script, which was then cloned across language-specific spin-offs and web domains within the Pravda network, creating the illusion of corroboration. The result was a layered disinformation strategy that coupled language targeting with centralised message control.
The original message invoking the suppression of voting rights, particularly the ‘redrawing of the electoral map by PAS’ (the Party of Action and Solidarity, founded by Maia Sandu), was posted by Rybar (1.3 million followers) – a well-documented disinformation actor/channel associated with Mikhail Zvinchuk, a military blogger placed under sanctions, and tied to Russia’s Ministry of Defence. Public EU documents also attest to his participation in a high-level working group convened in 2022 by Vladimir Putin to coordinate Russia’s all-out mobilisation against Ukraine. The channel has significantly expanded its reach, with spinoffs in multiple languages across a vast transnational geography.
A parallel amplification strand around voter suppression in Transnistria was picked up by The Islander, another disinformation outlet linked to Gerry Nolan and Chay Bowes, both Irish nationals with extensive histories in geopolitical influence operations, notwithstanding direct affiliations with Russian state media (i.e. RT and Sputnik). Active across Telegram and X, The Islander functions as a narrative laundering node, repackaging Russian-origin messaging into Anglophone spaces (albeit not the only one).
On TikTok, we observed the same tactic at its most granular level. A coordinated cluster of at least four accounts, linked to pro-Russian propagandist Tatiana Costachi, reposted an identical video accusing authorities of suppressing Transnistrian voters, while accruing disproportionate reach. We identified two adjacent clusters (below-left, network graph) with similar structures but different narrative frames: one centred on anti-EU mobilisation, and another on diaspora scapegoating. Both are connected to the amplification network associated with Tatiana Costachi, which has cumulated over 3 million impressions in a short time span.
Despite their thematic divergence, both clusters replicate the dissemination pattern observed in earlier content: high semantic uniformity, copy-pasted or minimally altered scripts, and coordinated releases within tight temporal windows (24-48 hours). Messaging framed the EU as an exploitative colonial threat, while the diaspora cluster redirected frustration inward, portraying Moldovans abroad as a parasitic force, abandoning Moldova while abusing its services. Such inflammatory rhetoric sought to exploit economic anxiety and post-Soviet identity fractures to deepen divisions between citizens at home and abroad.
Templated amplification acts as a force multiplier; once a script proves effective, it can be redeployed across platforms with minimal effort.
- Narrative laundering through proxy networks
Another recurring tactic, narrative laundering, moved storylines from Russian sources through local or seemingly neutral intermediaries until their origin was obscured. The pipeline often ran from Russian Telegram channels (Rybar, Slavyangrad) into Romanian-language and Western information spaces – often via actors apparently based in European countries but ultimately tied back to the same core disinformation networks. By the time a narrative emerges on a Romanian-language Facebook page or in a Moldovan TikTok feed, it may no longer be immediately recognisable as Russian.
In analytical terms, narrative laundering transforms what should be recognisable as a foreign interference campaign into opinions that look and feel endogenous, complicating attribution and blurring the line between external manipulation and domestic contestation.
- TikTok swarms and participatory mobilisation
If Telegram has served as the operational backbone, prompting amplification cues, TikTok emerged as the engine of emotional mobilisation. The PPDA/Vasile Costiuc ecosystem, explored prior to the vote in collaboration with the FACT EU Hub, illustrates this dynamic particularly well. The Democratia Acasa (PPDA) party passed the 5% threshold and won six parliamentary mandates, running on a ‘sovereignist’ (populist) platform reinforced by the support networks of the far-right Alliance for the Union of Romanians (AUR). Pre-electoral polls had failed to credit PPDA with any realistic chance of clearing the threshold despite its inflated online visibility.
From a corpus of 2,171 TikTok posts, at least 337 were duplicates or near-identical repeats, spread across a web of seemingly unaffiliated accounts. However, many of these accounts behaved as ‘twins’, cross-posting in a tactically repetitive manner.
These repetitions were not accidental. Instead, they evolved into a strategy of content flooding, gaming TikTok’s algorithm by reinjecting the same emotionally charged narratives into users’ feeds: the plight of local farmers, pensioners abandoned by the state, families facing eviction, diaspora hardships abroad and many more similar tropes. These clips were accompanied by explicit calls to action, urging viewers to open new accounts, repost videos, ‘flood TikTok’ with complaints, or confront perceived enemies online, from the government to civic watchdogs. This rhetorical strategy delegitimises independent oversight and positions civil society as a collective enemy – collapsing all institutional counterweights into a single hostile bloc. Similar patterns and rhetorical artifices were noticeable in Romania, where they feature prominently in far-right, populist discourse.
Collage 1 : Building on the cross-platform dataset, Vasile Costiuc, the leader of the Democratia Acasa party, also appeared in the Russian-spun Pravda network and its Romanian-language affiliates at least seven times between July and August 2025.
- Rhetorical camouflage and ‘sovereignist’ (nationalist-populist) rebranding
Another operational behaviour involved rhetorical camouflage, with (political) actors adopting pro-European or ‘neither East nor West’ rhetoric while structurally aligning with Russian postures.
An illustrative case is the Alternative Electoral Bloc (Blocul Electoral Alternativa – BA), ostensibly (self-declared) as pro-European, but in fact operating as a pro-Russian conduit, aligned with Moscow’s strategic interests. The Bloc’s leadership includes a number of controversial figures, amongst them, Alexandr Stoianoglu (presidential contender in 2024), Ion Ceban (formerly a member of the pro-Russian Socialist Party, PSRM, who was denied entry in Romania and the Schengen area on grounds of national security risks), and Mark Tkaciuk, a communist ideologue who persistently advocated for Moldova’s integration into the Eurasian Union. Throughout its campaign trail, BA avoided a clear positioning on core geopolitical issues, including Russia’s war in Ukraine.
A substantial share of the information manipulation arsenal was channelled into amplifying ‘sovereignist’ parties and blocs. These political hybrids blend nationalist rhetoric with populist tropes, allowing them to exploit domestic grievances while opportunistically tapping into transnational ideological currents, including newly imported slogans and nominal affiliations to the MAGA and its European offshoot, MEGA (Make Europe Great Again) movements. This coordinated propagation also relied on foreign influencers and political technologists, some visible, others concealed behind online avatars and proxy accounts, many of whom also operate from the United States.
In 2024, during Romania’s presidential elections, Jackson Hinkle, an American commentator, openly aligned with Russian state media, played an active role in amplifying polarising frames and has since directed similar messaging toward Moldova. In both cases, unfounded accusations of election fraud and vote theft sought to pre-emptively discredit the result and incite civil unrest.
- Manipulation Techniques
Online, this ambiguity was reinforced by a vast repertoire of manipulation techniques and rhetorical artifices. From June 1st to mid-September (prior to the vote), we identified 6,823 manipulation techniques and 3,671 rhetorical figures embedded in the discourse using the PROMPT Corpus Analyser.
Across the coded sample, the dominant manipulation techniques included name-calling/labelling, casting doubt, and guilt by association – devices that reduced political competitors to hostile archetypes (‘globalists’, ‘foreign puppets’, ‘traitors’, etc.), and recast communities through associative blame – for instance, civil societies portrayed as captive to incumbent power, or entirely deprived of agency.
In parallel, most recurrent rhetorical figures consisted of exaggeration, false equivalencies, repetition/redundancy, and anecdotal storytelling. This repertoire of stylistic devices served as a force multiplier, intensifying emotional resonance while lending speculative claims a sense of inevitability.
Together, these mechanisms shaped an informational environment designed to feel persuasive regardless of evidence.
What to do with all this knowledge?
Taken together, these TTPs reveal a multi-layered hybrid campaign: templated posting bursts seeded narratives, proxy networks laundered them across borders, TikTok swarms amplified emotional mobilisation, while rhetorical camouflage preserved deniability. This is the architecture we have learnt to confront, moving beyond the episodic firefighting or emergency choreography that precedes the vote.
Electoral integrity increasingly depends on what happens between election cycles. When journalists, observers, and voters can recognise algorithmically manufactured outrage or recycled narratives disparaging democratic choice, concerted manipulation loses some of its grip. However, none of this resolves the asymmetry at the heart of the problem – democracies will always operate under ethical constraints that hostile actors and authoritarian regimes simply do not share. In our conversations with grassroots communities of practice, we also fought hard arguments that we must distinguish societal resilience from mere counter-propaganda or ‘playing by the enemy’s rules’ in the hope of manufacturing consent.
Resilience, however, is not a spectator sport, and requires us to confront how widely the burden of safeguarding democracy is shared, and how differently it is understood in contexts where legitimacy itself is contested. The same diagnostics that expose disinformation can be repurposed into consequence engines: a more effective sanctions regime through evidence files for money-laundering investigations, ownership trails that trigger licence and funding reviews, pattern dossiers that push platforms from cosmetic moderation to infrastructure takedown of repeat offenders – or else.
It is equally important to note that some of the most consequential infrastructures in the informational ecosystem sit at the edge of current regulatory reach, still governed by hard borders. Telegram, for instance, is not designated as a Very Large Online Platform (VLOP) under the EU’s Digital Services Act, despite its central role in seeding and coordinating cross-border destabilisation campaigns – this designation is based on self-reported user numbers just below the 45-million threshold. Closed messenger applications, which are broadly deployed for coordination, also fall outside the scope of the DSA. At the same time, journalists and NGOs who chart these ecosystems increasingly face SLAPP suits, through defamation and civil actions meant to drain resources and scrutiny. Abusive litigants, able to sustain expensive legal battles indefinitely or until they successfully coerce investigative outlets into retreat, are rarely penalised, despite years of warnings and such cases accumulating across Europe. Although a welcome initiative, the EU’s anti-SLAPP Directive, adopted in May 2024, will take another two years to be transposed into national legal systems.
Even more so, EU consortia need to account for dynamics beyond their geographical scope. The diasporas themselves tend to fall through the cracks within EU-level response mechanisms. These transnational constituencies are no less consequential; on the contrary, often doubly exposed to radicalisation patterns, diasporas become both vectors and targets of disinformation, where manipulative narratives are refined and fed back into both host and home democracies (and vice versa). Ignoring them not only leaves millions of European citizens outside the protective scope of emerging response mechanisms but also concedes a strategically valuable terrain to hostile actors who understand all too well how to weaponise porous jurisdictions and socio-economic precarity.
Overall, democratic safeguards, whether institutional, civic or both, need to evolve alongside the threat landscape, rather than react belatedly to it or not at all. From an institutional perspective, this persistent over-reliance on platforms to detect systemic risks, moderate content, and essentially police their own business models, outsources core democratic functions to private actors with limited incentives to confront otherwise extremely profitable abuses.
In other words, the same evidence that maps hybrid campaigns must also reshape the regulatory environment in which they operate, rendering every single operation weaker, poorer, and less credible than its starting point.
1 During the campaign, Russian-aligned parties and leaders constantly threatened to back-track on this constitutional provision and organise a referendum that would herald a return to the status quo – disinformation outlets amplified this narrative across platforms and the web.
2 Keir Giles (2016). The Next Phase of Russian Information Warfare (Riga: NATO StratCom COE). Passim.
Opinions expressed on this website are those of the authors alone and do not necessarily reflect or represent the views, policies or positions of the EJO or the organisations with which they are affiliated.
The analysis based on the PROMPT narrative report is also available in an interactive, exploratory format here: https://elections.igov.ro/
This article was first published on: https://de.ejo-online.eu/ The original article is available here: https://de.ejo-online.eu/aktuelle-beitraege/parlamentswahlen-2025-in-moldawien-den-kampf-vorantreiben
Acknowledgements: the PROMPT EU Consortium, the investigative team from Context.ro, Vladimir Buruiana (Moldovan civic diaspora), the civil societies and watchdogs on the digital frontlines.
