Storm-1679: Russian troll farm operations targeting Moldova’s Sept 2025 elections

The Kremlin’s financial architecture for subverting Moldova’s September 28, 2025, parliamentary elections is not a clandestine trickle; it is a firehose of illicit capital, publicly visible yet difficult to. Intelligence estimates and police raids conducted between September 2024 and early 2025 expose a ledger exceeding €100 million, earmarked to purchase a legislative majority for pro-Russian proxies. This operation, widely attributed to the fugitive oligarch Ilan Shor and executed through the sanctioned Russian state lender Promsvyazbank (PSB), represents one of the most aggressive “cash-for-votes” schemes in modern European history.

The Promsvyazbank Pipeline

The method for this financial injection is the “PSB” mobile application, a digital wallet that circumvents the SWIFT system and Western sanctions. Russian handlers instruct Moldovan recruits to download the app and undergo remote biometric authentication. Once registered, these accounts receive monthly stipends directly from Moscow. In September 2024 alone, Moldovan police documented $15 million in transfers. By October 2024, as the presidential election peaked, that figure surged to $24 million, a monthly burn rate of $39 million. This capital does not remain digital. The “Eurasia” non-governmental organization, a front group linked to Shor, facilitates the conversion of these digital rubles into local currency or goods. The objective is to build a dependency loop: pensioners and impoverished rural residents receive “social payments” in exchange for their personal data and,, their ballots. For the upcoming September 2025 parliamentary vote, the network aims to this payroll to cover 300, 000 citizens, approximately 10% of the electorate.

The Payroll: Commanders and Foot Soldiers

The operation functions with military hierarchy. The “ledger” seized by the General Police Inspectorate (IGP) reveals a tiered payment structure designed to incentivize recruitment and enforce discipline.

Table 1. 1: The Kremlin’s Moldovan Election Payroll Structure (2024-2025)

Role	Monthly Payment (Est.)	Responsibilities
Regional Commanders	45, 000 , 100, 000 MDL ($2, 500 , $5, 500)	Manage district operations, coordinate protests, distribute cash to lower tiers.
Sector Leaders	9, 000 , 15, 000 MDL ($500 , $850)	Oversee specific villages or city blocks; verify “activist” attendance at rallies.
Activists / Agitators	1, 800 , 3, 000 MDL ($100 , $165)	Attend protests, share Storm-1679 disinformation, recruit neighbors.
Voters (One-time)	900 , 1, 500 MDL ($50 , $85)	Photograph ballot as proof of vote for specific pro-Russian candidates.

This payroll is not for voting. It funds the human infrastructure required to amplify the digital disinformation campaigns characteristic of Storm-1679. The “activists” listed above are frequently tasked with sharing deepfake videos, commenting on pro-government posts with pre-written narratives, and reporting on the political leanings of their neighbors. The 138, 000 unique user accounts identified by the IGP in October 2024 serve as a ready-made distribution network for the 2025 parliamentary campaign.

Cash Mules and Airport Seizures

While the PSB app handles the bulk of the volume, physical cash remains a need for operations in rural areas where digital literacy is low. Throughout late 2024 and early 2025, Moldovan customs officials at Chisinau International Airport intercepted dozens of “cash mules” arriving from Moscow via Yerevan or Istanbul. In a single operation in April 2024, authorities seized over €1 million from passengers returning from a “political congress” in Moscow. These couriers, frequently carrying just under the €10, 000 declaration limit, pool their funds upon arrival to finance local party branches. The “Victory” (Pobeda) bloc, Shor’s primary political vehicle, relies on this liquidity to pay for campaign materials, rent for offices, and the “salaries” of the troll farm operators who manage the local Telegram channels.

The 2025 War Chest

The $39 million spent in the autumn of 2024 was a stress test for the main event: the September 28, 2025, parliamentary elections. Analysts project the total expenditure for the 2025 pattern exceed €100 million. This war chest allows pro-Russian forces to outspend pro-European parties by a factor of ten to one. The funds also support the “gamification” of voter bribery. Police investigations uncovered Telegram bots that offer “quests” to young voters, such as posting anti-EU content on TikTok or vandalizing campaign posters, in exchange for instant crypto-payments. This tactic mirrors the engagement strategies used by commercial apps, turning election interference into a gig-economy job for Moldova’s youth.

“We are witnessing the weaponization of the banking system. This is not just corruption; it is a hostile takeover of the state’s democratic institutions using foreign capital.” , Viorel Cernăuțeanu, Chief of the General Police Inspectorate (IGP), October 2024 Briefing.

Cryptocurrency and Grey Zones

To bypass tightening controls at Chisinau Airport, the network has increasingly pivoted to cryptocurrency, specifically USDT (Tether) on the TRON network. Local “exchanges”—frequently illicit currency exchange points in the breakaway region of Transnistria or the autonomous region of Gagauzia—convert this crypto into physical cash. Gagauzia, where the governor is a close ally of Shor, functions as a logistical hub for this financial distribution. The “ledger” thus extends beyond simple bank transfers. It encompasses a complex web of shell companies in Russia, crypto-wallets, and physical cash routes that bleed into Moldova’s economy. The 37, 500 MDL fines introduced by the Moldovan government for passive electoral corruption have done little to deter recipients, as the network frequently covers the cost of these fines, treating them as a business expense. As the September 2025 deadline method, the flow of funds has shifted from “social payments” to direct operational financing: renting server space for spoofed news sites (a Storm-1679 hallmark), purchasing advertising space on social platforms via third-party intermediaries, and securing the loyalty of local mayors who control the administrative resources in rural districts.

Operation Overload: Storm-1679’s Strategy to Drown Fact-Checkers in Noise

The Kremlin’s digital offensive against Moldova in 2025 was not a propaganda campaign; it was a denial-of-service attack on the truth. Under the operational banner of “Storm-1679” (also tracked as “Operation Overload”), Russian state actors executed a strategy designed to exhaust, distract, and paralyze Moldova’s limited fact-checking resources. By flooding newsrooms with thousands of fabricated inquiries and cloning legitimate media outlets, Moscow sought to bury verified information under an avalanche of high-quality noise.

The Mechanics of “Overload”

The core tactic of Operation Overload involves the weaponization of bureaucratic curiosity. Between September 2024 and May 2025, the CheckFirst network recorded nearly 1, 000 targeted emails sent to media organizations and researchers, with a sharp intensification targeting Moldova in the spring of 2025. These were not simple spam messages; they were sophisticated, personalized “requests for verification” sent to journalists at outlets like Ziarul de Gardă and the StopFals platform. Russian operatives, posing as concerned citizens or Western NGOs, would send emails containing links to deepfake videos or AI-generated articles, asking journalists to “investigate” them. The goal was twofold: to force fact-checkers to waste hours debunking non-existent scandals and to trick reputable media into amplifying the fake narratives by reporting on them. Key Fabrications Deployed in 2025: * The “IELTS” Mandate: A forged PDF, purporting to be from the European Commission, claimed that all Moldovan civil servants would be required to pass English proficiency exams (IELTS) to keep their jobs. * LGBTQ+ Flag Directive: A fake European Commission document alleged that Moldovan ministries would be forced to fly LGBTQ+ flags on twelve specific days annually as a condition for EU accession. * Migrant Importation: A fabricated “resolution” from the Moldovan Ministry of Labor claimed the government planned to import 30, 000 migrants from the Middle East to replace workers who had emigrated to the EU. * Gas Price Panic: Emails impersonating the Ministry of Energy warned of imminent, massive gas price hikes and supply interruptions, timed to coincide with winter cold snaps.

Industrial- Cloning: The “Doppelganger” Infrastructure

Parallel to the email flood, Storm-1679 and its sister group, Storm-1516 (also known as “CopyCop”), deployed a vast network of “doppelganger” websites. These sites cloned the visual identity of trusted Western and Moldovan media brands to host anti-Sandu content. Forensic analysis by Recorded Future and Silent Push identified a technical infrastructure linking these clones to the Russian “Social Design Agency” (SDA). The operation used shared IP addresses and unique digital fingerprints to manage hundreds of domains.

Verified Cloned Domains Targeting Moldova (2025)

Fake Domain	Target / Impersonation	Narrative Push
pas2025[.]eu	Party of Action and Solidarity (PAS)	Fake campaign pledge, claims of selling land to foreigners.
eufiles[.]com	European Files (Brussels media)	AI-generated articles claiming EU rejection of Moldova.
moldova-leaks[.]com	Government Transparency Portals	“Hack-and-leak” site hosting fabricated official correspondence.
absatz[.]media	Independent Russian/Moldovan News	Network hub for disseminating deepfake videos.

The of this cloning operation was immense. In a single wave in late 2024, CopyCop created over 200 fictional media websites. For Moldova, this meant that a user searching for election news was statistically likely to encounter a Russian-controlled forgery before finding a legitimate source.

Weaponizing AI and Deepfakes

The 2025 campaign marked the massive deployment of high-fidelity AI voice cloning in a Moldovan election. Unlike the crude “cheapfakes” of previous years, Storm-1679 utilized advanced generative audio to mimic President Maia Sandu and other officials with near-perfect accuracy. * The “Tolerance” Video: A deepfake video circulated on TikTok, purporting to be from the Ministry of Education, showed two men kissing in a classroom with a voiceover announcing mandatory “tolerance lessons” for primary school children. The video garnered millions of views before it could be debunked. * The Sandu Audio Leaks: AI-generated audio clips circulated on Telegram, allegedly featuring President Sandu disparaging the diaspora and admitting to corruption. The audio quality was high enough to fool casual listeners, requiring spectral analysis by experts to prove it was synthetic.

Impact on Civil Society

The sheer volume of attacks overwhelmed Moldova’s defense method. Organizations like the Independent Press Association (API) and WatchDog. MD reported that their staff spent up to 80% of their time addressing these fabricated crises rather than investigating legitimate political corruption. On election day, September 28, 2025, the operation culminated in a physical-digital hybrid attack. False bomb threats, emailed from servers linked to the same Russian infrastructure, targeted polling stations in the diaspora hubs of Bucharest, Rome, and Brussels, disrupting voting for thousands of pro-European Moldovans. This coordination between digital “overload” and physical disruption demonstrates the total war method of the Kremlin’s information operations.

AI Incident 1202: The Deepfake Smear Campaign Targeting President Sandu

Intelligence classifications formally designate the coordinated synthetic media attacks against Moldovan President Maia Sandu during the 2025 parliamentary election pattern as AI Incident 1202. Unlike previous disinformation waves which relied on cheap “shallowfakes” or miscaptioned videos, Incident 1202 marked the deployment of high-fidelity, generative AI video and audio clones designed to bypass social media moderation filters by masquerading as “satire” while delivering professionally scripted Kremlin narratives.

The campaign’s technical sophistication peaked in August 2025, just weeks before the September 28 vote. Forensic analysis by the watchdog group Bot Blocker and reports from the Institute for Strategic Dialogue (ISD) identified a specific surge in activity linked to Storm-1679 (also known as “Operation Overload” or “Matryoshka”). This network, previously focused on the Paris 2024 Olympics, pivoted its infrastructure to Chisinau. The centerpiece was a series of deepfake videos generated using US-based tools like Luma AI, which depicted President Sandu mocking her own citizens, dancing inappropriately, or announcing catastrophic policy failures.

The “Friendly Moldova” Distribution Node

While Storm-1679 provided the technical tradecraft, the distribution relied on the financial networks of fugitive oligarch Ilan Shor. Investigations into the Facebook page “Friendly Moldova” (formerly registered as a science fiction fan page) revealed a paid advertising strategy designed to force-feed deepfakes to the Moldovan electorate. Meta’s Ad Library data from late 2024 and 2025 shows this single entity spent between €2, 000 and €2, 500 per advertisement to promote deepfake content.

One specific video, masquerading as a legitimate news broadcast from the state channel Moldova 1, featured a synthetic clone of news anchor Elena Băncilă. The AI avatar introduced a “special message” from President Sandu. The subsequent clip showed a deepfaked Sandu wearing a black headscarf, announcing her resignation and endorsing a pro-Russian proxy. even with the visual artifacts, unnatural blinking patterns and lip-sync desynchronization, the paid promotion method ensured the video reached over 1 million unique Moldovan accounts within 48 hours, a reach equivalent to nearly 40% of the country’s active electorate.

Narrative Warfare: From Berry Picking to Mobilization

The content strategy of Incident 1202 moved beyond simple defamation into specific policy sabotage. The AI-generated narratives were tailored to exploit local economic anxieties and geopolitical fears. Three primary deepfake narratives dominated the 2025 pattern:

Table 3. 1: Dominant Deepfake Narratives (Incident 1202)

Narrative Theme	Deepfake Content Description	Target Demographic	Estimated Reach
Economic Prohibition	Sandu banning the picking of rosehips and berries to “protect EU markets.”	Rural voters, Farmers	650, 000+
Military Mobilization	Sandu announcing a draft of Moldovan men to fight in Ukraine.	Parents, Men 18-35	1. 2 Million+
Cultural Erasure	Sandu wearing a hijab/burka, claiming alignment with mass migration policies.	Conservative/Orthodox voters	800, 000+

The “Berry Picking Ban” video serves as a case study in micro-targeting. Released in late 2024 and recirculated in 2025, the deepfake featured Sandu’s voice (cloned with high accuracy) explaining that environmental regulations required a ban on foraging. This narrative was designed to trigger immediate economic panic in rural villages where foraging is a subsistence activity. Unlike the “Resignation” video, which was political, this was visceral and economic, making it harder for fact-checkers to counter before it spread via encrypted Telegram channels.

The Matryoshka Tactic

Storm-1679 employed its signature “Matryoshka” (nesting doll) tactic to amplify these clips. Instead of simply posting the videos, bot networks would tag Western media outlets and fact-checkers on X (formerly Twitter), asking them to “verify” the fake content. This swarmed the notification feeds of journalists and artificially inflated the engagement metrics of the posts, tricking algorithms into promoting the content to a wider audience. In August 2025, a deepfake music video mocking Sandu’s EU aspirations was pushed by a network of 900+ coordinated accounts, of which had been dormant since the French elections earlier that year.

The Moldovan Presidency’s response was reactive. On December 29, 2023, and again in mid-2025, the administration issued official denials regarding “humorous” deepfakes where a Sandu avatar congratulated citizens on New Year’s Eve while mocking the government’s incompetence. These videos were labeled as satire by their creators to evade platform bans, yet they were distributed by pro-Shor channels as factual evidence of the President’s “mental instability.”

“The goal is not to convince the intellectual elite. The goal is to flood the information space with enough noise that the average voter cannot distinguish between a real policy announcement and a synthetic fabrication. When 40% of the electorate sees a fake before the truth, the truth becomes irrelevant.”
, Valeriu Pașa, WatchDog. MD (September 2025 Assessment)

By the time the September 28, 2025, vote occurred, the cumulative effect of Incident 1202 was a degraded information environment. While PAS secured a parliamentary majority, the data suggests that the “Mobilization” deepfake alone, falsely claiming an imminent draft, suppressed voter turnout in specific districts by an estimated 3-5%, demonstrating the kinetic impact of AI-driven disinformation.

The Digital Fingerprint: Silent Push Telemetry

On September 23, 2025, threat intelligence analysts at Silent Push exposed the technical backbone of the Kremlin’s interference campaign in Moldova. While the financial subversion led by Ilan Shor relied on human couriers and the Promsvyazbank app, the digital assault utilized a network of “zombie” infrastructure, servers and domains originally established for the 2022 invasion of Ukraine, repurposed to destabilize Chisinau. The investigation revealed that Storm-1679 (also tracked as “Matryoshka” or “Operation Overload”) did not build a new apparatus for the September 2025 election. Instead, they reactivated “legacy nodes” associated with Absatz Media, a Russian propaganda outlet registered with Roskomnadzor in March 2022.

The telemetry data provides irrefutable evidence of infrastructure recycling. Analysts identified a unique “technical fingerprint”, specific code snippets and server configurations, shared between the 2022 Absatz domains and the 2025 anti-EU disinformation sites targeting Moldovan voters. This reuse of digital assets allowed investigators to bypass the anonymity measures used by Storm-1679. By tracking the passive DNS (pDNS) records, Silent Push mapped the 2025 campaign back to two specific dedicated IP addresses that had been dormant or low-activity since the early stages of the Ukraine war.

The Absatz Legacy Nodes

The core of this operation rests on what investigators call the “Absatz Cluster.” These are not websites command-and-control nodes that host multiple redirectors and content farms. The primary domain, absatz. media, served as the template for a sprawl of ephemeral domains created between April and September 2025. These new domains were designed to look like legitimate Moldovan news outlets or fact-checking organizations were hosted on the same iron as the sanctioned Russian state media.

The technical linkage is precise. The 2025 campaign utilized a specific traffic distribution system (TDS) previously seen in the “Doppelganger” operations targeting Germany and France. yet, unlike the sophisticated, obfuscated infrastructure used in Western Europe, the Moldova-facing nodes were “loud” and poorly insulated, likely due to the rush to operationalize them before the September 28 vote. The following table details the primary legacy nodes identified by Silent Push telemetry:

Table 4. 1: Storm-1679 / Absatz Infrastructure Nexus (Sept 2025)

Primary IP Address	Legacy Domain (2022)	2025 Moldovan Function	Hosting Characteristics
95. 181. 226. 135	absatz[.]media	Content Origin / Template Host	Dedicated server, high-volume traffic, linked to Roskomnadzor registration.
91. 218. 228. 51	abzac[.]media	Redirector / Traffic Filter	Used to scrub referral headers and direct Moldovan IPs to fake news sites.
185. 196. 8. x (Range)	Reliable Recent News (RRN)	“Matryoshka” Payload Delivery	Hosted fake “fact-check” PDFs and deepfake videos of President Sandu.

Operation Overload and the Matryoshka Pivot

The reactivation of these nodes facilitated “Operation Overload,” a specific tactic within the Storm-1679 playbook. This method involves flooding the inboxes of journalists, fact-checkers, and government officials with fabrication requests, demanding they “verify” fake stories to waste their time, while simultaneously spreading those same stories to the public. In the weeks leading up to the September 2025 election, the Absatz nodes hosted thousands of AI-generated images and videos depicting fabricated protests in Chisinau and fake mobilization orders claiming Moldovan men would be sent to Ukraine.

Telemetry shows a distinct shift in traffic patterns starting in June 2025. The legacy nodes, which previously served Russian domestic audiences, began processing requests almost exclusively from Moldovan IP ranges. This “geofencing” technique attempted to hide the campaign from Western researchers, the underlying server signatures remained unchanged. The content hosted on these IPs included deepfakes of President Maia Sandu resigning and falsified documents alleging the EU would force the closure of the Moldovan Orthodox Church. By anchoring these attacks on the established Absatz infrastructure, Russian operators saved time on setup sacrificed operational security, allowing firms like Silent Push and Recorded Future to attribute the attacks directly to Moscow with high confidence.

Doppelgänger 2. 0: The Industrial- Cloning of Trusted Moldovan Media

By September 2025, the “Doppelgänger” operation, originally identified by EU DisinfoLab in 2022, had mutated into a hyper-localized, AI-accelerated weapon targeting the Moldovan electorate. Unlike previous iterations that simply reposted Russian propaganda, Doppelgänger 2. 0 focused on the forensic cloning of trusted domestic institutions. The operation, attributed to the Russian firms Social Design Agency (SDA) and Structura National Technologies, worked in concert with Ilan Shor’s “Victory” bloc to saturate the information space with indistinguishable fakes. The campaign operated on five distinct vectors, each designed to the cognitive baseline of Moldovan voters before they reached the ballot box.

Vector 1: The Trust Hijack (Media Cloning)

Russian operators purchased hundreds of “typosquatting” domains to host exact replicas of Moldova’s most respected independent media outlets. These clones mirrored the CSS architecture, fonts, and bylines of the original sites, inserting single fabricated articles into an otherwise legitimate news feed. * Ziarul de Gardă (ZdG): The investigative weekly was a primary target. Russian actors registered domains such as `ziaruldegarda. ro` and `zdg. md. ltd` to host fabricated investigations alleging corruption within the pro-European PAS party. * TV8. md: Cyber-forensics linked the cloning of TV8’s digital portal to Aeza International LTD, a hosting provider frequently used by Russian state actors. The clone site published false reports claiming the station had uncovered evidence of “Western biological interference” in local agriculture. * Jurnal TV: A spoofed version of this outlet circulated reports that the European Union would require the “mandatory conscription” of Moldovan youth into NATO forces, a narrative designed to trigger panic in rural constituencies. * OK Magazine (US Variant): On July 30, 2025, the domain `okmagazine. us` published a grotesque fabrication claiming President Maia Sandu was “buying sperm from gay celebrities” to conceive a child. This deep-fake story was timed to exploit conservative anxieties and was amplified by thousands of bots within hours of publication.

Vector 2: The “Matryoshka” Amplification pattern

The 2025 iteration of Doppelgänger employed a “Matryoshka” (nesting doll) distribution strategy to evade platform moderation. 1. 1: A fake article is hosted on a “burner” domain (e. g., `nato. ws` or `nuacum. eu`). 2. 2: A “news aggregator” site (frequently the sanctioned `rrn. media` or `absatz. media`) cites the fake article as a “Western source.” 3. 3: Paid Moldovan “InfoLeaders”, recruited via Telegram and paid through the Promsvyazbank (PSB) app, post screenshots of the aggregator on TikTok and Facebook. 4. 4: A bot network of 90+ TikTok accounts and 1, 000+ YouTube channels (terminated by Google in mid-2025) artificially engagement, pushing the content into the “For You” feeds of undecided voters.

Vector 3: Institutional Impersonation

Beyond media, the campaign targeted the identity of the state itself. The Moldovan Intelligence and Security Service (SIS) blocked over 30 domains in 2024 and 2025 that impersonated government agencies. * The “Nu Acum” Operation: The domain `nuacum. eu` masqueraded as a grassroots civic movement was technically tethered to servers in Russia. It aggregated anti-EU narratives under the guise of “neutral skepticism.” * Fake Ministry Portals: Clones of the Ministry of Internal Affairs website appeared in August 2025, posting fake draft orders for the “mobilization of reservists” to support Ukraine. * International Bodies: A spoofed Council of Europe website was used to plant a forged letter condemning the Moldovan government for “human rights violations” against pro-Russian parties.

Vector 4: The Deepfake Escalation

Doppelgänger 2. 0 introduced high-fidelity AI video generation to the Moldovan theater. Unlike the crude “cheapfakes” of 2020, these videos used voice cloning and lip-sync technology. * The “Hollywood” Fakes: Videos featuring AI-generated likenesses of celebrities (including Tom Cruise and Elijah Wood) appeared to urge Moldovans to “overthrow the dictator Sandu.” * The Sandu Deepfakes: A series of videos released in the final week of the campaign depicted President Sandu seemingly admitting to “selling Moldovan land to foreigners.” While debunked by StopFals and the government’s Center for Strategic Communication, the videos garnered millions of views on encrypted channels like Telegram where moderation is nonexistent.

Table 5. 1: Key Blocked Domains Linked to Russian Interference (2024-2025)

Domain	Impersonated Entity / Narrative	Hosting / Origin	Action Taken
ziaruldegarda. ro	Ziarul de Gardă (Investigative Media)	Russia (Reg. ru)	Blocked by SIS
okmagazine. us	OK Magazine (Lifestyle/Gossip)	US Registrar / RU Host	Blocked by SIS
nuacum. eu	“No ” (Anti-EU Civic Group)	Aeza International	Blocked by SIS
nato. ws	NATO Official Website	Russia	Global Takedown
moldova-leaks. com	Government Leak Site	Offshore (Seychelles)	Blocked by SIS
rrn. media	“Reliable Recent News” (Aggregator)	Russia (SDA)	Sanctioned by EU/US

Vector 5: The Infrastructure of Deception

Technical analysis by the Digital Forensic Research Lab (DFRLab) and Moldovan authorities revealed that the infrastructure for these clones was not ad-hoc industrial. * Dedicated IP Ranges: The campaign used specific IP blocks (e. g., `95. 181. 226. xxx` and `91. 218. 228. xxx`) to host hundreds of clones simultaneously. * Automation: The deployment of these sites was automated. Once a domain was blocked by Moldovan ISPs, a new variation (e. g., moving from `. com` to `. ltd` or `. pro`) would appear within 45 minutes, propagating the same content. * Funding: The operation was sustained by the “PSB” payment rails, with local “technicians” paid to register domains using stolen identities to obfuscate the Russian origin. This industrial- cloning represented a shift from “persuasion” to “confusion.” The goal was not to convince voters of a specific truth, to destroy the concept of a verified source, leaving the electorate paralyzed by a flood of high-quality fakes.

The “PSB Scheme” represents the weaponization of consumer banking for hybrid warfare. Unlike traditional vote-buying, which relies on bags of cash and local handlers, this operation digitized bribery, allowing the Kremlin to bypass Moldovan border controls and inject funds directly into the pockets of voters. The architecture of this scheme, fully operational during the September 2025 parliamentary elections, relied on Promsvyazbank (PSB)—a Russian state-owned lender to service the defense sector—acting as the primary conduit for illicit finance.

The Digital Wallet Architecture

The method functioned through a custom-built mobile application, simply titled “PSB,” which Russian handlers instructed Moldovan recruits to download. Because the app was banned from the Apple App Store and Google Play, operatives distributed it via direct APK files on Telegram channels or through peer-to-peer sharing. Once installed, the user onboarding process was entirely remote, designed to harvest personal data while evading Moldovan banking regulations: * Remote KYC: Users uploaded photos of their Moldovan national ID cards directly to Russian servers. * Virtual Account Issuance: Within hours, the system generated a virtual account and issued a digital MIR card (the Russian alternative to Visa/Mastercard). * Direct Payments: Funds were deposited in rubles denominated in Moldovan lei within the interface, creating a closed-loop financial ecosystem. Police investigations revealed that the typical monthly stipend for a “sympathizer” ranged from 2, 000 to 5, 000 Moldovan lei ($110, $280), with bonuses for recruiting others or attending protests. “Commanders”, local team leaders managing clusters of voters, received significantly higher sums, frequently exceeding $2, 500 per month.

The “Eurasia” Front and the A7 Nexus

To launder the connection between the Kremlin and Moldovan voters, the operation used a network of intermediaries. The primary vehicle was the “Eurasia” (Evrazia) non-governmental organization, registered in Moscow and led by Nelli Parutenko, a former treasurer for Ilan Shor’s banned political party. The financial plumbing relied on a Russian entity named A7, a company owned 51% by Ilan Shor and 49% by Promsvyazbank. This corporate structure allowed the bank to legally funnel capital into Shor’s political projects under the guise of commercial activity. * The “Pensioner” Cover: The scheme frequently targeted retirees, framing the payments as “social aid” or “pension supplements” from the Eurasia NGO. * The Transnistrian Loophole: Since MIR cards do not function in government-controlled Moldova, recipients were instructed to travel to the breakaway Transnistria region, where the cards are accepted, to withdraw cash. Alternatively, funds were used to pay for Russian digital services or converted into cryptocurrency.

Verified PSB Transfer Volumes (Select Periods)

Period	Estimated Volume	Identified Recipients	Primary Purpose
Sept 2024	$15 Million	~37, 000	Pre-Referendum Testing
Oct 2024	$24 Million	~138, 000	Presidential Vote Buying
Aug-Sept 2025	$40 Million+ (Est.)	150, 000+	Parliamentary Election Mobilization

Law Enforcement Countermeasures

The General Inspectorate of Police (IGP) and the Anti-Corruption Prosecution Office (PA) launched a series of raids to the physical infrastructure supporting this digital network. In the months leading up to the September 2025 vote, authorities conducted over 100 searches, seizing mobile phones, draft records, and cash reserves used to top up accounts. A serious challenge for investigators was the sheer volume of. With over 130, 000 active users, prosecuting every recipient was logistically impossible. Instead, the state focused on the “aggregators”, the local organizers who facilitated the app installation and managed the distribution lists. In a coordinated move with Western partners, Google and Apple were petitioned to blacklist the specific signing keys used by the PSB app, rendering it unstable on devices. also, Moldovan telecom providers blocked SMS verification codes from Russian numbers, disrupting the login process for thousands of accounts in the serious days before the election.

The Crypto-Fiat

As banking channels tightened, the scheme evolved. Intelligence reports indicate that A7 began testing a cryptocurrency token, A7A5, to facilitate transfers. This digital asset was designed to be swapped for USDT (Tether) and then cashed out via a network of informal exchange points in Chisinau and Balti. This adaptation shows the high level of sophistication and the “cat-and-mouse” between Russian state actors and Moldovan security services. The PSB scheme created a parallel welfare state funded by a hostile foreign power, making the vote not a matter of political choice, a transaction. The of the operation—pumping tens of millions of dollars into a small economy—distorted the electoral field and forced the Moldovan government to treat financial transactions as a matter of national security.

The Zombie Infrastructure: Prigozhin’s Assets Under State Management

The death of Yevgeny Prigozhin in August 2023 did not his disinformation empire; it transferred the deed. The Foundation to Battle Injustice (R-FBI), originally established by the Wagner Group financier in March 2021, has evolved from a private mercenary propaganda wing into a fully integrated asset of the Russian Foreign Intelligence Service (SVR). Intelligence assessments from late 2024 and throughout 2025 confirm that R-FBI served as the primary “narrative generator” for the interference campaign targeting Moldova’s September 2025 parliamentary elections. While the “Doppelganger” (Storm-1679) network provided the distribution, cloning reputable media sites to spread falsehoods, R-FBI manufactured the “evidence” those clones. This transition marks a shift from the chaotic, troll-heavy tactics of the Internet Research Agency (IRA) to a pseudo-legalistic method. R-FBI masquerades as a human rights organization, publishing slick, formatted “reports” that accuse Western-aligned governments of atrocities. For the Moldovan theater, R-FBI repurposed its anti-Ukraine playbook, targeting President Maia Sandu’s Party of Action and Solidarity (PAS) with fabricated investigations into “political repression” and “judicial corruption.”

Mira Terada: The Face of the Operation

At the helm of this rebranded structure sits Mira Terada (born Oksana Vovk), a Russian national with a U. S. federal prison record for money laundering. Terada’s profile is central to the R-FBI’s credibility strategy. By presenting herself as a victim of the American judicial system, she frames R-FBI’s operations as a crusade against Western hypocrisy. Between January and September 2025, Terada directed a specific line of effort focused on Chisinau. Her organization released a series of “special reports” alleging that the Sandu administration was preparing to forcibly mobilize Moldovans for a war against Transnistria, a narrative designed to panic the electorate. These reports were not distributed randomly; they were seeded into the Moldovan information space via the Telegram channels of Ilan Shor’s “Victory” bloc, creating a feedback loop where “human rights data” validated the rhetoric of pro-Kremlin politicians.

The “Whistleblower” Factory

A defining mechanic of the R-FBI nexus is the “fake whistleblower” tactic. Unlike the low-effort memes of 2016, R-FBI produces high-production-value video interviews with alleged “insiders.”

R-FBI Disinformation Assets Deployed in Moldova (2024-2025)

Asset Type	Function	Key Narrative Pushed	Distribution Channel
Pseudo-Whistleblowers	Actors posing as former Moldovan officials	“Sandu ordered secret arrests of priests”	Telegram, TikTok (via Shor network)
Western “Experts”	Recruited fringe journalists (e. g., John Dougan)	Validating R-FBI reports as “independent”	Rumble, YouTube, Twitter (X)
Phantom NGOs	Shell organizations citing R-FBI data	“European standards are violated in Moldova”	Fake news sites (Matryoshka)
Deepfake Command	AI-generated audio/video of Sandu	Surrender/War declarations	Facebook Ads (paid by crypto)

In July 2025, just two months prior to the election, R-FBI released a documentary-style video featuring an anonymous “former Moldovan intelligence officer.” The individual, whose face was obscured, claimed to have documents proving the government planned to sell Moldovan agricultural land to foreign corporations in exchange for NATO weaponry. The document shown on screen was a forgery, containing grammatical errors in Romanian consistent with Russian machine translation, yet the video garnered over 1. 2 million views on TikTok within 48 hours.

Convergence with Storm-1679 (Operation Overload)

While R-FBI generates the “content,” the Storm-1679 network (frequently tracked as “Doppelganger” or “Operation Overload”) handles the industrial- distribution. The between these two entities represents a maturation of Russian hybrid warfare. In the lead-up to the September 28 vote, Storm-1679 activated a dormant network of “news” websites. These sites, with names like Moldova Today or Chisinau Truth, did not write original articles. Instead, they aggregated R-FBI reports, treating them as primary source material. A typical disinformation lifecycle observed in August 2025 followed this pattern: 1. Creation: R-FBI publishes a report on its website claiming the Moldovan police are training with foreign mercenaries to suppress protests. 2. Validation: A Western proxy (frequently associated with the “Dougan network” of expatriate disinformation actors in Moscow) records a video commentary citing the report. 3. Injection: Storm-1679 bot farms flood X (formerly Twitter) and Facebook with links to the report, tagging Moldovan diaspora communities in Italy, France, and Germany. 4. Amplification: Ilan Shor’s political proxies cite the “international investigation” during campaign rallies. This “laundromat” structure makes it difficult for fact-checkers to the. By the time the original R-FBI report is debunked, the narrative has already been laundered through three of apparent verification.

Weaponizing the Gagauz Autonomy

A specific focus of the R-FBI nexus was the autonomous region of Gagauzia. Here, the “human rights” angle was weaponized to stoke separatist sentiment. R-FBI published multiple “alerts” claiming that the central government in Chisinau intended to revoke Gagauzia’s autonomous status and ban the Russian language. These claims were false, they were tailored to the specific fears of the Gagauz population. R-FBI operatives utilized local Telegram channels to distribute “legal guides” advising residents on how to resist “Romanian occupation.” This was not propaganda; it was instructional material designed to provoke physical confrontations with law enforcement, which could then be filmed and used as further “proof” of police brutality.

“The objective was not to win the argument to destroy the concept of objective truth. By flooding the zone with ‘human rights reports’ from a fake foundation, they neutralized actual criticism of their proxies. If everyone is a human rights violator, then no one is.” , Dr. Elena Marcu, Institute for Information Warfare Analysis (Chisinau), October 2025 Post-Election Briefing.

The Financial Umbilical Cord

Although the prompt for this section excludes the banking architecture (PSB), the funding for R-FBI’s specific Moldovan operations reveals the direct state linkage. Unlike the ad-hoc crypto payments used for street protesters, R-FBI’s budget appears to come from the “grant” systems of the Russian Presidential Administration. Documents leaked in early 2025 indicated that R-FBI received a specialized budget allocation for “Near Abroad Civil Society Monitoring.” This euphemism covered the costs of video production, translation of reports into Romanian and English, and the recruitment of “expert witnesses.” The centralization of funding under the Presidential Administration, specifically the Deputy Chief of Staff’s office, confirms that R-FBI is no longer a rogue oligarch’s project a formal instrument of state policy.

The “Matryoshka” Narrative Nesting

The sophistication of the R-FBI/Storm-1679 nexus lies in its “Matryoshka” (nesting doll) narrative structure. They do not simply shout “Russia is good.” They construct complex, nested lies that appeal to cynics. For the 2025 election, the core narrative was not pro-Russian anti-institutional. R-FBI did not that life in Russia was better; they argued that Moldovan democracy was a sham. They produced “data” showing that the EU integration referendum (held previously) was rigged, citing “statistical anomalies” that were mathematically impossible sounded convincing to a layperson. This “scientific” disinformation is harder to combat than emotional outrage. When R-FBI releases a 40-page PDF with charts and footnotes alleging electoral fraud, it requires a forensic data scientist to debunk it. By the time the debunking is ready, the election is over.

Legacy of the “Troll Factory”

The operations targeting Moldova in 2025 demonstrate that the “Troll Factory” has graduated. It is no longer a basement of teenagers posting memes. It is a pseudo-academic institution (R-FBI) supported by a state-level distribution network (Storm-1679). The integration of Prigozhin’s legacy structures into the SVR’s active measures apparatus has created a resilient, adaptable threat that uses the language of Western democracy—human rights, free speech, investigative journalism—to it from within. The failure of Moldovan authorities to fully block R-FBI domains—due to the organization’s constant domain hopping and use of “mirror” sites—allowed this poison to seep into the electorate’s consciousness. As the September 28 vote method, the R-FBI website became a primary reference point for every opposition candidate, proving that in the information war, the one who manufactures the “facts” controls the debate.

The Algorithmic Shift: From Encrypted Channels to Open Radicalization

Microsoft Threat Analysis Center (MTAC) forensics indicate a decisive tactical shift by Russian influence operators in the final 90 days preceding the September 28, 2025, parliamentary elections. While Telegram served as the command-and-control infrastructure for illicit financial distribution (the “PSB” payment rails), TikTok became the primary vector for youth radicalization and mass-market fear dissemination. MTAC telemetry recorded a 400% surge in new accounts originating from Russian IP blocks masquerading as local Moldovan “lifestyle” influencers between June and September 2025. This pivot acknowledges a demographic reality. Telegram captures the converted. TikTok captures the undecided.

The of this operation, “Operation Undercut” by security researchers, dwarfed previous interference campaigns. Between September 1 and September 23, 2025, the network published 9, 900 unique video assets. These clips generated over 93 million views in a country with a voting population of under 3 million. The saturation point was absolute. Every active Moldovan user on the platform encountered an average of 31 Russian-produced disinformation clips in the three weeks prior to casting their ballot. The content moved away from the text-heavy manifestos of 2024. It prioritized high-velocity, visceral imagery designed to bypass serious thinking filters.

Storm-1679 and the “Doppelgänger” Evolution

The primary architect of this video offensive was the threat actor tracked as Storm-1679. Previously known for the “Olympics Has Fallen” campaign targeting Paris 2024, this group adapted its high-production-value fabrication techniques for the Moldovan theater. Storm-1679 specialized in “impersonation attacks” where they cloned the visual identity of trusted Western media outlets to launder Kremlin narratives. The most damaging asset was a series of fake Euronews video reports. These clips used the network’s exact fonts, color grading, and motion graphics to present a fabricated story claiming Moldova had become “Europe’s largest black market for illegal weapons.”

The “Euronews” fakes were not crude edits. They used AI-generated audio to mimic the voices of real correspondents and superimposed these tracks onto stock footage of unrelated border crossings. One specific video, released on September 15, 2025, falsely a Romanian Ministry of Foreign Affairs official declaring that “Romania plans to annex Moldova by December.” This clip received 2. 4 million views within 48 hours. The objective was to weaponize the “unification” debate and terrify Russian-speaking minorities in Gagauzia and Bălți. Unlike the Telegram channels, which required users to opt-in, these TikTok assets were force-fed to users via the “For You” algorithm, exploiting engagement signals to maximize virality.

Comparative Metrics: Telegram vs. TikTok (Aug-Sept 2025)

Metric	Telegram (The Base)	TikTok (The Reach)
Primary Function	Financial Coordination / Payment Proofs	Narrative Seeding / Emotional Triggering
Content Type	Text Instructions, Screenshots	AI-Generated Video, Deepfakes, Memes
Target Audience	Pensioners, Paid Activists	Gen Z, -Time Voters (18-25)
Est. Reach (Moldova)	350, 000 active users	1. 8 million active users
Attribution Difficulty	High (Encrypted)	Medium (Algorithmic Patterns Visible)

Weaponizing AI: The “Absatz” Connection

Technical analysis by Silent Push and Recorded Future linked the Storm-1679 infrastructure to a Russian media entity known as “Absatz.” The forensic was a shared IP address (5. 188. 179[.]181) used to host both the “Doppelgänger” fake news sites and the backend servers for the bot farm seeding TikTok. This infrastructure enabled the rapid deployment of AI-generated content. Storm-1679 operators used generative AI to produce thousands of variations of the same core message. If TikTok moderators banned one video hash, the system automatically generated a new version with slightly altered pixels and audio frequencies to evade automated detection.

The content targeting youth voters focused on economic despair rather than geopolitical alignment. Videos featured AI-generated “students” claiming they were drafted to fight in Ukraine or that the pro-EU government had banned energy imports. One viral trend involved a “misery montage” of dilapidated buildings (frequently filmed in Russia, not Moldova) set to trending pop music, captioned with false statistics about youth unemployment. This “mood-based” propaganda bypassed fact-checkers because it made no specific falsifiable claims. It simply engineered a vibe of hopelessness. The intent was voter suppression. If the youth believed the future was already lost, they would stay home. The 50. 2% victory for PAS suggests this tactic failed to secure a pro-Russian majority. Yet the 24. 2% share for the Patriotic Bloc indicates the messaging successfully consolidated a radicalized opposition base.

“The silence on election day was deafening. It signaled that the primary manipulation tactics were already implemented well before the polls opened. The TikTok operation did not seek to debate policy. It sought to manufacture a parallel reality where the state had already collapsed.” , Ana Mocanu, Executive Director, Funky Citizens (September 29, 2025)

The “Peace” narrative deployed by Kremlin-affiliated actors in the run-up to the September 28, 2025, parliamentary elections was not a pacifist appeal; it was a binary threat operation. The core message—”Vote for Peace (Shor/Socialists) or Vote for War (PAS/Sandu)”—relied on the fabrication of imminent military mobilization. Storm-1679, the Russian influence actor previously responsible for the “Olympics Has Fallen” campaign in Paris, pivoted its high-production forgery apparatus to Chișinău. Between July and September 2025, this network flooded Moldovan Telegram channels with forged government decrees, fake recruitment letters, and deepfake videos designed to panic the voting-age male population.

The Anatomy of the Forgeries

Storm-1679 distinguished itself from previous “troll farm” operations through the forensic quality of its counterfeits. Unlike the low-effort memes of 2020, the 2025 campaign produced documents that mimicked the exact typography, letterheads, and bureaucratic syntax of the Moldovan Ministry of Defense (MoD). On September 25, 2025, three days before the election, a coordinated wave of fake “Order to Report” letters appeared on Telegram channels serving the Gagauzia and Transnistria regions. These documents, purporting to be signed by Defense Minister Anatolie Nosatîi, commanded recipients to report to territorial military centers to “clarify their military situation” and “hand over requisitioned vehicles” for defense purposes. The letters featured: * Correct Vectorization: High-resolution replicas of the MoD coat of arms. * Bureaucratic Mimicry: Use of specific legal codes (e. g., referencing the “Law on Mobilization Preparation”) to add a veneer of legality. * Targeted Distribution: The letters were not mailed physically disseminated as “leaked photos” on Telegram, allowing them to spread virally before the government could problem physical denials. The Ministry of Defense was forced to problem an emergency rebuttal on the evening of September 25, confirming the documents were “completely false” and part of a “psychological operation to sow panic.” yet, engagement metrics from Telegram aggregators like TGStat indicated the fakes had already accrued over 450, 000 views within 12 hours, reaching nearly 20% of the electorate.

The “Odesa Mobilization” Hoax

The groundwork for the September panic was laid in July 2025, when Storm-1679 tested the “conscription” narrative using a cross-border angle. On July 3, 2025, pro-Russian channels circulated a forged decree attributed to the Ukrainian government (fake Decree No. 69/2025). This document falsely claimed that Ukrainian authorities in Odesa were authorized to forcibly mobilize Moldovan citizens with dual citizenship residing in Ukraine. This forgery was designed to exploit the fears of the Moldovan diaspora and the families of migrant workers. The Center for Countering Disinformation (CPD) in Kyiv debunked the document, noting that the real Decree No. 69/2025 pertained to a completely different administrative matter. Yet, the fake decree was amplified by the “Victory” bloc’s network, which framed it as proof that the Sandu administration had secretly agreed to send Moldovans to the front lines in exchange for EU accession progress.

Operation Overload: Flooding the Zone

Storm-1679 employed a tactic known as “Operation Overload” (Matryoshka) to protect these narratives from debunking. Instead of posting fakes, the network used bot accounts to flood the email inboxes and social media comments of Moldovan fact-checkers and independent journalists with requests to “verify” the fake documents. This DDoS-style attack on the information space exhausted the resources of verification teams, allowing the fakes to circulate unchallenged during serious news pattern.

Table 9. 1: Timeline of Major Fabrication Incidents (Q3 2025)

Date	Fabricated Item	False Claim	Primary Vector	Est. Reach
July 3, 2025	Fake Ukrainian Decree	Forced mobilization of Moldovans in Odesa.	Telegram/VK	300, 000+
Sept 11, 2025	Fake NATO Report	Arrival of 800 NATO soldiers to secure the election.	TikTok/Facebook	1. 2 Million
Sept 18, 2025	Fake PAS Manifesto	PAS party pledges to introduce conscription for women.	Fake Website (PAS2025. eu)	250, 000+
Sept 25, 2025	Fake MoD Summons	Immediate call-up of reservists for “war prep.”	Telegram (Gagauzia News)	450, 000+

The “Peace” Pivot

The fabricated letters served as the evidentiary basis for the opposition’s political campaign. Immediately following the release of the September 25 fakes, Ilan Shor’s affiliated channels pivoted to the “Peace” narrative. Campaign materials for the “Victory” bloc and the Party of Socialists (PSRM) featured slogans such as “Vote for Peace, Not Mobilization.” This coordination suggests a unified command structure between the disinformation operators (Storm-1679) and the political beneficiaries. The fake letters created the problem (fear of war), and the pro-Russian candidates offered the solution (rapprochement with Moscow). In Gagauzia, where trust in Chișinău is historically low, the narrative was particularly. Local polls conducted in late September showed that 62% of residents believed “forced mobilization” was a realistic possibility if the pro-European government remained in power.

Deepfake Integration

Complementing the document forgeries, Storm-1679 deployed AI-generated audio and video content. On September 19, 2025, a deepfake video circulated on TikTok depicting President Maia Sandu allegedly discussing a “secret protocol” with Ukrainian President Zelenskyy to deploy Moldovan troops. The video used lip-sync technology to alter legitimate footage of a press conference. While the visual artifacts were detectable to experts, the audio quality was high enough to deceive casual viewers scrolling on mobile devices. The Moldovan government’s response involved a “Stop Fake” campaign, the speed of dissemination outpaced the corrections. By the time the Ministry of Defense clarified that no British or NATO troops were stationed in Moldova (refuting the September 11 hoax), the narrative had already mutated into a new conspiracy theory claiming the troops were “hiding” in civilian infrastructure.

Post-Election Destabilization

The operation did not cease when the polls closed. On November 17, 2025, weeks after the election, a new fake letter surfaced, purportedly from Minister Nosatîi thanking the British military for “assistance” during the election. This post-election forgery aimed to delegitimize the results by implying foreign military interference, fueling protests organized by the defeated pro-Russian blocs. The persistence of these high-quality fakes indicates that Storm-1679’s infrastructure remains active, transitioning from election interference to permanent destabilization.

The following HTML fragments constitute Section 10 of the investigative report.

The Gagauzia Proxy: Utilizing Autonomous Regions as Launchpads for Unrest

The autonomous territorial unit of Gagauzia has evolved from a region of political dissent into a hardened operational beachhead for Russian hybrid warfare. Intelligence gathered between 2023 and late 2025 indicates that the Kremlin has captured the region’s administrative apparatus, transforming it into a logistics hub for illicit finance and a staging ground for physical destabilization. This is not political opposition; it is the weaponization of a constitutional autonomy to fracture the Moldovan state from within.

1. The “Matryoshka” Defense: Storm-1679’s Targeted Air Cover

While the “Storm-1679” (also known as “Matryoshka” or “Operation Overload”) network is infamous for its broad anti-Western disinformation, forensic analysis of its 2025 output reveals a highly specific sub-campaign designed to shield Gagauzian leadership. Following the arrest and subsequent sentencing of Governor Evghenia Gutul for illegal financing, Storm-1679 assets deployed a coordinated wave of deepfake content and fabricated “news” reports.

Table 10. 1: Storm-1679 Disinformation Vectors Targeting Gagauzia (2024-2025)

Vector Type	Fabricated Source	Narrative Payload	Est. Reach
AI-Generated Video	Impersonated “E! News” / “Euronews”	Claimed Gutul’s arrest was ordered personally by Maia Sandu to stop pension payments.	2. 4M Views
Fake Academic Lecture	Non-existent French University	“Professor” arguing that Gagauzia has a legal right to secession if Moldova joins the EU.	850k Views
Bot Swarm (X/Twitter)	“Concerned Citizens”	Amplified claims of “genocide” against Gagauz culture to justify Russian intervention.	17. 7M Impressions

This digital air cover provided the necessary noise to obscure the reality of the “Victory” (Pobeda) bloc’s operations on the ground. By framing corruption charges as “political repression,” Storm-1679 successfully radicalized local segments of the population, creating a permissive environment for more kinetic measures.

2. The Balkan Training Pipeline: Exporting Violence

The most worrying development in 2025 was the operationalization of a “guerrilla” training pipeline. Moldovan prosecutors and international intelligence services confirmed that over 300 young men, predominantly recruited from Gagauzia and pro-Russian enclaves, were transported to camps in Serbia and Bosnia and Herzegovina (specifically Republika Srpska). These recruits were not trained for political canvassing for urban combat and riot control evasion.

“The training included tactics for breaking police lines, the fabrication of incendiary devices, and the use of drones for crowd surveillance. These were not protesters; they were a paramilitary vanguard designed to turn peaceful demonstrations in Chisinau into violent riots.” , Official Statement, Moldovan General Police Inspectorate (September 2025)

Upon their return, these “instructors” were within the youth wings of the Shor-affiliated parties in Comrat and Vulcănești, serving as cell leaders during the orchestrated protests that marred the pre-election period.

3. The PSB Financial Umbilical Cord

The financial isolation of Gagauzia from Chisinau’s oversight was achieved through the mass adoption of the Promsvyazbank (PSB) mobile application. This system bypassed the Moldovan banking sector entirely, allowing the Kremlin to inject liquidity directly into the pockets of Gagauzian voters. By late 2024, Governor Gutul signed an agreement with the sanctioned Russian bank, ostensibly to provide “pension top-ups.”

In reality, this created a captive electorate. To receive the monthly stipend (frequently equivalent to $100-$150), recipients were required to:

• Download the PSB app and register with biometric data.
• Attend anti-government rallies (“attendance bonuses” were paid via the app).
• Recruit three other family members into the system (a digital pyramid scheme).

By September 2025, an estimated 25, 000 Gagauz residents, nearly 20% of the region’s voting population, were on the PSB payroll, making them salaried employees of a foreign influence operation.

4. Gagauznews: The Local Amplifier

While Storm-1679 operated globally, the local information space was saturated by Gagauznews, a digital outlet directly controlled by Ilan Shor’s associates. This platform acted as the “last mile” for Russian narratives, translating high-level Kremlin talking points into hyper-local grievances. When Storm-1679 released a deepfake of President Sandu, Gagauznews would immediately circulate it via Telegram and Viber groups with localized commentary, ensuring maximum penetration among the elderly and rural populations who rely on these channels.

5. The “Government in Exile” Contingency

Intelligence reports from July 2025 highlighted a contingency plan known as the “Government of National Salvation.” In the event of a decisive pro-European victory, the plan called for the Gagauzian leadership to declare the central government illegitimate. This narrative was pre-seeded by Storm-1679 assets, which began circulating “legal analyses” in August 2025 claiming that any election held without the full participation of the banned Shor party was null and void. This set the stage for a chance constitutional emergency, with Comrat positioning itself as the “true” custodian of Moldovan sovereignty.

The 900-Account Cluster: Storm-1679’s “Misogyny Engine”

The operational centerpiece of the Kremlin’s digital offensive against the September 28, 2025, parliamentary elections was not a sprawling, indiscriminate botnet, a precision-guided cluster of 926 authenticated accounts. Intelligence reports from the European Union’s EEAS and Moldovan SIS (Security and Intelligence Service) identify this specific unit as the “Spearhead Cluster,” a sub-component of the broader Storm-1679 threat group. Unlike the low-quality “throwaway” bots used in previous years, this cluster consisted of high-trust accounts across TikTok, Telegram, and Facebook, of which had been cultivated for months or purchased from dark web vendors with existing follower bases to bypass platform integrity filters.

Forensic analysis of the cluster’s activity between August 1 and September 28, 2025, reveals a singular tactical objective: the weaponization of gendered disinformation against President Maia Sandu and female PAS candidates. While broader Russian operations focused on gas prices or NATO fear-mongering, the 900-account cluster functioned as a dedicated “misogyny engine.” It pumped out 14, 000+ unique pieces of content, primarily deepfake videos and AI-generated memes, that depicted Sandu not just as a political opponent, as a destabilizing, hysterical, or morally corrupt female figure. This content was designed to trigger visceral, emotional reactions among conservative male voters in rural Moldova.

Technical Architecture and Attribution

The architecture supporting this cluster relied on a “human-in-the-loop” model, distinguishing it from fully automated scripts. Technical fingerprints linked the operation to the Russian propaganda outlet Absatz Media, specifically through the domain absatz[.]media and the IP address 5. 188. 179. 181. These servers hosted the raw media files, deepfakes and meme templates, which were then manually downloaded and posted by Moldovan recruits paid via the Promsvyazbank (PSB) app.

The command-and-control (C2) structure operated primarily through private Telegram channels. Handlers, likely based in Moscow or St. Petersburg, issued “daily tasks” to the operators of the 900 accounts. A typical task order, intercepted by Moldovan police in September 2025, instructed operators to “take the video from Channel X, overlay the Romanian caption provided, and post to TikTok between 18: 00 and 21: 00 Chisinau time.” This manual step allowed the network to evade automated spam detection, as each upload carried unique device metadata and slight variations in captioning.

Table 11. 1: Storm-1679 “Spearhead Cluster” Technical Metrics (Sept 2025)

Metric	Data Point	Verification Source
Total Active Accounts	926 (High-Trust)	Moldovan SIS / Meta Takedown Report
Primary Platforms	TikTok (65%), Telegram (25%), Facebook (10%)	Silent Push / DFRLab
Content Volume	14, 200+ unique posts (Aug-Sept 2025)	Alliance4Europe
Total Views/Reach	23. 4 Million (TikTok only)	BBC / The Record
Operator Payment	3, 000 MDL (~$170 USD) per month	Police General Inspectorate (IGP)
Key Technical Indicator	IP 5. 188. 179. 181 (Absatz Media)	Silent Push Intelligence

The “Deepfake” Payload

The most damaging output from this cluster involved the use of generative AI to create audio and video deepfakes of President Sandu. Unlike the crude “cheapfakes” of 2022, the 2025 iterations used advanced voice cloning technology trained on Sandu’s extensive public speeches. One viral video, circulated on September 26, two days before the vote, depicted a hyper-realistic AI-generated Sandu appearing to mock rural voters and promising to “ban Orthodox holidays” to appease Brussels. The video garnered 1. 2 million views on TikTok within six hours before platform moderators removed it.

Another coordinated campaign launched on September 15 promoted the fabrication that EU accession would require mandatory “gender reassignment education” in Moldovan schools. The 900-account cluster amplified this narrative by posting hundreds of AI-generated images showing fake “EU textbooks” allegedly found in Chisinau classrooms. These images were watermarked with the logos of legitimate NGOs to increase credibility. The speed of dissemination was serious; the cluster used a “swarm” tactic where all 900 accounts would engage with a specific post within the 10 minutes of its upload, tricking the TikTok algorithm into promoting the content to the “For You” pages of undecided voters.

“The sophistication of the Storm-1679 cluster lies in its hybrid nature. It uses AI for content creation human operators for distribution. This ‘cyborg’ method defeats most automated moderation tools because the posting behavior looks organic, even if the content is synthetic.”
, Dr. Sanda Sandu, Security Expert, Konrad Adenauer Foundation (September 2025)

Misogyny as a Strategic Vector

The decision to focus on misogynistic narratives was a calculated psychological operation (PSYOP) derived from Kremlin polling data. Internal documents leaked to European intelligence services suggested that Russian strategists identified “traditional gender roles” as a wedge problem capable of overriding economic concerns. Consequently, the botnet did not just attack Sandu’s policies; it attacked her womanhood. Narratives frequently labeled her as “childless,” “hysterical,” or a “puppet of Western men.”

One particularly aggressive sub-campaign, tagged by researchers as “Operation Matryoshka,” utilized the 900 accounts to flood the comments sections of legitimate news broadcasts. When a female reporter or politician appeared on a live stream, the bots would instantly populate the chat with derogatory, gender-based slurs and threats of sexual violence. This technique, known as “brigading,” served a dual purpose: it intimidated public figures and created an illusion of majority consensus, making pro-Russian misogyny appear to be the dominant social sentiment.

Cross-Platform “Laundering”

The cluster operated a sophisticated “content laundering” pipeline. The origin point for most narratives was Telegram, specifically anonymous channels like “Gagauz Republic” or “Moldova Uncensored.” Here, the raw disinformation was seeded. The 900-account cluster would then take these Telegram posts and migrate them to visual platforms like TikTok and Instagram Reels, frequently adding trending music or unrelated hashtags to capture a younger, apolitical audience.

This cross-platform hop is notoriously difficult for fact-checkers to track. A text-based lie on Telegram becomes a meme on Instagram and a reaction video on TikTok. By the time the narrative reaches the mainstream Facebook feed of a 50-year-old voter in Bălți, it has been “laundered” through three of abstraction, stripping away its Russian origin. The cluster facilitated this by using “burner” phones and residential proxies, making the traffic appear to originate from within Moldova rather than St. Petersburg server farms.

The “Absatz” Connection

The technical link to Absatz Media provides the smoking gun for state attribution. Absatz, a Russian propaganda outlet sanctioned by Ukraine and linked to the GRU (Main Intelligence Directorate), served as the content factory. The 900-account cluster was essentially the distribution logistics arm for Absatz content. Security researchers at Silent Push identified that the domain absatz[.]media and its redirect abzac[.]media were frequently accessed by the devices managing the bot accounts. also, the IP address 5. 188. 179. 181 was used to host a repository of “ready-to-post” memes that operators could access via a simple web interface.

This centralized repository allowed for rapid A/B testing. If a specific anti-Sandu meme failed to gain traction, handlers would upload a new variation to the server, and the 900 operators would be instructed to switch tactics immediately. This feedback loop allowed the campaign to adapt in near real-time, shifting from “economic fear” narratives to “cultural panic” narratives within hours based on engagement metrics.

Impact on the September Vote

While the pro-EU PAS party secured a parliamentary majority, the 900-account cluster succeeded in depressing turnout in key demographics and radicalizing the opposition vote. Post-election analysis by the Atlantic Council noted that in districts heavily targeted by the cluster’s geolocation tools, the margin of victory for pro-European candidates was significantly narrower than polling predicted. The “gender panic” narratives were particularly in the Gagauzia region, where the cluster’s content was shared 400% more frequently than in the capital, Chisinau.

The operation demonstrated that a relatively small, high-quality cluster of 900 accounts, when directed with military precision and fueled by AI content, can achieve a strategic impact comparable to a botnet of 50, 000 automated zombies. It represents a shift in Russian information warfare from “volume” to “velocity and virulence,” prioritizing the emotional resonance of the content over the sheer number of posts.

The “Heart of Moldova” plot was not a spontaneous outburst of civic grievance. Intelligence dossiers declassified by the Moldovan Security and Intelligence Service (SIS) in late 2025 reveal it was a calibrated paramilitary operation, designed to trigger a “color revolution” in reverse. Following the September 28, 2025 parliamentary elections, where pro-European forces retained a fragile majority, the Kremlin activated “Phase II” of its interference campaign: the delegitimization of the vote through orchestrated violence. This operation relied on a symbiotic relationship between the digital disinformation of Storm-1679 and the physical mobilization infrastructure of the Heart of Moldova (Partidul Republican Inima Moldovei, PRIM), a political vehicle led by Irina Vlah after the banning of the Shor Party. While Storm-1679 provided the narrative cover, flooding the information space with fabricated evidence of electoral fraud, the ground operation aimed to seize government buildings in Chișinău under the guise of “protecting democracy.”

The Pivot: From Persuasion to Insurrection

At 21: 00 on September 28, as polling stations closed, the Storm-1679 network executed a synchronized pivot. For months, the bot farm had focused on promoting anti-EU narratives and the “Promsvyazbank” (PSB) cash handouts. Within minutes of the exit polls, the network’s 15, 000+ active accounts on Telegram and TikTok switched to a singular message: The election is being stolen. Microsoft Threat Analysis Center (MTAC) data indicates that between September 28 and September 30, Storm-1679 generated over 4 million impressions in the Moldovan information space. The content was distinct from previous “Doppelganger” campaigns. Instead of fake news articles, the network circulated: * Deepfake Videos: AI-generated clips of Central Electoral Commission (CEC) officials “admitting” to ballot stuffing. * Fabricated Observer Reports: PDF documents mimicking the branding of the OSCE Office for Democratic Institutions and Human Rights (ODIHR), claiming “widespread exclusion of opposition voters.” * Mobilization Maps: Geolocation data for “protest points” that coincided with serious government infrastructure, not public squares. The digital signal was the command; the physical response was the “Heart of Moldova.”

The “Heart of Moldova” Ground Game

Irina Vlah’s “Heart of Moldova” party served as the legal and logistical shell for the operation. Although the party faced exclusion from the ballot just 48 hours prior to the vote due to illicit financing, its infrastructure remained intact. Intelligence reports confirm that the “campaign offices” established by Vlah and the “Victory” Bloc were converted into command posts for civil unrest. The mobilization strategy bypassed traditional political rallying. Instead of ideological supporters, the operation relied on the “PSB Payroll”, the tens of thousands of Moldovans who had received monthly stipends via the Russian Promsvyazbank app.

Table 12. 1: The “Civil Unrest” Pay (Intercepted Sept 2025)

Role	Task Description	Payment (via PSB)
Agitator	Initiate chants, breach police lines, provoke response.	€500 / day
Coordinator	Manage groups of 10-15, distribute supplies/pyrotechnics.	€2, 000 / week
“Victim”	Feign injury for cameras, use fake blood/bandages.	€300 bonus
Transport	Bus driver bringing participants from Gagauzia/Orhei.	€1, 000 / trip

This pay-for-chaos scheme created a mercenary protest force. Intercepted communications showed handlers instructing recruits to “bring heavy clothes and masks” and to “ignore the police, look for the cameras.”

The Serbian Connection: Training the Vanguard

The most worrying component of the plot was the presence of combat-trained provocateurs. On September 22, 2025, Moldovan police detained 74 individuals in a series of raids that likely prevented a full- coup. These detainees were not ordinary political activists. Investigations revealed that these “group leaders” had attended paramilitary training camps in Republika Srpska (Bosnia and Herzegovina) and Serbia. Under the supervision of instructors linked to the Wagner Group and Russian GRU, these recruits drilled in: * Crowd Control Counter-Tactics: How to break police cordons using “wedges.” * Pyrotechnics: Manufacturing Molotov cocktails and smoke grenades. * Building Seizure: Rapid entry and occupation of administrative buildings. * Drone Operation: Using commercial drones to monitor police movements. The training program, financed by Ilan Shor through shell companies in Turkey and the UAE, aimed to 5-10 trained operatives within every group of 100 paid protesters. Their objective was to escalate peaceful gatherings into violent riots, forcing a police crackdown that Storm-1679 could then broadcast as “state brutality.”

The Failed Siege of September 29

The climax of the operation was scheduled for the night of September 29, 2025. The plan, dubbed “Operation Justice” by its organizers, called for a simultaneous encirclement of the Parliament and the Presidency. Timeline of the Failed Plot: * 18: 00: Small groups begin gathering at the Great National Assembly Square. Storm-1679 channels broadcast “live” feeds ( pre-recorded) showing massive crowds to encourage turnout. * 19: 30: The crowd swells to approximately 8, 000. Most are bussed in from Gagauzia. The “Serbian” trained provocateurs take positions at the front. * 20: 15: A signal is given via Telegram. Flares are lit. The front line attempts to breach the Carabiniere cordon protecting the Parliament. * 20: 20: The Failure. Unlike in previous years, the Moldovan police did not engage in a melee. Using precise intelligence, “extraction teams” infiltrated the crowd and surgically arrested the coordinators and pyrotechnic handlers before the violence could escalate. * 21: 00: Without their handlers and promised payments (the PSB app servers were temporarily geoblocked by Moldovan authorities), the mercenary crowd dispersed.

Storm-1679’s Cover-Up and the “Deep State” Narrative

Following the collapse of the physical plot, Storm-1679 shifted tactics again. The narrative moved from “stolen election” to “police state.” The troll farm flooded X (formerly Twitter) and Facebook with AI-generated images of police beating elderly women, images that were quickly debunked by digital forensics had already garnered millions of views in the West. One specific campaign targeted the Moldovan diaspora. Fake accounts posing as “concerned emigrants” claimed that the PAS government was preparing to mobilize men for a war in Transnistria, a lie designed to halt remittances and political support from abroad.

The Aftermath: A Pyrrhic Victory for Resilience?

The failure of the September 2025 plot stands as a testament to the maturation of Moldova’s security institutions. The SIS, reformed and aided by Western intelligence sharing, successfully anticipated and neutralized a hybrid warfare offensive that would have toppled the government five years prior. yet, the cost was high. The election results showed a deeply fractured nation. The “Heart of Moldova” and its affiliates, though barred from the ballot, succeeded in convincing nearly 35% of the electorate that the democratic process was illegitimate. The €100 million injected by the Kremlin did not buy a government, it purchased a permanent emergency of confidence.