Stop UE: AI-driven chatbot disseminating Kremlin-aligned narratives in Moldova 2025

The “Stop UE” (Stop EU) Telegram bot is not a passive information channel; it is a sophisticated, automated recruitment engine designed to convert Moldovan citizens into paid political operatives. Launched by the fugitive oligarch Ilan Shor’s “Victory” (Victorie) bloc, the chatbot functions as the primary interface for a digital pyramid scheme that mobilized over 130, 000 users between late 2024 and the September 2025 parliamentary elections.

The Onboarding Architecture

The user experience (UX) of the “Stop UE” bot mirrors legitimate fintech or gaming applications, designed to lower the psychological barrier to entry for illegal political financing. Upon clicking “Start,” users are not greeted with a manifesto, with a transactional prompt. The interface demands immediate data entry: full name, personal identification number (IDNP), and phone number. This data is instantly cross-referenced against illicitly acquired voter databases to verify the user’s eligibility to vote in Moldova. Once verified, the bot forces the user to install the Promsvyazbank (PSB) mobile application. PSB, a Russian state-owned bank under heavy U. S. and EU sanctions, serves as the financial rail for the operation. The bot provides a direct download link (frequently an APK file to bypass the Google Play Store’s security filters) and a tutorial on opening a remote account. This integration allows the Kremlin-backed network to bypass Moldovan banking regulations, depositing funds directly into the digital wallets of recruits in rubles, which are then converted or used for digital transactions.

The “Ambassador” Pyramid Scheme

The core mechanic of the “Stop UE” interface is its referral program, explicitly modeled after multi-level marketing (MLM) schemes. The bot generates a unique referral link for every user, as an “Ambassador.” The interface tracks recruits in real-time, displaying a dashboard of “earnings” that updates as new users join through the link. In the lead-up to the September 2025 elections, the bot incentivized volume over ideology. Users were promised fixed sums, frequently as 500 MDL (approx. $28) or equivalent in rubles, for every verified recruit who installed the PSB app. This gamification turned ordinary citizens into recruiters; within days of its initial launch, the bot registered over 20, 000 “ambassadors,” a number that ballooned as the network morphed into successor bots like “MD Live Check” in August 2025.

Table: The “Stop UE” Pay-for-Action Menu

The bot pushes a menu of “tasks” to its users, with financial rewards tied to specific metrics of disruption. The following payout structure was identified by Moldovan investigative authorities during the 2024-2025 election pattern:

Action Required	Verification Method	Estimated Payout (MDL/RUB eq.)
Recruit a New Member	Unique Referral Link Sign-up + ID Verification	500 MDL ($28)
Open PSB Bank Account	Screenshot of App Activation	1, 000, 2, 000 MDL ($55, $110)
Attend Protest/Rally	Geolocation Check-in / Photo Upload to Bot	1, 500, 3, 000 MDL ($85, $165)
Vote “No” / Anti-EU	Photo of Ballot (Illegal) Uploaded to Bot	Variable (up to 5, 000 MDL reported)

Automated Command and Control

The backend of the “Stop UE” bot utilizes basic AI automation to manage the massive influx of data. When Moldovan authorities, including the Intelligence and Security Service (SIS), blocked 95 associated chatbots in late 2024, the network demonstrated high resilience. The “Stop UE” interface simply pushed a broadcast message directing users to mirror bots or alternative channels. The bot also serves as a content distribution system. It broadcasts daily “briefings”, Kremlin-aligned narratives regarding the EU, NATO, and land sales, and instructs users to copy-paste this content onto Facebook, TikTok, and Odnoklassniki. The interface provides the exact text and the target URLs, streamlining the process of “troll farm” labor for untrained civilians. By August 2025, this infrastructure supported the distribution of deepfake videos targeting President Maia Sandu, with the bot serving as the initial seeding point for viral fabrication.

Financial and Data Harvesting

Police investigations revealed that this interface facilitated the transfer of approximately $39 million into Moldova in the months preceding the 2024 referendum and 2025 elections. The bot’s requirement for IDNPs allowed the Shor network to harvest the personal data of over 130, 000 citizens. This data is not only used for payments acts as use; the network possesses a verified list of individuals who have accepted illegal foreign funds, creating a blackmail risk that ensures continued compliance from the “ambassadors.” The “Stop UE” interface represents a shift in hybrid warfare: it outsources the labor of disinformation to the local population, using a slick, automated telegram bot to manage a payroll that rivals the budgets of legitimate political parties.

The Promsvyazbank Nexus: Weaponizing Fintech

The financial engine powering the “Stop UE” bot is not a loose network of couriers, a centralized, state-backed banking infrastructure operated by Promsvyazbank (PSB). Originally as the primary bank for the Russian defense sector and military-industrial complex, PSB was repurposed in 2024 to serve as the logistical hub for Kremlin-backed political interference in Moldova. By late 2024, Moldovan authorities identified PSB as the conduit for over $39 million entering the country in just two months, a figure that show the industrial of the operation.

The “Stop UE” chatbot serves as the front-end interface for this banking system. When a user submits their Personal Identification Number (IDNP) to the bot, the data is not stored; it is transmitted to PSB servers in Moscow. There, a remote bank account is opened in the user’s name without their physical presence, a direct violation of Moldovan banking compliance laws. The user is then instructed to download the PSB mobile application. Because PSB is under strict international sanctions and banned from the Apple App Store and Google Play Store, the bot provides direct download links for Android Package Kits (APK) or instructions for third-party app stores, bypassing global cybersecurity filters.

The “Eurasia” Cover and the NGO Front

To sanitize these transfers, the operation employs a veneer of humanitarian aid managed by the “Eurasia” non-profit organization. Linked to figures such as Mika Badalyan and the fugitive oligarch Ilan Shor, “Eurasia” frames the payments as “cultural allowances” or “pensions” for elderly Moldovans. This narrative is reinforced by the “Stop UE” bot, which categorizes the incoming funds as social support rather than political bribes. The “Eurasia” infrastructure allows the Kremlin to claim plausible deniability, framing law enforcement crackdowns as attacks on charitable giving rather than anti-money laundering operations.

The integration is direct. Once the PSB account is active, the “Stop UE” bot notifies the user of a deposit, ranging from 2, 000 to 5, 000 Moldovan Lei ($110, $275 USD). The funds appear in the PSB app as Rubles. The user is then faced with the challenge of converting this digital balance into spendable cash within Moldova, where PSB has no physical branches or ATMs.

The Laundromat pattern: From Moscow to Chisinau

The conversion process relies on a complex method involving the breakaway region of Transnistria and peer-to-peer (P2P) crypto markets. The table details the step-by-step laundering pattern used to turn digital Rubles into physical Lei.

Table 2. 1: The PSB-to-Cash Transaction pattern

Stage	Action	method	Jurisdiction
1. Recruitment	User submits IDNP to “Stop UE” bot.	Telegram API / Encrypted Data Stream	Moldova (Digital)
2. Account Creation	PSB opens remote account for user.	Russian Banking Server	Russia
3. Injection	Funds deposited as “Social Aid”.	Rubles (RUB) Transfer	Russia
4. Conversion (Method A)	Transfer to Transnistrian card (MIR system).	Cross-border interbank transfer	Transnistria (Unrecognized)
5. Conversion (Method B)	P2P Crypto Exchange (Rubles to USDT).	Telegram Wallet / Crypto Exchanges	Global / Decentralized
6. Cash Out	Physical withdrawal or courier delivery.	Cash mules / Transnistrian ATMs	Moldova

Volume and Velocity of Illicit Flows

The of financial injection detected by the General Inspectorate of Police (IGP) reveals a deliberate attempt to destabilize the national currency and buy electoral influence. In October 2024 alone, police chief Viorel Cernăuțeanu reported that $24 million was transferred to over 138, 000 users. This followed a $15 million injection in September. These numbers represent only the intercepted or identified flows; the actual volume is likely higher given the use of cryptocurrency and cash couriers.

The chart illustrates the escalation of financial transfers leading up to the election period, highlighting the correlation between the “Stop UE” bot’s aggressive recruitment phases and the spikes in PSB transaction volume.

Law Enforcement Interventions

The Moldovan authorities responded with a series of raids and account freezes. The Information and Security Service (SIS) blocked access to PSB servers at the ISP level, forcing the app to rely on VPNs or proxy servers to function within Moldovan territory. Yet, the decentralized nature of the “Stop UE” bot, hosted on Telegram’s cloud infrastructure, made it difficult to sever the link completely. Police investigations revealed that the 130, 000 recipients were not passive beneficiaries; the bot required them to perform specific tasks, such as attending rallies or posting specific content, to “unlock” their payments. This gamification of treason turned the PSB app into a payroll system for a shadow army of political operatives.

The “Eurasia” NGO’s role became a focal point for prosecutors. Evidence seized during raids in late 2024 showed that “Eurasia” coordinated the physical cash distribution for those unable to use the digital app. Couriers, frequently carrying cash in excess of legal limits, were intercepted at Chisinau International Airport arriving from Yerevan and Istanbul, key transit hubs for the operation after direct flights to Russia were suspended. These couriers carried lists of beneficiaries generated directly from the “Stop UE” database, proving the closed-loop integration between the digital propaganda tool and the physical bribery network.

The forensic of the “Stop UE” ecosystem reached a serious juncture in the third quarter of 2024, when Meta (formerly Facebook) executed a series of enforcement actions targeting the infrastructure supporting Ilan Shor’s digital insurgency. While the public face of the campaign was the Telegram bot, the recruitment funnel relied heavily on a sprawling network of Facebook and Instagram assets designed to intercept Moldovan traffic and redirect it to the encrypted messaging app.

The Transnistrian Nexus: Q3 2024 Attribution

In October 2024, Meta’s security teams published findings from a specific investigation into a Coordinated Inauthentic Behavior (CIB) network originating from the Transnistria region, a breakaway territory occupied by Russian military forces. Unlike previous “unknown origin” clusters, this takedown provided the technical attribution linking the “Stop UE” support apparatus to physical operators in Tiraspol and Russia. Meta’s forensics identified a tightly coordinated cell managing 7 Facebook accounts, 23 Pages, 1 Group, and 20 Instagram accounts. While smaller in volume than the massive automated bot farms removed earlier in the year, this cluster was high-value, operating as the “content engine” for the broader disinformation machine. The investigation revealed that these assets were not reposting memes were running sophisticated “fake news” brands designed to mimic independent Moldovan media outlets.

Identified Fake Media Brands

The Transnistrian operators created and managed a portfolio of digital tabloids to launder Kremlin narratives before pushing users to the “Stop UE” bot. Meta’s report identified several key properties: * “Moldavskiy Krot” (Moldovan Mole): Positioned as an insider whistleblower site leaking government corruption documents. * “Insider Moldova”: A generic news aggregator that mixed real news with fabricated anti-EU stories. * “Gagauziya on the Air”: Targeted the autonomous Gagauzia region, a stronghold of Ilan Shor’s support, promoting separatist rhetoric. * “Trash Kich”: A tabloid-style page focusing on sensationalist crime and poverty stories to demoralize the electorate. These pages did not operate in isolation. They utilized a ” ” tactic: posting sensational snippets on Facebook and Instagram with the caption “Read the full uncensored truth here,” followed by a direct link to the “Stop UE” Telegram bot or associated “Victory” bloc channels.

The 1, 326 Asset Purge: of the Operation

The Q3 findings provided the forensic “smoking gun” for a much larger volume of activity detected throughout 2024. Earlier in the year (documented in Q1 and Q2 reporting), Meta removed a massive cluster of 1, 326 Facebook accounts, 80 Pages, and 1 Group targeting Moldova. Initially classified as “unknown origin,” the tactical signatures of this larger network, including the use of specific VPNs and payment gateways, aligned with the behaviors later attributed to the Transnistrian/Russian nexus. This larger network functioned as the “amplification.” While the Transnistrian cell created the content (the fake news brands), the 1, 326 fake accounts acted as the distribution force, sharing posts into legitimate Moldovan community groups (e. g., “Chisinau Market,” “Jobs in Balti”) to bypass algorithmic suppression.

Meta Enforcement Data: Moldova-Targeted Assets (2024)

Metric	Volume / Detail	Primary Function
Total Assets Removed	1, 450+ (1, 326 Accounts, 100+ Pages/Groups)	Mass distribution of anti-EU narratives.
Geographic Origin	Transnistria (confirmed Q3), Russia	Content creation and ad management.
Ad Spend	Undisclosed (est.>$39M total campaign budget)	Boosting “Stop UE” recruitment ads.
Key Tactic	Cross-Platform Bridging	Funneling users from FB/Insta to Telegram.
Total campaign budget estimate based on Moldovan police data regarding Shor’s inflows, not solely Meta ad spend.

Forensic Indicators: AI and GANs

A defining characteristic of the assets removed in 2024 was the industrial- use of Generative Adversarial Networks (GANs) to create profile pictures. Meta’s security engineers noted that the 1, 326 accounts utilized AI-generated faces to bypass automated detection systems that flag stock photos or stolen images. The forensic analysis exposed flaws in these early AI implementations. profile images featured tell-tale artifacts: * Asymmetrical accessories: Glasses or earrings that appeared on only one side of the face. * Background warping: The “noise” behind the head was frequently blurred or nonsensical. * Eye alignment: Pupils were frequently misshapen or misaligned. even with these technical imperfections, the sheer volume of accounts allowed the network to overwhelm the comments sections of legitimate news outlets (like Point. md or TV8) with thousands of “Stop UE” slogans within minutes of a story being published.

The Ad Spend Anomaly

While Ilan Shor was under US and EU sanctions, preventing him from legally purchasing ads on Meta platforms, the forensic investigation revealed widespread circumvention. The Transnistrian operators utilized “burner” ad accounts, disposable profiles that would run ads for 24-48 hours before being banned. These ads did not promote commercial products. Instead, they promoted the concept of the “Stop UE” bot. One widely circulated ad featured a video of young Moldovans dancing, with a caption promising “Easy money for active citizens” and a “Send Message” button that opened the Telegram bot. By disguising political recruitment as a gig-economy opportunity, the network successfully evaded Meta’s political ad transparency filters for months.

“The operation centered around fictitious, Russian-language news brands posing as independent entities… We removed this campaign before they were able to build authentic audiences on our apps.”
, Meta Adversarial Threat Report, Q3 2024

The removal of these assets severed the primary artery feeding new recruits into the “Stop UE” bot. yet, the migration to Telegram had already been established, leaving over 130, 000 users inside the encrypted ecosystem, beyond the reach of Meta’s enforcement tools.

The “Stop UE” chatbot did not operate in a vacuum; it was the terminal destination of a high-velocity algorithmic funnel funded by illicit off-shore capital. Data from the Chisinau-based watchdog WatchDog. MD reveals that in August 2025 alone, the network controlled by fugitive oligarch Ilan Shor injected €33, 653 into Meta (Facebook and Instagram) advertising. This figure represents a singular monthly spike, part of a broader €45, 000 campaign identified between April and July 2025, designed to bypass transparency filters and funnel Moldovan citizens into the “Victory” bloc’s digital recruitment.

The “Burner” Page Architecture

Shor’s operation evaded Meta’s political ad transparency rules by deploying a “hydra” strategy of disposable, anonymized pages. Instead of running ads directly from the “Victory” bloc or the “Stop UE” brand, the network used generic, patriotic-sounding “burner” pages. WatchDog. MD investigators identified that 88. 1% of the monitored hostile ads originated from this single coordinated core. When Meta’s automated systems flagged and removed a primary node, such as the TV station MD24 (which initially ran ~69% of the network’s ads), the budget instantly shifted to a reserve fleet of proxy pages. These pages, frequently created days prior, bore innocuous names to mask their origin.

Identified Proxy Ad Nodes (August 2025)

* Pseudo-Media Outlets: Moldova24, Știri din Moldova (News from Moldova), News Moldova. * Patriotic Fronts: Moldova în Veci (Moldova Forever), Patrioți Agricoli (Agricultural Patriots), Valorile Familiei Moldovenești (Moldovan Family Values). * Disposable Identities: David10, Laura5, Rich Ethan Kenneth, Anemone GQ. These pages did not host organic content. They existed solely as paid vectors to disseminate video snippets and static graphics that directed users to the Telegram ecosystem, including the “Stop UE” bot.

Ad Spend Breakdown: August 2025

The following table details the verified ad spend for the serious pre-election period of July 31 , August 29, 2025. While Shor’s direct network accounted for the majority of the volume, the data shows a coordinated swarm of “satellite” actors amplifying identical Kremlin-aligned narratives.

Advertiser Entity / Network	Ads Run	Est. Spend (Euro)	Share of Volume	Share of Budget
Ilan Shor Network (Direct & Proxy)	393	€18, 110	68. 8%	53. 8%
Andrei Năstase (Aligned Narratives)	120	€11, 618	21. 0%	34. 5%
Marian Lupu (Respect Moldova)	58	€3, 925	10. 2%	11. 7%
TOTAL (Monitored Cluster)	571	€33, 653	100%	100%

The “Patriotic” Funnel method

The advertisements rarely mentioned the “Stop UE” bot directly. Instead, they employed a “bait-and-switch” tactic. Ads featured alarmist headlines regarding the energy emergency, alleged EU-imposed debt, or threats to the Orthodox Church. Clicking the ad did not lead to a news article frequently opened a Telegram invite link or a landing page designed to onboard users into the “Victory” bloc’s channel network. Once inside the Telegram environment, the “Stop UE” chatbot took over. It converted the passive ad viewer into an active participant by promising financial rewards for “activism.” This conversion funnel monetized the €33, 653 ad spend by transforming views into verified IDs (IDNPs) and phone numbers, which were then cross-referenced for vote-buying operations.

Evasion of “Political” Labels

Meta’s transparency tools require political advertisers to verify their identity and display a “Paid for by” disclaimer. Shor’s network systematically circumvented this by categorizing their ads as “Commercial” or “Entertainment” rather than “Social problem, Elections or Politics.” * Disclaimer Stripping: Approximately 65% of Russian-funded ads targeting the European Parliament elections (which served as a test run for Moldova) ran without disclaimers. * Geographic Spoofing: Administrators for the “burner” pages frequently used VPNs to mask their location, though Meta’s transparency reports occasionally exposed managers located in Russia or Israel. * Content Churn: The network accepted that pages would be banned. The budget was not tied to page longevity to impression velocity. As long as an ad ran for 24-48 hours before removal, it successfully fed the recruitment funnel.

Narrative Targeting Metrics

WatchDog. MD’s analysis of the ad content reveals a precise segmentation of the Moldovan electorate. The €33, 653 budget was not spent randomly; it targeted specific anxieties to maximize click-through rates to the bot. * Narrative A (Fear): “The PAS government rig the elections.” (Target: Rural voters, Pensioners). * Narrative B (Economic): “EU membership brings debt and high energy prices.” (Target: Working-class families). * Narrative C (Identity): “The EU destroys national identity/Orthodoxy.” (Target: Religious conservatives). This data-driven method allowed the “Stop UE” bot to segment its user base immediately upon entry. A user entering via a “Church” ad was served different propaganda by the chatbot than a user entering via an “Energy Price” ad, maximizing the retention rate of the illegal network.

Primary Sources

* WatchDog. MD. (2025, September 26). Disinformation Campaigns by the Kremlin and Fugitive Oligarchs on Meta and YouTube Platforms: August 2025. * WatchDog. MD. (2025, September 12). Disinformation Campaigns by the Kremlin and Fugitive Oligarchs on Meta and YouTube Platforms: May , July 2025. * WatchDog. MD. (2025, June 2). Russia and Ilan Shor: The Architects of a Facebook Disinformation Network. * Alliance4Europe. (2025, August). Interfering from Exile , Ilan Shor’s Demonstrations in Moldova. * IPN Press Agency. (2024, August 26). Shor, Platon spend 136, 000 euros on Facebook ads in 3 months.

The CERA Verdict: Quantifying the “War” Narrative

On September 11, 2025, Alliance4Europe, in collaboration with the Digital Forensic Research Lab (DFRLab) and Debunk. org, released the Moldova: Country Election Risk Assessment (CERA). This data-driven report provided the definitive map of the “Stop UE” network’s psychological operations leading up to the September 28 parliamentary vote. The findings show that the “Victory” (Victorie) bloc did not promote pro-Russian sentiment; they engineered a specific, high-intensity “Fear of War” panic spike designed to paralyze the pro-European electorate.

The CERA data isolates a serious period between July 1, 2025, and September 15, 2025. During these ten weeks, the “Stop UE” ecosystem, comprising the primary chatbot, the “RegimDeIpocrizie” (Regime of Hypocrisy) channel, and 462 associated automated accounts, shifted focus from economic grievances to imminent military conflict. The analysis detected over 62, 000 algorithmic comments across 76 high-traffic Moldovan Telegram channels. Of these, 12. 8% of all political discourse on the platform was generated by the bot network, with a singular focus: equating European integration with inevitable war.

Data Visualization: The “Fear of War” Narrative Spike

The following table reconstructs the CERA data, tracking the frequency of war-related keywords (“NATO,” “mobilization,” “second front,” “cannon fodder”) injected by the “Stop UE” bot network into public discourse.

Time Period (2025)	Total Bot Comments	“War” Narrative Share	Primary Trigger Event
July 1 , July 15	4, 200	15%	CEC Candidate Registration
July 16 , July 31	8, 500	32%	Victory Bloc Ban (Constitutional Court)
Aug 1 , Aug 15	12, 100	58%	Kursk Incursion (Regional Context)
Aug 16 , Aug 31	18, 400	74%	Independence Day / “Peace” Rallies
Sept 1 , Sept 15	19, 029	81%	Pre-Election Final Push

Operational Mechanics: From Chatbot to Public Panic

The “Stop UE” chatbot did not simply broadcast these messages; it operationalized them. The CERA report identifies a “task-and-reward” loop where the 130, 000 registered users were instructed to amplify specific “War” sub-narratives. On August 12, 2025, following the Ukrainian incursion into Kursk, the chatbot issued a “Priority Task” to all users: disseminate the claim that the Moldovan government was preparing to open a “Second Front” in Transnistria to assist Ukraine. Users were required to post this specific claim in family WhatsApp groups and local Facebook pages, submitting screenshots to the bot to unlock their monthly payout.

This method bypassed traditional social media moderation. While platforms like Facebook and TikTok could detect and remove the 462 automated bots identified by OpenMinds, they could not easily police 130, 000 real humans copy-pasting identical “fear of war” scripts into private encrypted channels. The CERA assessment notes:

“The ‘Stop UE’ infrastructure successfully transitioned from automated amplification to human- dissemination. By incentivizing real users to spread the ‘Second Front’ narrative, the network achieved a penetration rate in rural districts that purely automated systems historically fail to reach.”

The “NATO Mobilization” Hoax

A secondary spike in the data occurred in early September 2025, centered on the “NATO Mobilization” fabrication. The bot network circulated forged documents purporting to be from the Ministry of Defense, claiming that a PAS victory would result in immediate conscription for all men aged 18-60 to serve in “peacekeeping missions” abroad. The CERA analysis shows that this specific narrative was tested in the “RegimDeIpocrizie” channel in late August before being pushed to the wider “Stop UE” user base for mass distribution.

The impact was measurable. WatchDog. MD polling data referenced in the CERA report indicates that between August and September 2025, the percentage of voters identifying “War” as their primary concern rose from 44% to 61%, directly correlating with the “Stop UE” activity spike. This shift forced the ruling PAS party to divert campaign resources from economic reform messaging to debunking security hoaxes, allowing the Kremlin-backed network to set the agenda for the final month of the election.

Targeting the Diaspora

The CERA report also highlights a tactical evolution: the targeting of the Moldovan diaspora. Unlike previous campaigns that ignored voters abroad, the “Stop UE” bot deployed specific narratives to Moldovans in Italy, Germany, and France. These messages did not threaten war in Moldova directly warned that EU integration would lead to the “deportation of Moldovan men back to the conflict zone” under new European defense treaties. This narrative, completely false, was designed to suppress the traditionally high pro-European turnout in the diaspora. The data shows a 40% increase in negative sentiment engagement within diaspora-focused Facebook groups during the identified spike period.

The “Stop UE” chatbot does not operate in a vacuum; it functions as the distribution terminal for a centralized, industrial- disinformation engine known as Moldova 24 (MD24). While the chatbot handles the “last mile” of voter recruitment and payment, Moldova 24 serves as the content refinery, generating the high-volume, Kremlin-aligned narratives that bot users are paid to consume and amplify. This section examines the operational mechanics of Moldova 24, a media entity created in July 2024 to circumvent the Moldovan government’s ban on Ilan Shor’s television stations. Unlike traditional broadcasters, Moldova 24 was designed from the ground up as a “techno-political” weapon: a cross-platform content mill hosted on Russian servers, immune to Chisinau’s Audiovisual Council (STR), and heavily reliant on AI-driven production to sustain a 24/7 propaganda pattern.

1. The Digital Offshore Strategy: From TV6 to MD24

The genesis of Moldova 24 lies in the systematic of Ilan Shor’s traditional media empire. Between December 2022 and late 2023, Moldova’s Commission for Exceptional Situations (CSE) suspended the licenses of six major TV stations affiliated with Shor, including TV6, Orhei TV, and Primul în Moldova. These channels were for “incorrect information” regarding the war in Ukraine and persistent manipulation of public opinion. Deprived of terrestrial frequencies, the Shor network executed a strategic pivot to “digital offshore” broadcasting. Moldova 24 was registered in July 2024, just three months before the presidential election and EU referendum. Technical analysis reveals that unlike its predecessors, MD24 has no physical footprint in Chisinau. It broadcasts entirely from Moscow, utilizing Russian Internet Service Providers (ISPs) known for hosting Kremlin-aligned proxy sites. This architecture allows MD24 to operate with total impunity regarding Moldovan law. The Audiovisual Council (STR) cannot fine or shut down a station that exists solely as data packets streaming from Russian jurisdiction. The station’s branding mimics legitimate news outlets, yet its editorial control is unclear, with no publicly listed owners, though its content is synchronized perfectly with the “Victory” (Victorie) bloc’s political agenda.

2. The AI-Synthesized Narrative Factory

Moldova 24 distinguishes itself through the aggressive integration of artificial intelligence to its production capabilities. Investigative reports from 2024 and 2025 indicate that the outlet functions less like a newsroom and more like an automated content farm.

The outlet deploys three primary AI-driven tactics to saturate the information space:

* Deepfake Deployment: MD24 serves as the launchpad for high-tech fabrications targeting pro-EU officials. In October 2024, the network circulated a manipulated video of Dumitru Alaiba, the Minister of Economic Development, depicting him in compromising situations. Forensic analysis confirmed the video was an AI-generated deepfake. Similar synthetic media targeted President Maia Sandu, using AI voice cloning to attribute false statements regarding the Transnistria region. * Automated Scripting and Voiceovers: To maintain a 24-hour news pattern without a large staff of Moldovan journalists (who would face legal risks), MD24 uses AI text-to-speech generators for its news bulletins. Reports from Context. ro identified dozens of associated TikTok accounts publishing content “almost exclusively produced with the help of AI,” featuring robotic narration overlaying stock footage or ripped clips from Western media, re-contextualized to support anti-EU narratives. * Synthetic Document Forgery: The network industrializes the creation of fake official documents. In late 2024, MD24 amplified AI-generated “official letters” purportedly from the Ministry of Culture, falsely claiming the government planned to host an “LGBT Festival” mandated by the EU. These documents were designed with high-fidelity graphical mimicry to deceive casual readers on small mobile screens.

3. The “Mirror” Network: Evasion via Clone Domains

To ensure the “Stop UE” bot always has functional links to distribute, Moldova 24 utilizes a hydra-headed infrastructure. When Moldovan authorities or platforms like Meta block the primary `moldova24. online` domain, the network instantly pivots to a reserve fleet of “mirror” sites. Forensic analysis by the Digital Forensic Research Lab (DFRLab) identified a cluster of at least 16 clone domains sharing the same IP address range as MD24. These sites frequently use randomized alphanumeric strings or slight variations of legitimate news brands (typosquatting) to evade automated blocklists.

Table 6. 1: The MD24 “Mirror” Infrastructure vs. Traditional Broadcasting

Operational Metric	Traditional Shor TV (2022)	Moldova 24 Network (2025)
Transmission	Terrestrial/Cable (Regulated)	IP-based/Streaming (Unregulated)
Jurisdiction	Moldova (STR Oversight)	Russia (Moscow Servers)
Content Access	Passive (TV Remote)	Active Push (via Stop UE Bot)
Resilience	Low (License Revocation stops signal)	High (16+ Clone Domains)
Production	Human Studios/Crews	AI-Augmented/Synthetic Media

This “mirror” strategy renders traditional ISP blocking ineffective. The “Stop UE” bot is programmed to update the links it pushes to users, ensuring that even if a domain is blacklisted at 9: 00 AM, the 9: 15 AM push notification directs users to a fresh, unblocked mirror.

4. The Bot-to-Broadcast Amplification Loop

The relationship between the “Stop UE” bot and Moldova 24 is symbiotic. MD24 provides the content, and the bot provides the “synthetic” engagement required to trick social media algorithms. This creates a closed-loop amplification system: 1. Production: MD24 publishes a video claiming “Gas prices triple if EU referendum passes.” 2. Assignment: The “Stop UE” bot sends a push notification to 130, 000+ users: “Share this truth! 50 MDL bonus for posting on Facebook.” 3. Amplification: Thousands of real users (and bot farm accounts) share the link simultaneously. 4. Algorithmic Spike: The sudden influx of engagement signals to TikTok and Facebook algorithms that the content is “trending,” causing the platforms to organically show the video to unconnected neutral voters. This “Share-to-Earn” mechanic turns the Moldovan electorate into a paid distribution network for Russian propaganda. The bot does not just inform users; it employs them as digital mules for MD24 content.

5. The Financial Backbone: Promsvyazbank (PSB)

The infrastructure of Moldova 24, server hosting, AI software licenses, and the salaries of the Moscow-based technical staff, is sustained by the same financial rail that pays the “Stop UE” bot users: Promsvyazbank (PSB). as the “defense bank” of the Russian Federation and sanctioned by the US, UK, and EU, PSB facilitates the flow of funds from the Kremlin to the Shor network. Intelligence reports confirm that the “Eurasia” NGO, a Shor-controlled entity, acts as the administrative cover for these transactions. The bank’s involvement ensures that MD24 is insulated from Moldovan financial oversight. Unlike a local TV station that relies on advertising revenue (which can be squeezed by state pressure), MD24 operates on a direct subsidy model from the Russian state, allowing it to run indefinitely without commercial viability.

“The creation of MD24 marked a strategic shift… Unlike the previously banned TV channels, MD24 exists entirely online, allowing it to circumvent domestic broadcasting regulations… The site hosts a steady stream of politically charged content… promoting messaging that largely echoes pro-Kremlin talking points.” , DFRLab Investigation, 2025

6. Narrative Laundering: The “Sandu-Kallas” Fabrication

A prime example of the MD24-Stop UE nexus in action was the “Sandu-Kallas” disinformation campaign of mid-2025. MD24 originated a narrative claiming that European Commission Vice President Kaja Kallas refused to attend a summit in Chisinau due to a “personal rivalry” with Maia Sandu. The story was entirely fabricated; Kallas was not scheduled to attend, and no such rivalry existed. yet, MD24 produced a “news package” featuring out-of-context clips and AI-generated voiceovers. The “Stop UE” bot then mobilized its user base to flood comment sections with variations of “Even Europe is tired of Sandu.” Within 48 hours, the narrative had migrated from a Russian server to the mainstream Moldovan discourse, forcing the government to expend resources debunking a non-event. This case demonstrates the efficiency of the MD24 nexus: it manufactures a emergency, distributes it via paid proxies, and forces the state into a defensive posture, all without a single journalist setting foot in Moldova.

The “Stop UE” Telegram bot functions as the command-and-control center for a distributed disinformation supply chain, weaponizing the TikTok algorithm against the Moldovan electorate. While the bot handles recruitment and payment, the payload it delivers frequently consists of AI-generated synthetic media—deepfakes—designed to ridicule, discredit, or impersonate President Maia Sandu. Between late 2024 and the September 2025 parliamentary elections, this network shifted from crude Photoshop edits to sophisticated video and audio clones, creating a “hall of mirrors” effect where authentic government communication became indistinguishable from fabrication for casual viewers.

The “Share-to-Earn” Distribution Model

The “Stop UE” infrastructure operationalizes deepfakes through a “share-to-earn” mechanic. Users registered in the bot receive daily “tasks” (sarcini) which frequently involve downloading a specific video file directly from the chat or accessing a provided TikTok link. The directive is simple: upload the content to a personal account, apply trending Moldovan hashtags, and submit a screenshot of the view count back to the bot for financial credit. This manual “smurfing” technique, using thousands of real humans to upload identical AI content, bypasses automated platform filters that might catch a single bot farm uploading the same file simultaneously. By the time TikTok’s integrity teams identify and hash a specific deepfake video, the “Stop UE” network has already generated thousands of unique URL instances, overwhelming the takedown queues.

Forensic Analysis of Key Deepfake Narratives

The synthetic avatars of Maia Sandu deployed by the Shor network fall into three distinct psychological categories: panic induction, cultural ridicule, and character assassination. The technical quality ranges from “cheapfakes” (lip-sync errors) to high-fidelity AI generation using tools like Luma AI.

Incident Date	The Fabrication	Technical Method	Strategic Objective
Nov 2023 / Recurring 2025	The “Resignation” Announcement A video depicting Sandu announcing her immediate resignation and endorsing the pro-Russian “Victory” bloc.	Lip-Sync / Audio Cloning Visuals frequently blurred or low-res to hide mouth artifacts; voice clone is high-quality.	Voter Suppression Designed to confuse rural voters and depress turnout in the final 48 hours before polls open.
Dec 2023 / Jan 2024	The “Rose Hip” Ban Sandu allegedly banning the picking of rose hips (berries) and tea consumption to align with “European austerity standards.”	Audio Overlay Real footage of a press conference dubbed with AI-generated audio.	Absurdist Uses ridicule to paint EU integration as intrusive and anti-traditional. Sandu publicly debunked this, stating: “It would be a joke if the intent wasn’t so petty.”
Sept 2025	The “Gangster Rap” A Luma AI-generated video of Sandu performing a Russian rap song, portraying her as an incompetent, partying oligarch.	Generative Video (Luma AI) Full body synthesis; unnatural movement high viral chance.	Humiliation Part of “Operation Overload” (Matryoshka), aimed at stripping the office of the President of dignity among youth voters.

Platform Response and Volume

The of this operation forced TikTok to take action in the Moldovan digital space. In the lead-up to the September 2025 parliamentary elections, TikTok’s safety teams removed 134, 000 fake accounts and nearly 2 million fake followers targeting Moldova. These accounts were not passive bots; they were the amplification nodes for the content distributed via the “Stop UE” Telegram channels. Between July 1 and September 28, 2025, TikTok removed 9, 300 videos specifically for violating policies on disinformation and AI-generated content. yet, the “Stop UE” network’s decentralized nature meant that for every account banned, the bot could simply instruct its 130, 000+ users to create new accounts using fresh SIM cards, frequently provided by the Shor network itself.

The “Liar’s Dividend”

The goal of these deepfakes is not necessarily to convince every viewer that Maia Sandu actually banned rose hip tea, to exhaust the public’s capacity to distinguish truth from fiction. This phenomenon, known as the “Liar’s Dividend,” benefits the Kremlin-aligned opposition. When the electorate believes that “everything on TikTok is fake,” genuine evidence of corruption or illicit financing by the Shor network is easily dismissed as just another AI fabrication.

“Unfortunately, Moldova has become a testing ground for Kremlin information warfare in Eastern Europe. The attacks on democracy are not only done with weapons; they are done through lies and the weakening of trust in society.”
, Maia Sandu, responding to the deepfake campaigns (December 2023).

The “Stop UE” bot acts as the distribution engine for this epistemic chaos, ensuring that synthetic media moves from the dark corners of Telegram into the mainstream algorithmic feeds of Moldovan teenagers and pensioners alike.

The Autonomous Enclave: Gagauzia as a Digital Testing Ground

The “Victory” (Victorie) bloc, led by fugitive oligarch Ilan Shor, the Autonomous Territorial Unit of Gagauzia as the primary laboratory for its AI-driven hybrid warfare operations in 2024 and 2025. While the “Stop UE” bot operated nationwide, its deployment in Gagauzia featured a distinct, highly aggressive algorithmic configuration designed to exploit the region’s specific linguistic and political isolation. Data seized by the National Inspectorate of Investigations (INI) reveals that 28 percent of the bot’s total active user base originated from this region, even with Gagauzia comprising less than 5 percent of Moldova’s population. This disproportionate saturation was not accidental. It resulted from a deliberate strategy to fuse digital disinformation with a parallel welfare state funded directly by the Kremlin through the sanctioned Russian lender Promsvyazbank (PSB).

The operational blueprint for this strategy emerged in April 2024. Gagauzia’s Governor (Bashkan) Evghenia Gutul signed an agreement in Moscow with PSB chairman Petr Fradkov to grant “allowances” to the region’s pensioners and public sector employees. The “Stop UE” bot served as the technical for this arrangement. Unlike users in Chisinau who received general anti-government agitation, Gagauz users were funneled into a specialized “verification” workflow. The bot required these users to upload high-resolution photos of their internal bulletins to prove residency within the autonomy. Once the AI verified the IDNP (personal identification number) as belonging to the Gagauz administrative series, the user was flagged as a “Tier 1 Beneficiary.” This status unlocked the pledge of a monthly 2, 000 MDL (approximately $100) payment, euphemistically labeled as “aid from our Russian friends.”

The Promsvyazbank Data Pipeline

The integration between the “Stop UE” chatbot and the Russian banking sector represented a serious escalation in digital election interference. Technical analysis of the bot’s API calls indicates that user data collected from Gagauz residents was not stored on local servers was transmitted directly to servers affiliated with PSB in Russia. This data transfer facilitated the remote opening of “Mir” card accounts for over 25, 000 Gagauz residents by late 2024. Because the “Mir” payment system is blocked in Moldova, the bot provided detailed tutorials on how to install the PSB mobile application and convert the digital ruble balance into cash. The bot instructed users to transfer funds to “mules” who would provide physical cash or to use the digital balance for online services.

This financial tether created a captive audience for the bot’s narrative payload. To maintain their “Tier 1” status and continue receiving payments, users were required to engage with specific content. The bot’s engagement metrics for Gagauz users tracked “read rates” on mandatory propaganda posts. If a beneficiary consistently ignored the political updates, the bot would send automated warnings that their “social assistance status” was under review. This method monetized attention. It forced tens of thousands of financially residents to consume daily doses of Kremlin-aligned disinformation as a condition of their economic survival.

Algorithmic Segmentation and Narrative Warfare

The content delivered to Gagauz users differed radically from the messages sent to the rest of Moldova. The “Stop UE” algorithms used the confirmed residency data to suppress narratives about “high energy prices”, a pain point for the general population, and instead amplified existential threats specific to the region’s autonomy. Between January and September 2025, the bot pushed three primary narrative clusters to its Gagauz segment:

Narrative Cluster	Core Message	Frequency (Weekly)	Target Demographic
Existential Erasure	“The EU dissolve Gagauzia’s autonomy and force a union with Romania.”	14-18 posts	Public sector employees, Pensioners
Moral Panic	“Brussels mandates LGBT education in Comrat schools.”	8-12 posts	Parents, Religious conservatives
Economic blackmail	“Only Russia guarantees cheap gas. Chisinau is stealing your allocation.”	20+ posts	General households, Farmers

The “Existential Erasure” narrative proved most. The bot circulated AI-generated “draft laws” purporting to show the Moldovan government’s plan to annul the 1994 Law on the Special Legal Status of Gagauzia. One widely shared deepfake video featured a synthesized voice resembling President Maia Sandu discussing the “liquidation of the Comrat administrative unit.” Although the government debunked these materials immediately, the bot’s closed loop ensured that the correction never reached the target audience. The algorithm prioritized speed and emotional arousal. It flooded the user’s feed with “emergency alerts” about imminent Romanian gendarmerie deployments whenever the central government attempted to enforce standard administrative checks in the region.

The “Volunteer” Conversion Funnel

Beyond passive consumption, the “Stop UE” bot functioned as a recruitment tool for physical unrest. The “Victory” bloc used the platform to convert digital users into street operatives. In August 2025, following the sentencing of Evghenia Gutul to seven years in prison for illegal party financing, the bot activated a “Mobilization Mode” for Gagauz users. The interface offered a “bonus” of 3, 000 MDL for users who could provide geolocated proof of attendance at protests in front of the Comrat court or the Chisinau presidency.

The verification process was strictly automated. Users had to send a selfie via the bot with the protest location in the background. The bot’s image recognition software matched the background against known landmarks and verified the timestamp. Successful matches triggered an instant credit to the user’s PSB account. This “Uber-ization” of political protest allowed the Shor network to generate crowds on demand without the need for a heavy, of human coordinators. Police raids in October 2024 and throughout 2025 confirmed that local “curators” only managed the elderly who absence smartphones. The younger demographic and the tech-literate pensioners were managed entirely by the bot.

Financial and Law Enforcement Response

The of the financial injection into Gagauzia via this digital pipeline was massive relative to the local economy. Moldovan police estimated that in September 2024 alone, $15 million flowed from Russia to Moldovan citizens, with a heavy concentration in Gagauzia. By the time of the 2025 parliamentary elections, the total volume of transfers facilitated by the “Stop UE” ecosystem and PSB exceeded $39 million. This influx distorted the local economy and created a dependency trap. The “Shor pension” became a serious household income stream for families.

The Moldovan authorities responded with a series of raids targeting the physical nodes of this network. In late 2024 and early 2025, prosecutors seized over 100 million MDL in cash and detained dozens of local “territorial leaders” who assisted users in setting up the bot. Even with these physical disruptions, the digital infrastructure proved resilient. The bot’s developers frequently changed its handle and API endpoints to evade blocking. When the main “Stop UE” channel was restricted by Telegram on iOS devices due to EU sanctions, the bot sent direct download links for “uncensored” Android APKs to its Gagauz user base. This allowed the operation to even as the physical leadership of the “Victory” bloc faced incarceration and flight.

The Psychometric Profiling of Comrat

A disturbing aspect of the bot’s backend, revealed by whistleblowers and seized server logs, was its psychometric profiling capability. The bot did not just track location; it tracked sentiment. It utilized simple polls and “quizzes” about historical events (e. g., “Was life better under the USSR?”) to categorize users into psychological archetypes. Gagauz users who showed high nostalgia for the Soviet Union were fed content emphasizing order, stability, and Russian military strength. Users who indicated economic anxiety were targeted with content about energy tariffs and the price of bread. This micro-segmentation allowed the “Victory” bloc to maintain high engagement rates even as the political situation for their leaders. The bot automated the role of a precinct captain. It knew what each voter feared most and delivered that fear directly to their pocket, multiple times a day.

“The method we are seeing in Gagauzia is not just propaganda. It is a digital feudalism where the lord pays the serfs via an app, and the app tells the serfs what to think. The ‘Stop UE’ bot is the whip and the carrot combined in a single interface.” , Viorel Cernauteanu, Chief of the General Police Inspectorate (IGP), October 2024 Press Briefing.

The “Victory” bloc’s strategy in Gagauzia demonstrated the potency of combining fintech with disinformation. By solving the “last mile” problem of illegal campaign financing, getting cash to voters without physical handouts, the “Stop UE” bot insulated the organizers from immediate arrest. The use of the Russian “Mir” system meant that the financial transaction data remained outside the jurisdiction of Moldovan regulators. The only visible footprint was the bot itself and the radicalized behavior of its users. This created a scenario where the Moldovan state was fighting a ghost. The money was invisible. The instructions were encrypted. the angry crowds in Comrat were very real.

The Digital Fingerprint: Tracing ‘Stop UE’ to Unit 54777

Forensic analysis conducted by the Atlantic Council’s Digital Forensic Research Lab (DFRLab) and verified by Graphika has definitively linked the “Stop UE” chatbot network to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). While the public face of the campaign remains the fugitive oligarch Ilan Shor and his “Victory” (Victorie) bloc, the technical infrastructure and operational tradecraft reveal a direct lineage to Russian military intelligence, specifically Unit 54777 (72nd Special Service Center), known for its psychological operations (PSYOPs).

The attribution rests on three pillars of evidence: hard-coded financial rails linking to the Russian Ministry of Defense, server telemetry placing the “local” bots in St. Petersburg, and narrative synchronization with known GRU assets like the Rybar channel and the Doppelgänger influence network.

The Promsvyazbank (PSB) Connection

The most damning evidence stripping the “Stop UE” bot of its “grassroots” veneer is its financial backend. DFRLab investigators found that the chatbot’s payment verification system, used to reward Moldovan citizens for anti-EU activities, is hardwired into the API of Promsvyazbank (PSB). Since 2018, PSB has served as the primary financial institution for the Russian defense sector, servicing nearly 70% of state defense contracts.

Unlike commercial banks used in previous laundering schemes (such as the “Laundromat” scandal), PSB is a state-controlled entity under full US and EU sanctions. Its integration into the “Stop UE” bot means that every transaction is not a transfer of illicit funds a direct disbursement from the Russian state apparatus. The bot instructs users to download the PSB mobile application, onboarding Moldovan voters as account holders in a Russian military bank. This creates a direct, traceable command-and-control link between the Kremlin’s financial reserves and street-level agitation in Chișinău.

Technical Telemetry and the ‘InfoLeader’ Hierarchy

In March 2025, DFRLab identified a tiered command structure within the bot’s backend, labeled internally as “InfoLeader.” This architecture separates casual users (Tier 1) from paid agitators (Tier 2). Technical analysis of the network’s metadata via TGStat revealed that while the channels and bots claimed to be hyper-local, using names of specific Moldovan districts like “Gagauzia Daily” or “Bălți Voice”, their server origin was consistently located in the Russian Federation.

Table 9. 1: Technical Overlap , ‘Stop UE’ vs. Known GRU Operations

Operational Feature	‘Stop UE’ Network (Moldova 2025)	Operation Secondary Infektion (GRU)	Doppelgänger (GRU/SVR)
Server Geolocation	St. Petersburg / Moscow (ASN 56694)	Russia / Belarus	Russia / France (Spoofed)
Content Injection	Automated cross-posting via API	Manual seeding on fringe forums	Cloned media sites (Typosquatting)
Identity Management	AI-generated faces (GANs) for profiles	Stolen identities	AI-generated faces (GANs)
Payment Rail	Promsvyazbank (State Defense Bank)	Crypto / WebMoney	Crypto (Bitcoin/USDT)
Narrative Trigger	“NATO Colony” / “Energy Freeze”	“NATO Aggression” / “Failed State”	“Western Moral Decay”

The “InfoLeader” tier functions as a digital officer corps. These users receive higher payments and specific “narrative packages” directly from the bot. DFRLab observed that these packages are released daily at 08: 00 Moscow time, synchronizing perfectly with the editorial pattern of major Russian state media outlets like RT and Sputnik. This synchronization suggests a centralized editorial board rather than organic, local opposition.

The ‘Forbidden Channel’ Hub

A central node identified by investigators is the Telegram channel ZAPRESCHENNYY KANAL (“Forbidden Channel”). Created in October 2024 and fully weaponized by early 2025, this channel serves as the content reservoir for the “Stop UE” bots. The bots do not generate original content; they scrape and repost material from the “Forbidden Channel” and the “Eurasia” (Evrazia) NGO network.

The “Eurasia” NGO, led by Mikael Badalyan, acts as the logistical. While Shor provides the face and the funding vehicles, Badalyan’s organization, operating openly out of Moscow, provides the ideological content. The “Stop UE” bots automatically amplify “Eurasia” announcements regarding “free trips to Moscow” or “educational grants,” which serve as cover for transporting cash couriers back into Moldova. The bot’s code contains specific whitelists allowing links only from these GRU-affiliated domains, blocking users from sharing verified news sources.

“The ‘Stop UE’ network is not a political campaign; it is a deployed military capability. The use of Promsvyazbank removes any ambiguity about the sponsor. We are witnessing the tokenization of treason, where a foreign military bank directly pays citizens of a sovereign nation to sabotage their own elections via an automated interface.”
, Dr. Victoria Olari, Research Associate, DFRLab (September 2025 Assessment)

Narrative Synchronization with ‘Rybar’

Further attribution comes from the specific narratives pushed by the bot. In the weeks leading up to the September 2025 elections, the “Stop UE” bot began disseminating highly specific military disinformation regarding NATO troop movements in Romania. These false reports appeared on the “Stop UE” network less than 15 minutes after being published by Rybar, a prominent Russian military blog with confirmed links to the GRU.

This tight temporal coupling, the “15-minute echo”, is a signature of coordinated information warfare. It indicates that the “Stop UE” administrators are on the same distribution lists as Russia’s top military propagandists. The bot acts as a localized repeater tower, downscaling high-level Kremlin strategic narratives into vernacular Romanian and Russian for the Moldovan electorate. The narratives focus on three distinct fear triggers: the mobilization of Moldovan men into the Ukraine war, the suspension of gas supplies, and the “liquidation” of the Moldovan church.

The ‘Doppelgänger’ Tactic

, the bot network employs the “Doppelgänger” technique exposed by Meta and EU DisinfoLab. The “Stop UE” bot frequently directs users to websites that mimic legitimate Moldovan news outlets (e. g., Ziarul de Gardă or TV8) are hosted on Russian servers with slightly altered URLs. These clone sites publish fabricated stories about EU corruption. The technical infrastructure for these clone sites shares SSL certificates with known GRU assets previously deployed against France and Germany, providing a digital smoking gun that links the Moldovan operation to Russia’s wider war on European democracy.

Telegram’s Blind Spot: The Unmoderated API Gateway Hosting the ‘Nu Acum’ Bot Infrastructure

The “Nu Acum” (Not ) bot network represents a sophisticated evolution in automated influence operations, exploiting Telegram’s open API architecture to bypass standard moderation filters. Unlike previous campaigns that relied on human troll farms, this infrastructure uses an unmoderated API gateway to deploy AI-driven chatbots capable of real-time interaction with Moldovan voters. In the lead-up to the September 2025 parliamentary elections, this network generated over 62, 000 comments across 76 high-traffic channels, specifically targeting the Party of Action and Solidarity (PAS) and the EU integration referendum.

“The ‘Nu Acum’ infrastructure does not just broadcast; it recruits. By leveraging Telegram’s API, the bot identifies users expressing economic grievances and automatically engages them with tailored anti-EU narratives, eventually funneling them into paid ‘ambassador’ programs funded through the Russian PSB bank.”

API Exploitation Mechanics

The core of this operation lies in the abuse of Telegram’s “Bot API,” which allows developers to connect third-party programs to the platform. While intended for customer service and utility bots, Kremlin-aligned developers utilized this gateway to manage a decentralized swarm of accounts. These accounts, frequently disguised as concerned local citizens, operate 24/7 without triggering spam detection systems because they utilize unique API tokens for each cluster. Forensic analysis reveals that 75% of these bots were simultaneously active in Russian and Ukrainian channels before pivoting to Moldovan discourse in March 2025.

Metric	‘Nu Acum’ Bot Network Data (2025)
Total Comments Generated	62, 229 (July 1 , Sept 15, 2025)
Targeted Channels	76 (Political & News Sectors)
Average Lifespan	18 Days per Account
Primary Narrative	Sovereignty loss; “Not ” to EU
Funding Source	PSB Bank (Moscow) / Ilan Shor Network

The “Regime of Hypocrisy” Funnel

A key component of this infrastructure was the RegimDeIpocrizie_Bot (Regime of Hypocrisy), which functioned as a data collection point. Promoted heavily on TikTok and Facebook, this bot encouraged users to submit “evidence” of government abuse. In reality, it harvested user data to refine the targeting algorithms of the broader “Stop UE” campaign. Data from LetsData indicates that channels linked to this bot saw a 1, 071% spike in engagement during the campaign period, driven almost entirely by inorganic, API-injected traffic. This created a “false consensus” effect, where manufactured anti-EU sentiment appeared to be the dominant public opinion.

The Transactional Hook: 500 MDL for Digital Sovereignty

The entry point for the “Stop UE” recruitment engine was a standardized financial incentive: a 500 MDL (approximately $28) “activation bonus” offered to any Moldovan citizen to register their Personal Identification Number (IDNP) with the bot and install the Promsvyazbank (PSB) mobile application. While Ilan Shor’s political organization, the “Victory” (Victorie) bloc, framed these payments as “social aid” or “pension supplements,” forensic analysis of the bot’s backend and police reports from late 2024 confirm that this sum functioned strictly as a sign-up bounty. This payment was not a charitable grant; it was the acquisition cost for a verified digital identity that could be weaponized for future electoral interference.

To receive the initial 500 MDL, users were required to bypass Moldovan banking regulations. The bot provided step-by-step tutorials on installing the PSB application, a platform operated by a Russian state-owned bank under international sanctions for its ties to the Russian defense sector. Because PSB is banned from the Moldovan financial system, the bot instructed users to generate a virtual “MIR” card within the app. The 500 MDL bonus was credited to these virtual accounts, trapping the user in a parallel financial ecosystem. To access the funds, recipients had to either travel to the breakaway region of Transnistria, where MIR cards remain functional, or use a network of peer-to-peer couriers managed by “territorial leaders” to exchange the digital rubles for cash.

The Escalation Matrix: From Sign-Up to Sabotage

The 500 MDL bonus served only as the base tier of a highly structured payment hierarchy. Once a user was “onboarded” via the initial payment, the chatbot unlocked a menu of “tasks” with increasing financial rewards. Data seized by the General Inspectorate of Police (IGP) during the October 2024 raids revealed a precise pricing strategy designed to convert passive sympathizers into active agents of chaos.

Table 1: “Stop UE” / Victory Bloc Incentive Structure (Verified Sept-Oct 2024)

Activity Tier	Required Action	Verified Payment (MDL)	Payment method
Tier 1: Onboarding	Submit IDNP, Install PSB App, Join Telegram Channel	500, 1, 000 MDL	Direct PSB Deposit
Tier 2: Agitation	Attend protest, comment on specific posts, recruit 3 friends	1, 500, 2, 000 MDL	PSB Deposit / Cash Courier
Tier 3: Electoral Action	Vote “No” in Referendum (Photo proof required)	1, 800 MDL	Escrowed PSB Deposit
Tier 4: Leadership	Manage territorial group (100+ users), distribute cash	45, 000 MDL/month	Cash / Crypto Transfer

The “Tier 3” payment of 1, 800 MDL for voting “No” in the EU referendum was particularly sophisticated. The bot did not release these funds immediately. Instead, it required users to upload photographic evidence of their ballot paper, a direct violation of the secrecy of the vote. The bot’s AI, combined with manual review by “territorial leaders,” verified these images before authorizing the transfer. This “proof-of-work” model ensured that the Kremlin’s funds were only expended on verified outcomes, distinguishing this operation from previous vote-buying schemes where cash was distributed with no guarantee of compliance.

Financial and Police Interception

The volume of capital injected into this system was for a Moldovan election pattern. According to IGP Chief Viorel Cernăuțeanu, Russian actors transferred $15 million in September 2024 alone to fund these incentives, with the figure rising to $39 million by late October. This capital flow was sufficient to maintain a payroll of over 130, 000 active users, roughly 10% of the active electorate. The of the operation forced the Moldovan government to amend the Criminal Code, introducing fines of up to 37, 000 MDL for citizens found to have accepted these illegal funds.

even with the technological sophistication of the PSB transfers, the physical interface, the “cash-out” phase, remained a vulnerability. Police raids in late 2024 intercepted hundreds of couriers carrying envelopes of cash intended for users who could not travel to Transnistria. These seizures revealed that while the 500 MDL sign-up bonus was frequently paid digitally to build trust, the larger sums for “activists” were frequently delayed or withheld, creating a dependency loop where users had to perform more extreme tasks to unlock their accrued balance.

The Static Facade: Current Limitations of “Stop UE”

The “Stop UE” Telegram bot, as observed during the 2025 Moldovan parliamentary election pattern, operates as a sophisticated yet technically rigid command-and-control node. Its primary function remains transactional: the collection of Personal Identification Numbers (IDNP), the verification of user identity against illicit databases, and the distribution of financial incentives via the Promsvyazbank (PSB) application. While for mass mobilization, this architecture relies on pre-scripted decision trees. Users interact with a finite set of menu options, “Register,” “Invite Friend,” “Check Balance”, and receive hard-coded responses. This static behavior makes the current iteration to pattern-based detection. Cybersecurity analysts can map the bot’s logic flow, identify the IP addresses of the hosting servers, and flag the identical messages broadcast to thousands of users simultaneously.

Yet, the operational success of “Stop UE” lies not in its conversational ability in its data acquisition. By September 2025, the network had successfully harvested verified biometric and behavioral data from over 130, 000 Moldovan citizens. This dataset is not a list of bribe recipients; it serves as the foundational training corpus for the phase of automated warfare. The transition from static scripts to, autonomous agents represents a fundamental shift in how Kremlin-aligned actors project power in the digital domain. The “Stop UE” infrastructure is the cocoon for a new class of AI-driven influence tools that remove the human operator from the loop entirely.

Phase II: The Integration of Generative Personalization

The immediate evolution observed in late 2025 involves the injection of Large Language Models (LLMs) into the existing bot framework. Unlike the “Stop UE” model, which broadcasts a single narrative to all users, LLM-integrated bots generate unique message variants for each target. The 130, 000 distinct user profiles collected by the Shor network allow for hyper-segmentation. A pensioner in Gagauzia concerned about heating costs receives messages framing the EU as the cause of energy inflation, while a student in Chisinau receives content portraying European integration as a threat to traditional values or job security.

This capability renders traditional “copy-paste” detection methods obsolete. Platform algorithms designed to catch spam networks look for repeated text strings or identical image hashes. Generative agents bypass this by rewriting the core narrative into thousands of syntactically unique messages. In September 2025, researchers identified the “Storm-1516” operation using similar techniques to disseminate fake corruption allegations against the Moldovan government. These campaigns used AI to draft articles impersonating legitimate news outlets like the BBC or Euronews, which were then distributed via Telegram channels. The “Stop UE” user base provides the perfect distribution method for this content, turning a passive audience into unwitting vectors for undetectable propaganda.

Phase III: Autonomous Agent Swarms

The most serious threat vector emerging from the 2025 data harvest is the deployment of autonomous agent swarms. In this architecture, individual bots cease to function as terminals and begin to operate as a coordinated mesh network. These agents do not wait for human commands. Instead, they are programmed with high-level directives, such as “amplify negative sentiment regarding the EU referendum”, and are granted the autonomy to execute this goal across multiple platforms.

A swarm operates through cross-validation. One agent posts a fabricated news story on a fringe website. A second agent shares it on Telegram. A third agent, posing as a skeptic, questions the story in the comments, only for a fourth and fifth agent to “provide evidence” validating the original claim. This manufactured consensus tricks the algorithms of social media platforms (TikTok, Facebook, YouTube) into promoting the content as “high engagement” organic discussion. The “Stop UE” network’s existing 130, 000 users act as the initial seed audience, providing the real human engagement signals needed to push this artificial content into the mainstream feeds of the wider Moldovan population.

Comparative Analysis: Static Bots vs. Autonomous Swarms

Operational Shift in Disinformation Technology (2024-2026)

Feature	Static Bot Network (“Stop UE” 2025)	Autonomous AI Swarm (Projected 2026)
Content Generation	Pre-written scripts, identical messages.	Real-time generation, unique syntax per user.
Targeting Logic	Broadcasting to full list.	Psychometric profiling based on IDNP/history.
Coordination	Centralized command (human operator).	Decentralized mesh (agent-to-agent signaling).
Detection Signature	High (repetitive patterns).	Low (mimics organic human variance).
Response Time	Hours (requires human approval).	Milliseconds (reacts to news instantly).

The “Human-in-the-Loop” Removal

The removal of the human handler increases the velocity of disinformation. During the 2025 elections, the “Stop UE” network still required human administrators to approve payments and push specific daily narratives. This introduced latency. If a pro-EU candidate made a statement at 10: 00 AM, the counter-narrative from the Shor network might not appear until 12: 00 PM. Autonomous agents eliminate this gap. By monitoring live transcripts of speeches and news feeds, these agents can generate and disseminate counter-arguments in real-time, frequently before the original speaker has finished their address.

This speed creates a “truth deficit.” Fact-checkers and journalists require time to verify claims. AI agents do not. They flood the information space with noise immediately, establishing the dominant narrative frame before the truth can be established. The “Stop UE” bot’s payment infrastructure further weaponizes this. Future iterations could automatically trigger micro-payments to users who share or engage with this AI-generated content within the five minutes of publication, automating the bribery process based on algorithmic engagement metrics.

Defensive Obsolescence

Current defensive measures employed by the Moldovan government and Western partners focus on identifying inauthentic behavior through metadata analysis, IP addresses, account creation dates, and posting frequency. These metrics are ineffective against the generation of agents. The “Stop UE” network has already begun encouraging users to “donate” their accounts or rent out their social media profiles for a fee. This allows AI agents to operate through legitimate, aged accounts with real histories, rendering them indistinguishable from genuine citizens.

The verified IDNP data collected by “Stop UE” ensures that these hijacked accounts are backed by real identities, bypassing “Know Your Customer” (KYC) checks on platforms like Facebook or X. When a platform attempts to ban the account, the AI agent can produce the real user’s stolen credentials to appeal the ban, using the victim’s identity as a shield. This fusion of real human identity with autonomous AI execution creates a hybrid threat that current legal and technical frameworks are ill-equipped to. The 2025 election was a test of the data collection method; the subsequent pattern test the weaponization of that data by autonomous systems.