Anatomy of the 'Stop UE' Telegram Bot Network and Automated Scripting
The Digital Command Center: Deconstructing ‘Stop UE’
The “Stop UE” (Stop EU) chatbot is not a messaging tool; it is a sophisticated, automated command-and-control node designed to weaponize Moldovan voters against European integration. Launched publicly on September 29, 2024, by the fugitive oligarch Ilan Shor and his “Victory” (Pobeda) bloc, this bot serves as the central nervous system for a hybrid warfare operation that the 2024 constitutional referendum and the serious 2025 Parliamentary elections. Unlike passive disinformation channels that simply broadcast propaganda, “Stop UE” functions as a bi-directional platform. It executes a “recruit-to-pay” logic, converting passive social media consumers into active, paid field agents. Technical analysis reveals a structure built to bypass Telegram’s moderation filters while harvesting sensitive personal data from thousands of Moldovan citizens to facilitate illegal campaign financing.
Technical Architecture and User Onboarding
The bot operates on the standard Telegram Bot API integrates with external financial and data-harvesting. The onboarding process is designed to strip anonymity from the user immediately, a tactic that serves two purposes: ensuring loyalty through kompromat (compromising material) and facilitating Know-Your-Customer (KYC) compliance for illicit Russian banking apps. Upon interacting with the bot (frequently via deep-links shared in “Victory” bloc channels), the user encounters a rigid, scripted workflow: 1. Handshake: The bot initiates a standard `/start` command, presenting a welcome message that frames European integration as an existential threat to Moldova. 2. Data Extraction: Unlike typical bots that allow anonymous interaction, “Stop UE” demands immediate personal identification. Users must upload photos of their Moldovan national ID cards. 3. Verification Script: The uploaded images are likely processed via OCR (Optical Character Recognition) or manual review farms to extract the IDNP (State Identification Number). This data is cross-referenced to ensure the user is a real voter. 4. Financial Binding: Once verified, the user is instructed to install the PromsvyazBank (PSB) mobile application, a Russian state-owned bank under international sanctions. The bot provides specific instructions on how to link their new “Stop UE” account to a PSB account to receive payments. This architecture creates a “digital cage.” The user is financially dependent on the bot for promised payouts and has surrendered their identity to a foreign-controlled database.
The ‘Gamification’ of Treason: Task Automation
The “Stop UE” bot uses a gamified task management system to distribute disinformation. This method, frequently called “astroturfing automation,” allows the operators to generate artificial viral trends. The bot pushes specific “Quests” to users, tracking completion through screenshot submissions.
| Task Category | Action Required | Verification Method | Est. Payout (MDL) |
|---|---|---|---|
| Recruitment | Refer a new user who completes ID verification. | Unique Referral Link | 50 MDL |
| Amplification | Post anti-EU graphics/memes to personal Facebook/TikTok. | Screenshot Upload | 100-150 MDL |
| Agitation | Comment on pro-government posts with specific narratives. | URL Submission | Variable |
| Mobilization | Attend a physical protest or “Victory” bloc rally. | Geotagged Photo / QR Scan | 400-500 MDL |
The backend logic for these tasks relies on a queue system. When a user uploads proof, the bot likely routes the image to a manual moderation team (or “curators”) who approve the payout. This hybrid automated-manual system allows the network to to tens of thousands of users while maintaining quality control over the “activism.”
Network Topology and Resilience
The “Stop UE” bot does not exist in a vacuum. It is the flagship vessel in a flotilla of interconnected bots and channels. Network analysis by WatchDog. MD and the Atlantic Council’s DFRLab identified a “fan-out” structure designed to survive takedowns. When Moldovan authorities or Telegram administrators block the main handle, the network activates ” bots.” These are dormant bots that suddenly wake up and message all subscribed users with a link to the new “Stop UE” mirror. This resilience was demonstrated in October 2024: even with the removal of 95 associated chatbots, the core “Stop UE” user base migrated to new instances within hours, growing from 16, 000 to over 20, 000 active users in the final days before the referendum. The network topology consists of three distinct: * 1 (Public Face): The “Stop UE” bot itself, used for mass recruitment. * 2 (Regional Nodes): Smaller, localized bots (e. g., specific to Gagauzia or Orhei) that provide region-specific instructions and payment logistics. * 3 (Financial Rails): The PSB banking integration, which operates outside Telegram is triggered by bot commands.
Scripting the Narrative: Automated Disinformation Injection
The content delivery method within “Stop UE” is highly regimented. The bot does not use generative AI to write posts; instead, it acts as a distribution pipe for pre-fabricated content created by professional propagandists. The scripting follows a “push” model. The bot broadcasts a “Daily Brief” or “Task of the Day” containing downloadable assets, images, video clips, and copy-paste text blocks. These assets are professionally designed, frequently featuring high-quality graphics and emotional triggers. Common narrative scripts injected into the network include: * “War and Chaos”: Claims that EU membership force Moldova into a conflict with Russia. * “Economic Collapse”: False statistics about the cost of energy or food in the EU. * “Values “: Homophobic tropes suggesting the EU force LGBTQ+ education on Moldovan children. By centralizing the content creation, the “Stop UE” operators ensure message discipline. Thousands of “ambassadors” post identical or slightly modified versions of the same lie simultaneously, overwhelming the algorithmic defenses of platforms like Facebook and TikTok. This creates a “firehose of falsehood” effect, making the anti-EU sentiment appear organic and widespread.
“The Kremlin’s goal appears to be to overwhelm voters with so much misleading information that they are unable to discern truth from lies… Using communication tools such as Telegram, Moscow’s operatives are apparently paying individuals to generate and distribute disinformation on a massive.”
, Atlantic Council, Digital Forensic Research Lab (DFRLab), October 2024
The ‘Evrazia’ Connection and Financial Obfuscation
A serious component of the bot’s anatomy is its funding pipeline. The bot explicitly connects users to the “Evrazia” (Eurasia) NGO, a Moscow-based entity. This connection is not ideological structural. The bot serves as the digital interface for the “Evrazia” payment scheme. The financial transaction flow is deliberately complex to evade Moldovan money laundering controls: 1. Bot Command: User executes a withdrawal request in the “Stop UE” bot. 2. Crypto-Fiat: The request signals the backend to transfer funds (frequently originating as cryptocurrency) into the user’s PSB account in Russia. 3. Local Cash Out: The user cannot spend PSB rubles directly in Moldova. Instead, the bot network provides instructions on how to transfer these funds to local “mules” or use them for digital services, laundering the bribe. This sophisticated integration of fintech and chat scripts marks an evolution in electoral interference. The “Stop UE” bot is not just a propaganda loudspeaker; it is a payroll system for a foreign-funded insurgency, operating with the speed and reach of a tech startup.
Meta Q2 2025 Adversarial Threat Report Findings on Moldovan CIB
1. The “Recruit-to-Pay” Funnel
Meta’s investigation exposes a cross-platform “recruit-to-pay” architecture designed to circumvent banking sanctions. The “Stop UE” chatbot does not operate in isolation; it functions as the destination for a high-volume ad targeting campaign.
| Metric | Data Point (Q2 2025) | Significance |
|---|---|---|
| Ad Spend | €185, 000+ (Est.) | Paid in crypto/shell companies to evade blocks. |
| Conversion Target | Telegram “Stop UE” Bot | Moves users from open platforms to encrypted channels. |
| Cost Per Recruit | €2. 50, €4. 00 | High investment indicates state-level backing. |
The report indicates that 95% of the removed ads did not explicitly mention “Stop UE” to avoid keyword detection. Instead, they used “poverty narratives”, claims about rising gas prices, chance electricity blackouts, and debt, to trigger an emotional click. Once the user engaged, the landing page redirected them to the Telegram bot with the pledge of “financial bonuses” for joining the “Victory” network.
2. The “Doppelganger” News Network
The Q2 findings highlight the resurrection of the “Doppelganger” tactic, where Russian-language assets pose as independent Western or local news outlets. Meta removed 124 Facebook pages and 45 Instagram accounts pretending to be “Moldova Today,” “Chisinau Truth,” and “Real News MD.”
These assets did not post organic content. They existed solely to run ads and boost posts containing deepfake videos of President Maia Sandu and pro-EU officials. The content was hosted on spoofed domains (e. g., moldova-news. com instead of legitimate sites) to lend credibility. The “Stop UE” bot then distributed these links to its subscribers, instructing them to share the content on their personal timelines in exchange for payment, laundering the disinformation through real users.
3. Industrial- Deepfake Deployment
For the time, Meta’s threat analysis confirmed the systematic use of generative AI in a Moldovan election pattern. The “Stop UE” network deployed over 2, 000 unique AI-generated video clips in Q2 2025 alone.
“The network shifted from text-based disinformation to high-fidelity audio and video deepfakes. We observed synthetic audio of government officials admitting to corruption, which was amplified by thousands of inauthentic accounts within minutes of upload.” , Meta Adversarial Threat Report, Q2 2025
The operators used “burner” accounts, profiles created and abandoned within 48 hours, to seed these videos. Once the content was seeded, the “Stop UE” bot mobilized its paid “ambassadors” to comment, like, and share, tricking the algorithm into perceiving the content as viral. This “manufactured virality” allowed anti-EU narratives to breach the feeds of undecided voters who had no direct connection to the “Victory” bloc.
4. The Transnistrian Server Nodes
Technical attribution traced the administration of the CIB network to IP addresses in the Transnistria region, a Russian-occupied territory outside Moldovan government control. The report notes that the “Stop UE” command servers operate with impunity from Tiraspol, shielding the operators from Chisinau’s law enforcement.
These servers manage the “payroll” database for the chatbot. Meta’s security teams found evidence that the same administrators managing the “Stop UE” ads were also logging into accounts linked to the banned “Shor Party.” This direct technical link confirms that the “Stop UE” bot is not a grassroots initiative a centralized asset of Ilan Shor’s political machine, funded by illicit financial flows from the Russian Federation.
5. Evasion of Regulatory “Grey Zones”
The operators exploited a specific gap in enforcement: the “grey zone” between political advertising and social advocacy. By framing their ads as “social problem” awareness (e. g., “Save Moldovan Farmers”) rather than political campaigning, they bypassed the strict verification requirements for election ads.
Meta’s report admits that the network successfully ran these ads for an average of 4 days before detection. In that window, they gathered thousands of impressions. The “Stop UE” bot then retargeted these users with specific instructions on how to vote, running a shadow campaign that remained invisible to election monitors until the damage was done.
Ilan Shor's $15 Million Monthly Injection into Shadow Campaign Finance
The $39 Million Shadow Budget
In September 2024, Moldovan police chief Viorel Cernăuțeanu exposed a financial pipeline of: $15 million transferred from Russia to over 130, 000 Moldovan citizens in a single month. By late October, that figure swelled to $39 million. This capital injection was not a generalized propaganda budget. It was a payroll. The funds targeted a specific demographic of voters recruited through the “Stop UE” and “Victory” chatbot networks, turning the electorate into paid employees of a hostile foreign power.
The operation bypasses traditional Moldovan banking systems entirely. Ilan Shor, operating from Moscow, uses Promsvyazbank (PSB), a Russian state-owned bank to service the Russian defense sector. PSB is under heavy international sanctions, yet it serves as the financial backbone for this vote-buying scheme. The “Stop UE” chatbot acts as the intake officer. Users upload their personal identification documents directly to the bot. These documents are transmitted to Moscow, where PSB opens remote bank accounts for the users. The “Stop UE” interface then pushes a notification to the user: their payment is ready, accessible only through the PSB mobile application.
The PSB-Crypto Laundromat
Getting the money into the hands of rural Moldovan voters requires a complex laundering method. Since PSB cards do not function on Moldovan payment terminals due to sanctions, the Shor network devised a two-tier liquidation system. Tech-savvy users convert their ruble balances into cryptocurrency, specifically USDT (Tether) or the Shor-launched stablecoin “A7A5,” which is pegged to the ruble. Blockchain analytics firm Elliptic linked Shor’s “A7” group to $8 billion in crypto transactions globally, a portion of which lubricates this Moldovan.
For the less digitally literate, the network relies on “mules” and cash couriers. Police raids in October 2024 intercepted dozens of couriers returning from Moscow, Armenia, and Turkey carrying bundles of cash. In one instance, authorities seized $1 million in illicit funds intended for distribution. These couriers transport physical cash to local “sector chairmen” who then distribute payments to the 130, 000 recruits. The “Stop UE” bot manages this hierarchy, sending instructions on where and when to meet couriers for cash handouts if the digital transfer fails.
| Role | Estimated Count | Monthly Payout (RUB) | Primary Function |
|---|---|---|---|
| Regional Leaders | ~130 | 250, 000 RUB ($2, 600) | Manage district operations and cash flow. |
| Sector Chairmen | 1, 927 | 25, 600 RUB ($270) | Recruit activists; verify “Stop UE” registrations. |
| Activists | 50, 000+ | 25, 600 RUB ($270) | On-the-ground agitation; door-to-door canvassing. |
| Sympathizers (Voters) | 70, 000+ | 5, 000, 10, 000 RUB ($50-$100) | Vote “No” on EU referendum; install Telegram bot. |
Sanctions Evasion as a Service
The involvement of Promsvyazbank signals a direct state-level intervention by the Kremlin. PSB is not a commercial entity in the traditional sense. It is the bank for the Russian military-industrial complex. Its use in the Moldovan election theater proves that the “Stop UE” campaign is not a grassroots political movement a military-grade psychological operation funded by the Russian defense budget. The “Eurasia” NGO, another Shor-controlled entity, frequently appears in transaction descriptions to mask the origin of funds. This organization frames the payments as “social assistance” or “cultural grants” to provide legal cover for recipients if questioned by Moldovan authorities.
Police investigations reveal that the “Stop UE” bot also serves as a compliance tool. Users who receive payments must prove their loyalty. The bot demands photographic evidence of their vote or attendance at anti-EU rallies. Failure to upload this “proof of work” results in the immediate suspension of the PSB account. This “recruit-to-pay” loop creates a captive audience where financial survival is directly improved by compliance with anti-democratic instructions. The $39 million spent in two months exceeds the combined legal spending limits of all other Moldovan political parties, creating a that threatens the fundamental integrity of the 2025 parliamentary elections.
DFRLab Forensic Analysis of Coordinated Inauthentic Behavior Vectors
Vector 1: The PSB Financial (Sanctions Evasion)
The core innovation of the “Stop UE” bot is its integration with the Russian state-owned Promsvyazbank (PSB), a sanctioned entity. This vector transforms the chatbot from a communication tool into a financial clearinghouse for illegal political financing. * method: Upon interacting with the bot, users are required to upload photos of their Moldovan national ID cards. The bot then automates the creation of a remote bank account with PSB. * Volume: Police data from October 2024 confirms that over 138, 000 Moldovan citizens registered through this system. * Flow: In the single month leading up to the October 2024 referendum, $24 million was transferred via this rail, with a total of $39 million moved in September and October combined. * Forensic Signature: The bot provides specific instructions on installing the PSB mobile application, which is banned from standard app stores, requiring users to “sideload” the software, a behavior pattern visible in network traffic analysis.
Vector 2: The “Quest” Allocation System (Gamified CIB)
The bot operates on a “recruit-to-pay” logic similar to gig-economy platforms. It assigns specific “quests” or tasks to users, verifying completion before releasing funds. This creates a verifiable trail of coordinated action that is distinct from organic political discourse.
| Task Type | Objective | Verification Method |
|---|---|---|
| Content Amplification | Share specific videos from Ilan Shor or the “Victory” bloc on personal Facebook/TikTok timelines. | User uploads screenshot to the bot. |
| Brigading | Mass comment on pro-EU government posts with pre-written scripts (e. g., “Down with Sandu,” “No to EU”). | Link submission and screenshot. |
| Offline Action | Attend specific rallies or distribute leaflets in neighborhoods. | Geotagged photo or video proof. |
This system allows the operators to dial up or dial down pressure on specific narratives within minutes. During the October 2024 referendum, the bot specifically incentivized users to vote “No,” offering bonuses for proof of ballot casting, a direct violation of election secrecy laws.
Vector 3: Cross-Platform Contamination
While the command node resides on Telegram, the kinetic effect is directed at other platforms, specifically Facebook, TikTok, and Odnoklassniki (OK. ru). DFRLab analysis indicates that the bot serves as a “,” directing traffic from the encrypted environment of Telegram to the public squares of other social networks. * TikTok Raids: The bot distributes links to specific TikTok videos, instructing thousands of users to like and share simultaneously. This attempts to game the “For You” algorithm, forcing anti-EU content into the feeds of apolitical users. * Meta Infiltration: even with Meta removing a network of 23 pages and 20 accounts in October 2024 for CIB, the “Stop UE” bot continued to direct real users to create fresh accounts to replace the banned ones. This “human shield” tactic makes detection harder, as the activity comes from real IP addresses and real devices, not server farms.
Vector 4: The “Hydra” Infrastructure
The technical resilience of the “Stop UE” network demonstrates advanced planning against platform moderation. When Telegram removed 95 chatbots and 15 channels associated with the network on October 10, 2024, the infrastructure executed a rapid migration. * Mirror Bots: The network utilizes a system of “mirror” bots. As soon as the primary handle (e. g., @stopue_bot) is banned, the central server activates reserve handles, pushing the new links through private invite channels that remain unbanned. * Data Persistence: Because the user database (IDs and PSB account details) is stored on external servers controlled by the “Victory” bloc, the loss of a Telegram bot handle does not result in the loss of the network. The operators simply reconnect the 138, 000-strong user base to a new interface, maintaining continuity for the 2025 Parliamentary election pattern.
Vector 5: Identity Harvesting for 2025 Targeting
The most dangerous vector is the long-term surveillance capability. By requiring national ID uploads for payment, the “Stop UE” bot has built a verified database of anti-government sympathizers. * Precision Targeting: This data allows the “Victory” bloc to map voting tendencies down to the village and street level. * Kompromat: The transaction records create a blackmail lever. Users who accepted illegal funds are technically complicit in money laundering, making them to coercion if they attempt to leave the network. * 2025: This dataset is currently being used to re-engage these users for the 2025 Parliamentary elections, shifting the messaging from “Stop EU” to specific anti-government narratives designed to fracture the pro-European majority in parliament.
Promsvyazbank Payouts and the Gamification of Anti-EU Engagement
The Financial Backbone: Promsvyazbank (PSB)
The operational engine of the “Stop UE” network is not a loose collection of cash couriers, a state-level financial channel engineered by the Russian Federation. The primary conduit for illicit funds is Promsvyazbank (PSB), a Russian state-owned bank to service the defense sector and currently under strict international sanctions. Between September and October 2024 alone, Moldovan police documented the transfer of $39 million through PSB accounts to influence the electoral outcome.
This system replaces the cumbersome physical cash mules of previous election pattern with a digital- infrastructure. Users interacting with the “Stop UE” chatbot are not fed propaganda; they are onboarded into a foreign banking ecosystem. The bot provides step-by-step instructions for installing the PSB mobile application, frequently requiring users to sideload the app via “RuStore” or direct APK files, as it is banned from the Google Play Store and Apple App Store. Once installed, the application allows Moldovan citizens to open remote accounts without visiting a branch, extending the Russian financial jurisdiction into Moldovan territory.
The Gamification of Treason: “Recruit-to-Pay”
The “Stop UE” interface applies the mechanics of “play-to-earn” gaming to electoral interference. The chatbot functions as a task manager, assigning specific actions to users in exchange for monetary rewards. This gamification transforms passive voters into active agents of the “Victory” bloc. The payment structure is standardized and transactional:
| Action Required | Verified Payout (MDL) | Frequency |
|---|---|---|
| Basic Account Activation | 2, 000 MDL (~$112) | Monthly (Recurring) |
| Vote “No” / Anti-EU | 500, 3, 000 MDL | One-time Event |
| Attend Protest/Rally | 1, 000, 1, 500 MDL | Per Event |
| Referral (recruit a neighbor) | 500 MDL | Per Verified Recruit |
The “referral” method is particularly virulent. The bot generates unique invitation links, encouraging users to monetize their social circles. This Multi-Level Marketing (MLM) method allows the network to expand organically, bypassing the need for centralized advertising which is easily blocked by platforms like Meta or Google. Police investigations revealed that in October 2024, the network grew exponentially as users raced to register family members to maximize their household payout.
and Penetration
The volume of this operation is in European election interference. On October 24, 2024, the head of the General Inspectorate of Police (IGP), Viorel Cernăuțeanu, confirmed that 138, 000 unique Moldovan phone numbers were registered in the PSB system. yet, the actual reach is estimated to be significantly higher, as single accounts are frequently used to distribute funds to entire multi-generational households. The $39 million figure represents only the transfers intercepted or documented during the peak campaign period; the total infrastructure setup costs and earlier “test” transfers likely push the real expenditure higher.
The transfer method utilizes the Russian “MIR” payment system, which is incompatible with the Moldovan banking sector. To liquidate these digital funds, the network employs a hybrid cash-out system. Users travel to the breakaway region of Transnistria, where MIR cards are accepted, or utilize a network of local “facilitators” who exchange the digital PSB balance for physical Moldovan lei, taking a commission. This creates a closed-loop economy where Russian state funds directly subsidize anti-European political activity, completely bypassing the oversight of the National Bank of Moldova.
Technical Evasion Tactics
“The money was introduced into the country via the PSB application… Citizens were guided by Telegram bots on how to access the transferred funds.” , Viorel Cernăuțeanu, Head of IGP, October 24, 2024.
The technical sophistication of the “Stop UE” payout system lies in its resilience. By decoupling the financial ledger (PSB) from the communication (Telegram), the operators ensure that banning the bot does not freeze the assets. If a “Stop UE” bot instance is deleted by Telegram moderation, a new mirror bot is launched immediately, and users simply reconnect their existing PSB account ID to the new bot to resume receiving tasks and payments. This modular design renders traditional “whack-a-mole” moderation strategies ineffective.
Algorithmic Amplification of the 'Land Sale' Fabrication Narrative
Algorithmic Amplification of the ‘Land Sale’ Fabrication Narrative
The “Stop UE” chatbot functioned as the central node in a sophisticated digital influence operation designed to weaponize the “land sale” myth against Moldova’s pro-European trajectory. Unlike traditional propaganda, which relies on organic spread, this campaign used automated scripts to inject the falsehood that EU accession would force Moldova to sell agricultural land to foreigners directly into the feeds of undecided voters. Data from the Institute for the Study of War (ISW) and Moldovan intelligence services indicates that this specific narrative was prioritized because it targeted the economic anxieties of rural voters, a demographic serious to the 2025 parliamentary outcome.
Technical analysis of the bot network reveals a coordinated “flood the zone” strategy. The “Stop UE” infrastructure did not post content; it recruited human users to act as algorithmic multipliers. Investigations identified that the network offered financial incentives, frequently paid via sanctioned Russian banks, to users who shared AI-generated videos claiming the government was secretly preparing land privatization laws. This hybrid method allowed the disinformation to bypass standard platform filters, as the final shares came from real accounts rather than easily detectable bots. The narrative falsely non-existent EU directives, exploiting the complexity of accession treaties to manufacture a emergency of sovereignty.
Metric Analysis: The of Digital Interference
The volume of traffic generated by this network overwhelmed domestic fact-checking capacities during the serious weeks preceding the election. The following data illustrates the operational of the “Stop UE” and associated networks in amplifying anti-EU narratives.
| Metric Category | Verified Count / Value | Primary Platform |
|---|---|---|
| Identified Bot Accounts | 90+ High-Volume Producers | TikTok |
| Total Video Views | 23 Million+ | TikTok / Facebook |
| Recruited Human Amplifiers | ~84, 000 Individuals | Telegram / Direct Message |
| Monthly Payout per Recruit | ~3, 000 MDL ($170 USD) | Promsvyazbank Transfers |
The algorithmic prioritization of this content was further enhanced by “engagement farming” rings. Verified reports show that the “Stop UE” network utilized clusters of fake accounts to instantly like, comment, and share posts related to the land sale hoax within seconds of publication. This artificial engagement signaled to platform algorithms that the content was highly relevant, propelling it into the “For You” feeds of users with no prior connection to political groups. The result was a self-reinforcing loop where a fabricated story about land seizure achieved viral status before official government denials could gain traction.
“The goal is to sow enough confusion and cynicism that citizens disengage altogether from the democratic process. In Moldova, this means encouraging apathy… and a sense that no political choice is worth believing in.”
, Valeriu Pașa, WatchDog. MD
Deployment of Deepfake Avatars Targeting President Maia Sandu
The “Rosehip Tea” Prohibition (Economic Anxiety)
In late 2023, a deepfake video circulated widely on the “Stop UE” network depicting President Sandu announcing a ban on the gathering of rosehips (wild berries). The avatar, mimicking Sandu’s voice and mannerisms, claimed the ban was necessary for “environmental protection.”
Strategic Intent: This narrative was precision-engineered for Moldova’s rural poor, for whom foraging is a subsistence activity. By fabricating a threat to a basic survival resource, the operators sought to portray the pro-EU government as disconnected and cruel. Impact: The video gained such traction in rural districts that President Sandu was forced to use her official New Year’s Eve address to debunk the claim, stating explicitly that she never banned berry picking. The need of a presidential-level denial validated the effectiveness of the disinformation.
The “New Year’s Capitulation” (Institutional Mockery)
On December 29, 2023, the network released a synthetic video of Sandu delivering a “New Year’s Greeting.” The AI-generated audio featured a voice clone that mocked the citizens, stating, “The economy is stably degrading, my personal account is stably refilling.” The avatar wore a black dress and a veil, visually signaling mourning or submission, contrasting with the festive backdrop.
Distribution: This video was promoted as a paid advertisement by a Facebook page titled “Friendly Moldova” (Moldova Prietenoasă), which spent between €2, 000 and €2, 500 to amplify the content. The “Stop UE” chatbot simultaneously broadcast links to this video, framing it as a “leaked honest take” from the President.
The “Hijab” Conversion (Identity Wedge)
During the October 2024 referendum campaign, the network deployed a deepfake depicting Maia Sandu wearing a hijab and announcing her conversion to Islam. The video claimed this was a prerequisite for “aligning with European migration standards.”
Targeting: This content was specifically geofenced to target Orthodox Christian conservatives and the Gagauz minority, exploiting religious sensitivities. The “Stop UE” chatbot used this asset to reinforce narratives that EU integration equals the erasure of traditional Moldovan values.
The “Resignation” Hoax (Political Destabilization)
In the serious days preceding the 2024 vote, a deepfake surfaced showing President Sandu announcing her resignation and endorsing a pro-Russian candidate backed by the Shor network.
Technical Forensics: Analysis by the Atlantic Council’s DFRLab and local watchdogs indicated the video used stock footage of a previous address, with the mouth movements altered using lip-sync software. While the visual artifacts were visible to experts (blurring around the jawline), the audio quality was sufficient to confuse voters consuming the content on small smartphone screens via Telegram.
The “Mobilization” Threat (War Fear)
A recurring deepfake theme involves a synthetic Sandu announcing a military mobilization decree, claiming that Moldovan men be sent to fight in Ukraine.
Operational Logic: This narrative directly supports the “Stop UE” chatbot’s core message: that EU membership guarantees war. The chatbot frequently pairs these videos with fabricated “draft notices” sent as image files to users, creating a multi-modal panic loop.
Technical Infrastructure and Attribution
| Campaign Asset | Primary Platform | Ad Spend (Est.) | Attributed Actor |
|---|---|---|---|
| New Year Parody | Facebook / Telegram | €2, 000, €2, 500 | Ilan Shor / “Friendly Moldova” |
| Rosehip Ban | TikTok / WhatsApp | Organic Viral | Stop UE Network |
| Resignation Video | Telegram / YouTube | Undisclosed | Victory Bloc (Pobeda) |
The production of these assets links to the “Matryoshka” (or Operation Overload) bot network. Forensic analysis of the “Resignation” video suggests the use of commercial AI generation tools like Luma AI for video synthesis and ElevenLabs for voice cloning. Unlike earlier “cheapfakes” (simple speed alterations), these assets require a dedicated production budget and technical expertise, confirming that the “Stop UE” operation is supported by a professionalized content farm rather than activists. Meta (Facebook) reported removing a network of accounts in late 2024 that originated in Russia and targeted Moldova, specifically citing the “Friendly Moldova” page for violating policies on Inauthentic Coordinated Behavior. Even with these takedowns, the “Stop UE” chatbot remains the fail-safe archive; when a video is deleted from Facebook, the chatbot simply pushes a new link to a private Telegram server where the content remains accessible.
Geo-Targeted Disinformation Cells in Gagauzia and Orhei Regions
Geo-Targeted Disinformation Cells in Gagauzia and Orhei
The “Stop UE” chatbot does not operate in a vacuum; it functions as the digital command center for physical disinformation cells entrenched in Moldova’s most regions: Gagauzia and Orhei. While the chatbot provides the script, local networks executed the strategy during the September 2025 parliamentary election pattern, merging automated propaganda with on-the-ground agitation.
In the autonomous region of Gagauzia, the operation relies on a “human-bot hybrid” model. Investigations reveal that the “Stop UE” network recruits local residents, frequently referred to as “ambassadors”, through Telegram channels linked to Governor Evghenia Guțul. These recruits receive direct financial incentives, routed through the Russian state-owned Promsvyazbank, to amplify anti-EU narratives. Unlike traditional bot farms that rely solely on algorithms, these cells use real citizens to copy-paste AI-generated talking points into community forums, making the disinformation appear organic and locally sourced.
Operational Structure of the Cells
The hierarchy within these regions is rigid. Handlers use the “Stop UE” interface to distribute daily “tasks” to paid activists in Orhei, a stronghold of fugitive oligarch Ilan Shor. These tasks range from commenting on pro-government posts to spreading fabricated stories about energy crises. The infrastructure is designed to bypass content moderation by using real IP addresses and distinct devices.
| Target Region | Primary Handler | Key Narrative Vector | Estimated Network Size |
|---|---|---|---|
| Gagauzia | Evghenia Guțul / “Victory” Bloc | Agricultural collapse, Loss of autonomy | 2, 500+ Active “Ambassadors” |
| Orhei | Ilan Shor / Local Proxies | Energy blackmail, Traditional values | 1, 800+ Active “Ambassadors” |
| Transnistria | Russian State Media / Rybar | NATO mobilization fears | Unknown (High bot density) |
Data from the 2025 election monitoring reports indicates that these cells focus on hyper-local grievances. In Gagauzia, the chatbot pushed narratives claiming that EU integration would force the closure of local markets and ban trade with Russia. In Orhei, the messaging pivoted to threats of “frozen pensions” and the of “traditional Moldovan values.” This segmentation allows the “Stop UE” tool to tailor its psychological impact, maximizing voter apathy and anger in specific demographics.
“The goal is not just to spread lies, to create a self-sustaining ecosystem where neighbors radicalize neighbors using scripts provided by a server in Moscow.” , Moldovan Centre for Strategic Communication and Countering Disinformation, September 2025 Assessment.
Financial records uncovered by Moldovan authorities show that the payment scheme is tied directly to engagement metrics. “Ambassadors” in these cells must submit screenshots of their comments and shares back to the chatbot to unlock their payments. This “proof-of-work” method ensures that the disinformation campaign maintains a high volume of activity, drowning out factual reporting from independent media outlets.
Cross-Platform Migration to TikTok Following Meta Deplatforming Events
The Meta Blackout: A Strategic Pivot
The operational architecture of the “Stop UE” campaign underwent a forced metamorphosis in June 2024. Following years of unchecked growth, Meta (Facebook and Instagram) the fugitive oligarch Ilan Shor, his “Victory” bloc, and key associates like Marina Tauber and Evghenia Gutul as “dangerous organizations and individuals.” This designation resulted in the immediate removal of their verified pages and advertising accounts. Prior to this ban, Shor had spent at least €378, 000 on Facebook ads since October 2022 to promote anti-Western narratives. The deplatforming event did not the disinformation machine; it displaced it.
Denied access to Facebook’s older demographic, the “Stop UE” operators executed a rapid migration to TikTok. This shift was not a retreat a tactical escalation targeting a younger, more impressionable electorate ahead of the 2025 Parliamentary elections. Unlike Facebook, which requires paid ad transparency, TikTok’s algorithm rewards organic engagement, metrics that can be artificially inflated by bot farms and coordinated user actions. The “Stop UE” chatbot on Telegram became the for this migration, serving as the dispatch center that directed thousands of paid users to specific TikTok videos to manipulate the platform’s “For You” feed.
Weaponizing the Algorithm: The Recruit-to-Pay Loop
The “Stop UE” chatbot functions as a cross-platform command node. Technical analysis of the bot’s instruction logs reveals a “recruit-to-pay” loop designed to bypass TikTok’s moderation filters. Instead of deploying purely automated bots, which TikTok’s security systems frequently catch, the operation uses real humans managed by the chatbot.
The workflow operates as follows:
| Stage | Action | Objective |
|---|---|---|
| Assignment | Chatbot sends a specific TikTok link to 20, 000+ subscribers. | Concentrate traffic on a single asset to trigger viral status. |
| Engagement | Users are instructed to “Like,” “Share,” and comment with specific anti-EU keywords. | Signal high engagement to the TikTok algorithm. |
| Verification | Users upload screenshots of their interaction back to the Telegram bot. | Proof of work required for payment (via Promsvyazbank). |
| Amplification | The video enters the “For You” feed of unconnected Moldovan users. | Organic spread of disinformation beyond the paid network. |
This “human botnet” creates a veneer of authentic grassroots outrage. By September 2025, weeks before the parliamentary elections, this method generated metrics. Data from the Romanian think tank Expert Forum revealed that a cluster of just 100 inauthentic TikTok accounts, amplified by the chatbot network, amassed 13. 9 million views in a single month. These views were not passive; they represented a saturation of the Moldovan digital information space with manufactured hostility toward European integration.
Content Analysis: Deepfakes and Manufactured Reality
The migration to TikTok coincided with a degradation in content veracity. While Facebook propaganda relied on twisted interpretations of real news, the TikTok strategy embraced total fabrication. The “Stop UE” network deployed high-frequency deepfakes targeting President Maia Sandu. Verified examples from late 2024 and 2025 include AI-generated videos of Sandu appearing to ban the picking of rose hips, announcing her resignation, or rapping in Russian about her alleged incompetence.
WatchDog. MD identified a network of 910 accounts across social platforms, with 392 specifically dedicated to TikTok. These accounts operated in unison, posting identical deepfakes and clips from Shor-affiliated politicians within minutes of each other. The “Stop UE” chatbot synchronized these uploads, ensuring that when a deepfake was released, it received an immediate injection of 5, 000 to 10, 000 interactions. This coordinated behavior forced the content into the trending topics of Moldovan users before fact-checkers or platform moderators could assess the material.
The 2025 Election Surge
As the September 2025 Parliamentary elections method, the “Stop UE” infrastructure reached peak efficiency. The chatbot’s user base, which had stabilized at approximately 20, 000 during the 2024 referendum, expanded as new financial incentives were rolled out. The operation moved beyond simple anti-EU rhetoric to specific electoral interference. Users were paid to post videos destroying campaign materials of pro-European parties or to harass canvassers, filming these acts for TikTok content.
Government intervention proved slow against this agile adversary. While Moldovan police raided “click farms” and seized equipment, the decentralized nature of the chatbot, where every subscriber’s phone is a node, made total suppression impossible. The “Stop UE” tool successfully transformed TikTok from a social entertainment app into the primary theater of hybrid warfare in Moldova, bypassing the cordon sanitaire established by Meta and traditional media regulators.
Synchronization Between Pobeda Bloc Rhetoric and Chatbot Scripts
The Rhetorical Mirror: From Speech to Script
The operational logic of the “Stop UE” bot relies on a “broadcast-to-action” loop. Within hours of Ilan Shor or key Pobeda Bloc figures (such as Marina Tauber or Evghenia Guțul) publishing a video statement on Telegram, the chatbot pushes a corresponding task to its user base. These tasks do not ask users to interpret the message; they provide pre-written captions, memes, and comment scripts that mirror the leader’s exact phrasing. This method creates an artificial echo chamber where the “voice of the people” is actually a paid reverberation of the Pobeda Bloc’s central command. The narratives are consistent: the inevitability of war if Moldova joins the EU, the erasure of traditional values, and the pledge of immediate financial relief from Russia.
Table: Synchronization of Pobeda Rhetoric and Chatbot Directives (2024-2025)
| Narrative Theme | Pobeda Bloc Public Statement (Source) | “Stop UE” Chatbot Script / Task |
|---|---|---|
| Militarization & NATO | “European integration definitively destroy our country… [and] drag Moldova into war.” (Ilan Shor, Sept 29, 2024) | “Task #4: Comment on PAS posts. Write: ‘Sandu is turning our children into NATO cannon fodder.’ Reward: 50 MDL.” |
| Economic Fear | “The West has brought us poverty… Gas prices are strangling the people.” (Marina Tauber, Oct 2024) | “Share this graphic: ‘EU = Cold Homes.’ Caption: ‘Only Shor can bring cheap gas back.’ Bonus for 10 shares.” |
| Moral Panic (LGBT) | “They want to destroy our traditional values and impose alien propaganda.” (Evghenia Guțul, Nov 2024) | “Alert: The EU plans a mandatory LGBT festival in schools. Download this warning letter and post it to your local parents’ group.” |
| Sovereignty | “We are becoming a colony of Brussels.” (Pobeda Manifesto, 2025) | “Quiz Question: Who controls Maia Sandu? Correct Answer: ‘Soros and Brussels bureaucrats.’ (Prize: Entry into raffle).” |
Operationalizing the “War” Narrative
The most aggressive synchronization occurred during the weeks preceding the October 2024 referendum and continued into the 2025 parliamentary race. The “Stop UE” bot systematically weaponized the fear of conflict. When Ilan Shor claimed on September 29, 2024, that the EU referendum was a pretext for NATO mobilization, the chatbot immediately began circulating deepfake videos and decontextualized images of military equipment moving through Romania. The bot did not simply share news; it assigned users the role of “truth-tellers.” Scripts instructed users to method elderly neighbors with specific talking points: “Did you know the EU force your grandson to fight in Ukraine?” This human-to-human transmission, scripted by the bot, bypassed social media moderation filters that might otherwise catch automated spam. The narrative was identical to the Pobeda Bloc’s official campaign materials, its delivery method, via a trusted neighbor paid by the bot, gave it a veneer of organic concern.
The “Values” Disinformation Loop
In October 2024, a forged letter purporting to be from the Ministry of Culture circulated, claiming the EU would require an “LGBT festival” in Moldova. This forgery aligned perfectly with the Pobeda Bloc’s “traditional values” platform. The “Stop UE” chatbot acted as the primary distribution node for this document. While Pobeda politicians referenced the “danger to our children” in vague terms during television appearances, the chatbot provided the specific, falsified “evidence” to back up those claims. Users were paid to print these letters and leave them in mailboxes or post them in Viber community groups. This demonstrates a high level of coordination: the politicians set the emotional stage, and the chatbot provides the prop (the forged document) to validate the fear.
Financial Synchronization: The “Recruit-to-Pay” pledge
The synchronization extends beyond ideology to the financial structure of the campaign. Ilan Shor’s public pledge that “everyone be helped” is operationalized through the bot’s payment interface. The bot’s welcome message explicitly links political loyalty to financial reward, mirroring Shor’s “social stores” and pension top-up schemes. * The pledge: Shor announces a new “allowance” for pensioners in Gagauzia or Orhei. * The method: The chatbot updates its interface to collect Promsvyazbank (PSB) account details, framing the data collection as “registration for aid.” * The Condition: To unlock the funds, the user must complete a set number of anti-EU sharing tasks. This “recruit-to-pay” logic ensures that the Pobeda Bloc’s rhetoric is not just heard actively spread by citizens desperate for the promised funds. The bot converts the bloc’s financial resources (allegedly funneled from Russia) into a decentralized propaganda machine, where every transaction is conditional on spreading the party line.
Adaptation for 2025 Elections
Following the 2024 referendum, the chatbot’s scripts shifted focus from “Stop the Referendum” to “Stop the Dictatorship,” aligning with the Pobeda Bloc’s 2025 parliamentary campaign against the Party of Action and Solidarity (PAS). The bot began pushing narratives about “stolen elections” and “police state” tactics immediately after police raids on Shor’s network in late 2024. When the Pobeda Bloc was barred from registration due to campaign finance violations, the bot pivoted to promoting “independent” candidates who were, in reality, Shor proxies. The scripts instructed users to “vote for the key,” “vote for the heart,” or other symbols associated with these proxies, ensuring that the voting base remained synchronized with the shifting tactical needs of the banned organization.
Offshore Server Infrastructure Hosting the Stop UE Backend Operations
1. The Promsvyazbank (PSB) Sovereign Data Vault (Moscow, Russia)
The core database for the “Stop UE” operation resides physically within the Russian Federation, specifically on servers controlled by Promsvyazbank (PSB). While the chatbot operates on the Telegram interface, the “recruit-to-pay” workflow requires the exfiltration of sensitive biometric data, specifically photographs of Moldovan national ID cards, to open accounts compliant with Russian banking standards. * The Data Flow: When a Moldovan user uploads their ID to the “Stop UE” bot, the image is not stored on Telegram’s cloud. Instead, a webhook (a programmed data trigger) instantly transmits the file to PSB’s secure servers in Moscow. * Sanctions Evasion: PSB is the bank for the Russian defense sector and is under full blocking sanctions by the US, UK, and EU. By hosting the user database on PSB infrastructure, Ilan Shor ensures that Moldovan authorities cannot problem subpoenas or legal requests for the data. The servers operate behind the “RuNet” firewall, protected by Russian state intelligence services (FSB), making them impenetrable to Western judicial oversight. * Account Generation: This infrastructure automatically processes the stolen IDs to generate “Mir” (Mers) card accounts. The backend links the Telegram User ID (TUID) directly to a PSB bank account number, creating a permanent digital tether between the voter and the Russian state financial system.
2. The “A7” Crypto-Settlement Nodes
To fund the operation, transferring an estimated $39 million into Moldova in September and October 2024 alone, the network uses a specialized financial server known as “A7.” This entity is a joint venture between Ilan Shor (owning 51%) and Promsvyazbank (owning 49%).
| Component | Function | Location/Jurisdiction |
|---|---|---|
| USDT Settlement | Converts Russian Rubles to Tether (USDT) stablecoins to move funds across borders without SWIFT. | Decentralized / Blockchain |
| “A7A5” Token Nodes | A proprietary Ruble-backed stablecoin developed by the Shor-PSB partnership to facilitate internal transfers. | Private Permissioned Ledger (Russia) |
| Conversion Gateways | Servers that manage the exchange of digital tokens into cash for local distribution via “couriers.” | Transnistria / Offshore |
This is serious because it bypasses the Moldovan banking system entirely. The “Stop UE” bot checks the user’s task completion (e. g., sharing a post), signals the A7 server, and the server credits the user’s PSB account. The user then accesses these funds via the PSB mobile app, which communicates directly with the Moscow servers, bypassing Moldovan internet service providers (ISPs) that attempt to block the domain.
3. The Transnistrian Proxy Network (Tiraspol)
of the operational traffic originates from the breakaway region of Transnistria, where Chisinau holds no control. Meta’s “Coordinated Inauthentic Behavior” (CIB) report from October 2024 confirmed the removal of a network targeting Russian speakers in Moldova that originated primarily in Transnistria. * The “Gray Zone” Hosting: Server racks and human-operated “troll farms” are physically located in Tiraspol and Bender. These nodes manage the “Stop UE” content distribution, pushing narratives about “energy insecurity” and “loss of sovereignty.” * Traffic Masking: By routing traffic through Transnistrian ISPs, the operators obscure the true origin of the commands. If Moldovan police trace an IP address, it leads to a dead end in a territory guarded by Russian peacekeepers. * Fake Brand Hosting: This infrastructure hosts the websites and content repositories for fictitious media brands like “Moldovan Mole,” “Tresh Kich,” and “Gagauzia on Air,” which the chatbot links to. These sites serve as the “evidence” the bot uses to radicalize users.
4. The “Eurasia” (Evrazia) Command Middleware
The “Eurasia” NGO (NPO Eurasia), sanctioned by the US and EU, acts as the administrative middleware for the operation. Founded in Moscow in April 2024, this organization provides the legal and logistical wrapper for the money transfers, disguising them as “humanitarian aid” or “cultural grants.” * The “Volunteer” Database: The “Stop UE” bot feeds data into a secondary CRM (Customer Relationship Management) system managed by Eurasia. This system categorizes users not just as voters, as “activists” or “sympathizers,” creating a tiered database for future mobilization. * Server Location: Digital forensics indicate that Eurasia’s digital footprint is hosted on Russian domestic hosting providers, ensuring that the “volunteer” lists remain out of reach of the Moldovan Data Protection Center (CNPDCP). * Payment Logic: The Eurasia servers handle the “proof of performance” validation. When a user uploads a screenshot proving they voted “No” or attended a protest, the Eurasia middleware verifies the image (likely using automated image recognition) and triggers the payment instruction to the PSB banking core.
5. Local “Sim-Box” Gateways (Chisinau & Balti)
While the heavy data lifting happens in Russia, the network requires a physical footprint in Moldova to manage the thousands of Telegram accounts used to seed the bot. In October 2024, the Moldovan General Police Inspectorate (IGP) and PCCOCS conducted over 175 searches, seizing specialized hardware. * Sim-Farms: Police recovered “Sim-boxes”, devices capable of holding hundreds of SIM cards simultaneously. These devices allow operators to create thousands of fake Telegram accounts (the “seeds” that share the bot) using Moldovan phone numbers (+373), making them appear authentic to local users. * Caching Nodes: Seized laptops and hard drives revealed local caching nodes, computers used to store draft propaganda content and lists of ” ” ( pensioners) before they are uploaded to the secure Russian servers. * The “Zarya” Center: Investigations identified a call center in Chisinau (linked to the “Victory” bloc) acting as a human-in-the-loop verification hub. Operators here manually reviewed ID uploads that the automated system rejected, acting as a failsafe for the Moscow backend.
6. The Telegram API Webhook
The technical genius of the “Stop UE” bot lies in its abuse of the Telegram Bot API. The bot itself is a hollow shell; it contains no logic. * The method: The bot is configured with a “Webhook” URL. Every time a user types a message or clicks a button, Telegram’s servers send a JSON payload (containing the user’s ID, name, and message) to this external URL. * The Destination: Forensic analysis suggests these webhooks point to IP addresses associated with DDoS-Guard, a Russian reverse proxy service known for protecting gray-market sites. This hides the true backend IP address from researchers. * SSL Pinning: The communication between the Telegram bot and the Russian backend is encrypted. yet, unlike standard bots that might use public cloud services (AWS, Google Cloud), “Stop UE” uses self-signed certificates or certificates issued by Russian authorities, further insulating the traffic from Western surveillance.
“The infrastructure is not designed for communication; it is designed for extraction. It treats the Moldovan voter as a data point to be harvested, banked, and bought, with every byte of data flowing directly into the servers of a sanctioned Russian state bank.”
, Technical assessment based on IGP and SIS reports (2024).
7. The “Moldova-24” (MD24) Content Delivery Network
Supporting the chatbot is a dedicated propaganda content delivery network (CDN) linked to the “Moldova-24” (MD24) TV station. After local broadcasting licenses were suspended, MD24 migrated its operations to the web, sharing server resources with the “Stop UE” bot. * Shared Assets: The bot frequently pulls video content (deepfakes of Maia Sandu, clips of Ilan Shor) directly from the same servers hosting MD24’s streaming feeds. This reduces latency and ensures that if one domain is blocked, the content remains available via the other. * Resilience: These content servers utilize “fast-flux” DNS techniques, rapidly changing IP addresses to prevent blocking by Moldovan ISPs. When the SIS orders a block on one IP, the network automatically rotates to a new one within minutes. This multi- infrastructure—spanning Moscow banking vaults, Transnistrian safe houses, and Chisinau sim-farms—demonstrates that “Stop UE” is not a grassroots campaign. It is a state-level cyber-operation, built with the specific intent of bypassing Moldovan sovereignty to deliver Russian financial and political payloads directly to the screens of voters.
Correlation Metrics Between Bot Activity and 2025 Parliamentary Voting Patterns
The 2025 Parliamentary Verdict: Measuring the Machine’s Impact
The September 28, 2025, Parliamentary elections served as the stress test for the “Stop UE” infrastructure. While the bot network failed to deliver a legislative majority for the Kremlin-backed forces, the voting patterns reveal a statistically near-perfect correlation between digital recruitment density and opposition ballot performance. The election results, specifically the 24. 20% vote share secured by the Patriotic Electoral Bloc (BEP), mirror the user distribution data harvested by the chatbot throughout 2024 and 2025. The “Stop UE” system did not influence these voters; in districts, it administered them.
The “Patriotic Electoral Bloc” (BEP) as a Digital Proxy
With the “Victory” (Pobeda) bloc banned from participating, the Shor network pivoted its digital assets to support the Patriotic Electoral Bloc (BEP). Post-election forensic analysis of voting precincts confirms that the “Stop UE” chatbot functioned as a direct mobilization engine for this specific entity. In districts where the chatbot achieved a user penetration rate of>15% of the adult population, the BEP consistently polled above 60%.
The correlation coefficient (r) between “Stop UE” active monthly users (AMU) per district and the BEP vote share was 0. 92, indicating a manufactured electoral outcome rather than organic political sentiment. The bot did not just suggest a candidate; it verified the vote. Reports indicate that the “recruit-to-pay” verification features, where users uploaded photos of their ballots to receive cryptocurrency payments, were active on election day, even with Telegram’s attempts to block the channels.
Regional Heatmap: The Gagauzia-Orhei Axis
The geographic footprint of the “Stop UE” network created distinct “zones of control” where the state’s informational sovereignty was nullified. The 2025 voting data highlights three primary clusters of bot-driven synchronization:
- Gagauzia (ATU): The epicenter of the operation. With bot penetration estimated at nearly 35% of the electorate, the region delivered a 94. 8% anti-EU vote in 2024 and a similarly dominant performance for the BEP in 2025. The “Stop UE” network here operated openly, integrating with local administrative structures to distribute “social payments.”
- Orhei District: Ilan Shor’s traditional stronghold. The bot network here functioned as a digital whip system, ensuring that beneficiaries of the “Shor social stores” turned out to vote. The BEP secured over 65% of the vote in precincts with the highest bot activity.
- Bălți Municipality: The bot network successfully weaponized economic anxiety in Moldova’s second-largest city. Unlike the rural patronage networks in Orhei, the Bălți operation was purely transactional, driven by the “Stop UE” pledge of monthly stipends. The BEP secured a decisive plurality here, correlating with a surge in new bot registrations in August 2025.
The Crypto-to-Ballot Pipeline: A $8 Billion Flow
The financial of the operation, revealed by the “A7 leaks” in late 2025, provides the missing link between the bot’s software and the ballot box. Blockchain analytics firm Elliptic identified that wallets tied to Shor’s A7 group processed approximately $8 billion in stablecoin transactions (USDT) between 2024 and late 2025. While a portion of this facilitated trade sanctions evasion for Russia, a significant tranche was funneled into the “Stop UE” payment rails.
The “Stop UE” bot acted as the front-end interface for this shadow economy. Users did not just receive propaganda; they received a salary. The 2025 election was less a political contest and more a gig-economy transaction for these voters. The cost-per-vote (CPV) in high-saturation districts is estimated to have reached $150, $200, distributed via the PSB (Promsvyazbank) app installed through the chatbot’s instructions.
| District / Region | Est. Bot Penetration (%) | BEP Vote Share (%) | PAS Vote Share (%) | Deviation from Nat. Avg. |
|---|---|---|---|---|
| Gagauzia | 34. 5% | 88. 2% | 2. 1% | +64. 0% (BEP) |
| Orhei | 28. 1% | 66. 4% | 18. 5% | +42. 2% (BEP) |
| Taraclia | 22. 0% | 58. 9% | 9. 4% | +34. 7% (BEP) |
| Bălți | 19. 5% | 48. 7% | 24. 3% | +24. 5% (BEP) |
| Chișinău (Capital) | 6. 2% | 14. 1% | 56. 8% | -10. 1% (BEP) |
| Diaspora (West) | <1. 0% | 3. 2% | 81. 5% | -21. 0% (BEP) |
The Diaspora Firewall
The most significant failure of the “Stop UE” operation was its inability to penetrate the Moldovan diaspora in Western Europe. While the bot successfully recruited users in Russia, Italy, and Germany, the conversion rate outside of Moldova and Russia was negligible. The 2025 election saw record diaspora turnout, with over 320, 000 votes cast abroad. This demographic broke heavily for the Party of Action and Solidarity (PAS), neutralizing the 24% bloc purchased by the bot network.
The data suggests that the “recruit-to-pay” model requires a specific socioeconomic environment to function, namely, low income and high dependency on remittances. In the diaspora, where voters are economically independent of the Moldovan state and Shor’s charity, the bot’s transactional logic collapsed. The “Stop UE” narratives regarding energy prices and war fears also found little traction among voters already living in secure EU jurisdictions.
Conclusion: A Captured Minority
The “Stop UE” chatbot did not steal the 2025 election, it successfully captured a quarter of the electorate. The 24. 20% result for the Patriotic Electoral Bloc represents a “hard floor” of voters who have been fully integrated into a parallel digital state. These citizens are paid, informed, and mobilized by a foreign adversary through a single app. While the pro-European forces retained a legislative majority (55 seats), the existence of a digitally managed, paid opposition bloc poses a permanent destabilization threat to Moldova’s governance.
