The Russian FIMI Playbook in Moldova

Executive Summary

Moldova underwent the most intensive FIMI (foreign infor­mation manip­u­lation and inter­ference) Europe has ever seen, and its defences held. The core lesson: FIMI is a gover­nance challenge, not a media challenge; Russian opera­tions amplify gover­nance deficits that already exist. Five prior­ities follow, for Chișinău and Brussels alike: treat FIMI as a good-gover­nance problem; prior­itize resilience over censorship; follow the money — banks, cards, crypto; learn faster than the adversary; and treat democ­ratic oversight as an asset, not an obstacle. Ultimately, Russia is competing less for control over infor­mation than for control over citizens’ trust. 

I. Country context and strategic relevance

Why Moldova matters to Russia. Moldova’s impor­tance is defined less by what it is than by where it stands: an EU candidate country negoti­ating accession on the immediate flank of the war against Ukraine. Whether a post-Soviet state can complete a democ­ratic, European trajectory in the face of sustained Russian resis­tance is a question now being tested on Moldovan soil. For Moscow, “losing” Moldova would puncture its claim to a privi­leged sphere of influence; by keeping Moldova unstable, Russia retains its leverage over the wider Black Sea region and compli­cates the provision of support to Ukraine. Moldova is also a low-cost, high-yield target, one with limited admin­is­trative resources, no collective-defence guarantees, and permanent neutrality enshrined in the Consti­tution.^[1] That neutrality is treated by Moscow not as a constraint to be respected but as a grey zone to be exploited — inter­ference escalates while remaining below any threshold that would trigger an allied response. The Transnis­trian region adds a struc­tural vulner­a­bility: an unrec­og­nized admin­is­tration, a residual Russian troop presence, and an infor­mation and financial space serving as a platform for influence opera­tions against the rest of the country.

State of relations with Russia. Since February 2022 the relationship has been de facto adver­sarial: Moldova has aligned with EU sanctions, drasti­cally reduced its energy depen­dence on Russia, and expelled intel­li­gence officers operating under diplo­matic cover. In response, coercive diplomacy has given way to a sustained hybrid campaign in which the infor­mation domain is the main focus of activ­ities and elections themselves the main objective.

Exploited vulner­a­bil­ities. Russian FIMI rarely creates vulner­a­bil­ities; rather, it succeeds by identi­fying, exploiting, and ampli­fying gover­nance deficits that already exist. Corruption, weak insti­tu­tions, gaps in public services, and low insti­tu­tional trust are the true fertile ground and the principal focus of Russia’s infor­mation manip­u­lation. Russia also exploits infor­mation vulner­a­bil­ities, the most conse­quential of which is a fragmented infor­mation space that functions as parallel ecosystems: Romanian-language media broadly support the European course, while a large Russian-language segment remains permeable to Kremlin narra­tives; the media environ­ments in Gagauzia and Transnistria are almost entirely dependent on Russian content and infra­structure. Different commu­nities thus inhabit different perceived realities. This fragmen­tation inter­sects with chronic distrust of central insti­tu­tions — a legacy of corruption and insta­bility — while trust remains concen­trated in local figures, such as priests, mayors, and teachers, who become preferred vectors of influence. The pattern extends to the very top of the state: even under the current pro-European government, trust is attached to the President as a person rather than to the ruling party, Parliament, the Government, or even the presi­dency as an insti­tution.[2] Socio-economic griev­ances (energy prices, inflation, emigration), linguistic and identity divisions, and instru­men­talized historical memory (the Soviet victory cult, nostalgia narra­tives) complete the attack surface.

FIMI within the broader toolkit. In Moldova, FIMI is not a stand­alone media problem but the connective tissue of a coordi­nated hybrid strategy. Infor­mation manip­u­lation amplifies electoral corruption networks, mobilizes paid protests, magnifies the effects of cyber­at­tacks and energy pressure, and disguises covertly financed political activity as sponta­neous civic sentiment — a snowball effect in which each instrument raises the yield of the others. Any analysis or response that isolates “disin­for­mation” from this system will under­es­timate it. This paper argues that Moldova offers an important lesson for Europe: FIMI is primarily a gover­nance challenge rather than a media challenge.

II. The Russian FIMI playbook

Strategic objec­tives. The purpose of Russian infor­mation activity in Moldova is desta­bi­lization rather than persuasion. Campaigns aim to generate confusion, corrode trust in insti­tu­tions, polarize society, and paralyze democ­ratic decision-making — the logic of reflexive control. The opera­tional goals are concrete: derail EU accession, delegit­imize the pro-European government and electoral outcomes, and hold Moldova in strategic limbo.

Dominant narra­tives. The narrative set is stable and locally tailored: EU integration means war, loss of sover­eignty, and loss of tradi­tional values; the West is dragging Moldova into the Ukraine conflict; the government is a Western puppet and elections are rigged; Moldova is a failed state that cannot survive without Russia; Russia is the protector of peace, faith, and affordable energy. Distinct narrative packages target Russian speakers (sover­eignty, NATO aggression, “gender ideology”), rural commu­nities (messages carried by trusted local figures), and the autonomous and separatist regions (loss of autonomy, “Central power is controlled by the West”).

Tactics, techniques, and proce­dures (TTP). The TTP reper­toire has indus­tri­alized and increas­ingly relies on AI:

• Coordi­nated inauthentic behaviour at scale: troll farms, bot networks, and auto-generated pages — civil-society monitoring (WatchDog.MD) identified a network of over 2,000 auto-generated Facebook pages, including 146 pages tied to Șor struc­tures promoting political adver­tising.^[3]
• Imper­son­ation and infor­mation laundering: Operation Overload/​ “Matryoshka” (Storm-1679), alongside Storm-1516 and Operation Undercut, produced fabri­cated videos imper­son­ating credible Western media and officials; AI-generated deepfakes targeted President Sandu and Western leaders.^[4]
• Platform migration as an adaptive response: after licenses for propa­ganda-linked television broad­casters were suspended,^[5] activity shifted to Telegram, TikTok, and YouTube; campaigns demon­strably learn from regulatory and platform countermeasures.
• Monetized influence: payments to “activists,” bloggers, and protesters via MIR cards issued by the sanctioned Promsvyazbank and, increas­ingly, via crypto infra­structure (the A7/​A7A5 sanctions-evasion ecosystem).^[6]

Actors and channels. State actors — intel­li­gence services and the Russian state media ecosystem with its proxy portals — operate through a dense layer of local inter­me­di­aries: the networks of fugitive oligarch Ilan Șor (the Evrazia organi­zation, the “Victory” bloc, the Moldova24 channel)^[7], pro-Russian parties and regional elites (the Gagauz executive under Evghenia Guțul signed cooper­ation agree­ments with Evrazia and Promsvyazbank)^[8], and societal vectors including segments of the Moldovan Orthodox Church. A case in point: in 2024, dozens of priests joined Moscow “pilgrimages” financed through Evrazia.^[9] Primary audiences are Russian-speaking commu­nities, older rural TV audiences, Gagauzia, Transnistria and Bălți, the diaspora in Russia, and youth reached through TikTok.

Landmark opera­tions, 2022–2026. During the 2022–2023 energy crisis, panic campaigns and waves of paid protests organized by Șor-linked struc­tures sought to convert economic anxiety into pressure for regime change. The October–November 2024 EU refer­endum and presi­dential election saw inter­ference of unprece­dented scale: Moldovan police documented the transfer of roughly USD 39 million through Promsvyazbank to some 138,000 citizens in a vote-buying scheme,^[10] which was accom­panied by mass disin­for­mation and bomb threats against diaspora polling stations. The refer­endum passed by the narrowest of margins – 749,719 “yes” votes vs. 739,155 ”no” votes, a margin of some 10,500 out of almost 1.49 million validly cast.^[11] The September 2025 parlia­mentary elections drew the most intensive FIMI effort ever recorded in the country: G7 Rapid Response Mechanism joint monitoring documented over 450 pieces of FIMI content;^[12] Matryoshka alone generated several times the output observed around recent US elections;^[13] author­ities reported the removal of roughly 100,000 fake TikTok accounts and over 1,000 cyber­at­tacks on state systems.^[14] The governing pro-European party never­theless retained its majority, and post-election protest mobilization failed. Since late 2025, the financing of influence networks has visibly migrated toward crypto rails, and narrative seeding for the next electoral cycles is already under way. Much of this is a preview for the rest of Europe: the crypto-based financing, AI-generated content, and platform migration observed in Moldova are likely to surface elsewhere on the continent next.

III. Resilience and countermeasures

What has worked. Moldova’s response has evolved from impro­vised emergency measures toward an insti­tu­tion­alized, whole-of-society – indeed whole-of-democracy – model, engaging parliament, the courts, electoral author­ities, media, and civil society alongside the executive. The Centre for Strategic Commu­ni­cation and Countering Disin­for­mation (estab­lished by law in 2023, opera­tional since 2024 and strengthened in 2025)^[15] monitors the infor­mation space, publishes exposure reports, and coordi­nates pre-bunking. The 2023 National Security Strategy, the 2024–2034 National Defence Strategy, and the 2025 National Security Law^[16] explicitly securitize hybrid threats and infor­mation manip­u­lation, creating a lasting legal basis for the response. During the 2024–2025 electoral cycles, it was the combi­nation of responses that was decisive: law-enforcement disruption of vote-buying networks, tenacity on the part of the electoral authority and courts, inves­tigative journalism (Ziarul de Gardă’s exposure of the Evrazia scheme)^[17], NGO monitoring and fact-checking (WatchDog.MD, Promo-LEX), and pre-electoral joint monitoring with inter­na­tional partners (G7 RRM, EEAS StratCom Task Force East, the EU Partnership Mission).^[18] Election integrity was preserved despite record-scale inter­ference — a test of insti­tu­tional resilience passed under fire — and Moldova is currently less a victim case study than a resilience laboratory: the site of the most intensive testing in Europe, from vote-buying and illicit financing to AI-generated FIMI, and a source of lessons for the wider continent.

The democ­ratic dilemma. Restrictive measures — license suspen­sions, website blocking — were largely grounded in state-of-emergency powers, and the limited trans­parency and judicial review of these measures hand the adversary its most effective counter-narrative — the “censoring regime”: provoking democ­ratic overreach is part of the design, and the ultimate objective of the Moldovan government  is not only to counter Russian manip­u­lation but to preserve democ­ratic legit­imacy while doing so — a particular challenge as a permanent, court-tested legal basis for FIMI response is still under construction. Success in countering FIMI must therefore be measured not only by how much manip­u­lative content is removed, but by how much insti­tu­tional trust is preserved.

Remaining vulner­a­bil­ities and gaps. Three gaps stand out. The first is the democ­ratic dilemma described above — striking a balanced response without damaging the democ­ratic legit­imacy it is meant to protect. Second, insti­tu­tional sustain­ability: the counter-FIMI archi­tecture is young, concen­trated in a small pool of specialists, and exposed to political and funding cycles — resilience built over five years could be unbuilt in one. Third, the audiences that matter most remain the hardest to reach: Russian-speaking commu­nities, Gagauzia, and Transnistria still lack credible public-interest media in their own languages, so debunking and quality journalism rarely penetrate the ecosystems where FIMI is most effective.

Trans­ferable lessons. Moldova’s experience suggests five lessons. Treat FIMI as a national-security and good-gover­nance problem, not a media problem, and insti­tu­tion­alize the response before the crisis, not during it. Prior­itize resilience over censorship: in the long term, the battle is one over trust in democ­ratic insti­tu­tions, and the weapons are media literacy, independent journalism, and government commu­ni­cation that answers citizens’ practical questions rather than restating policy abstrac­tions. Follow the money: FIMI is insep­a­rable from illicit financing, and disrupting its payment infra­structure — banks, payment cards, crypto — measurably degrades opera­tions. Insti­tu­tions must also learn faster than the adversary: FIMI adapts between electoral cycles, and standing lessons-learned mecha­nisms matter more than one-off fixes. Finally, democ­ratic oversight of counter­mea­sures is itself a resilience asset: propor­tionate, trans­parent, and accountable responses deny the adversary its most effective counter-narrative; parlia­mentary and judicial scrutiny are not obstacles to countering FIMI but the compet­itive advantage of democracies.

Policy recom­men­da­tions. At the national level: replace emergency-based instru­ments with a permanent legal framework for FIMI response that is subject to judicial review and parlia­mentary oversight; strengthen the basis for thean­a­lytical indepen­dence of the strategic commu­ni­cation function, and secure its resourcing; invest in Russian-language public-interest media and in media literacy across the education system; and make the disruption of illicit financing — banks, payment cards, crypto — a standing pillar of FIMI response rather than an electoral emergency measure. Democ­ratic resilience depends not only on a pro-European political orien­tation but equally on the continued strength­ening of checks and balances, judicial indepen­dence, parlia­mentary oversight, and insti­tu­tional account­ability – in short, on good gover­nance. At the European level: treat Moldova as a front-line source of FIMI lessons and system­atize their transfer across the enlargement space; make joint monitoring of the G7 RRM type permanent rather than election-bound and extend it to other exposed partners, backed by common analytical cells and a shared TTP database; take action at the EU level on platform account­ability — above all Telegram and TikTok — and on crypto-based FIMI financing; and integrate FIMI-resilience and gover­nance-quality bench­marks into the enlargement method­ology itself. Rather than treating FIMI as one instrument among many, European policy should under­stand it as the connective tissue that links and amplifies all other hybrid instru­ments. Russia seeks to weaken democracy not only through disin­for­mation, but also by eroding the insti­tu­tions that generate public trust; the most sustainable response is therefore not stronger censorship, but stronger democ­ratic gover­nance. Ultimately, Russia competes less for control over infor­mation than for control over citizens’ trust.

*The views expressed are the author’s own and do not neces­sarily reflect the position of any organi­zation with which the author is affil­iated. Gener­ative AI tools were used to support the drafting and editing process, including source verifi­cation and refer­encing; the analysis, inter­pre­ta­tions, conclu­sions, and recom­men­da­tions are solely the author’s, who assumes full respon­si­bility for the content.

[1] Consti­tution of the Republic of Moldova, Preamble (European Integration), Art. 11 (permanent neutrality). Official texts of Moldovan legis­lation: https://www.legis.md. Source: Consti­tution

[2] Public Opinion Barometer (BOP) surveys; CBS-Research /​ Institute for Public Policy; see, for example, the September 2025 edition. Source: Barometer survey

[3] WatchDog.MD, report of May 2025: 146 anonymous Facebook pages affil­iated with fugitive oligarch Ilan Șor for political adver­tising, plus 315 pages held “stand-by”, forming part of a network of at least 2,167 auto-generated pages. Source: Watchdog Analysis

[4] Attri­bution per Recorded Future, “Russian Influence Assets Converge on Moldovan Elections”, 3 September 2025, and the G7 RRM report on the 2025 elections. Operation Overload is also known as Matryoshka /​ Storm-1679; see also Storm-1516 and Operation Undercut. Source: Recorded Future Report.

[5] The suspen­sions rested on state-of-emergency powers: Dispo­sition No. 1 of 24 February 2022 of the Commission for Excep­tional Situa­tions (suspension of certain media broad­casts) and the Order of the SIS Director of October 2023 blocking online sources, issued under Parliament Decision No. 41/​2022. Source:  SIS Order

[6] OCCRP /​ CU SENS /​ RISE Moldova, 15 October 2024. A7 is a payments/​crypto firm jointly owned by Șor and the sanctioned Promsvyazbank, which is used to evade Western sanctions; the associated A7A5 rouble-backed stablecoin has since been reported to be used to finance influence opera­tions (EDMO, September 2025). Sources:  OCCRP Report; EDMO Report.

[7] See the SIS report of November 2023 on the criminal group led by Ilan Șor; and Recorded Future (2025) on the Evrazia organ­i­sation and the Moldova24 television network. Source: Recorded Future Report.

[8] Balkan Insight, 10 April 2024; OSW, 26 April 2024; OCCRP, 15 October 2024. Governor Evghenia Guțul signed cooper­ation agree­ments with both Evrazia and Promsvyazbank on monthly “human­i­tarian” payments channelled via MIR cards. Sources: Balkan Insight Analysis; OSW Analysis; OCCRP Report.

[9] Inves­ti­ga­tions by deschide.md and Ziarul de Gardă (2024); C. Lowe, P. Nikol­skaya, A. Zverev, “Holy war: How Russia recruited Orthodox priests to sway Moldova’s voters”, Reuters, 26 September 2025. Clergy received MIR cards from the sanctioned Promsvyazbank and were promised roughly €1,000/month for “church repairs”. Sources: ZdG Inves­ti­gation; Reuters Special Report.

[10] General Police Inspec­torate (chief Viorel Cernăuțeanu), press conference of 24–25 October 2024, cited by RFE/​RL and bne IntelliNews: about USD 39 million (USD 15 million in September, USD 24 million in October) trans­ferred via Promsvyazbank to some 138,000 documented transfer recip­ients; the author­ities assessed the actual number of benefi­ciaries to be higher, though undeter­mined. Sources: Radio Free Europe; Intelli News.

[11] Consti­tu­tional Court of the Republic of Moldova, Judgment No. 24 of 31 October 2024 confirming the results of the consti­tu­tional refer­endum of 20 October 2024 (case No. 212d/​2024): 1,488,874 valid votes, of which 749,719 were in favour and 739,155 were against; turnout was 50.72% of regis­tered voters. Neither the CEC nor the Court cites results in percentage terms; the widely cited c. 50.35% “in favour is derived from these figures. Source: Briefing by the President of the Consti­tu­tional Court.

[12] G7 Rapid Response Mechanism, “Joint Monitoring of the 2025 Moldovan Parlia­mentary Elections”, Global Affairs Canada, April 2026. Russian state-aligned opera­tions accounted for about 91% of FIMI content aimed at Moldova. Source: G7 Rapid Response.

[13] Valeriu Pașa (WatchDog.MD): the output of Operation Matryoshka was roughly five times the volume of content targeting Moldova’s elections seen during the last two US elections (New Eastern Europe, 10 October 2025). Source: New Eastern Europe.

[14] Prime Minister Dorin Recean: more than 1,000 cyber­at­tacks on state systems since the start of the year and 100,000 fake TikTok accounts removed (New Eastern Europe, 10 October 2025). TikTok reported blocking over 100,000 fake accounts between 1 July and 9 September 2025 (IWPR). Source: IWPR Report.

[15] Law No. 242/​2023 of 31 July 2023 on the Centre for Strategic Commu­ni­cation and Countering Disin­for­mation (Official Gazette No. 318–321/2023, art. 566), amended by Law No. 247 of 10 July 2025. Official text: StratCom Law.

[16] National Security Strategy, approved by Parliament Decision No. 391 of 15 December 2023 (Official Gazette No. 17–19/2024, art. 28); National Defence Strategy 2024–2034, approved by Parliament Decision No. 319 of 26 December 2024 (Official Gazette No. 1–4/2025, art. 15); Law No. 249/​2025 on the national security of the Republic of Moldova. Official texts: National Security Strategy; National Defence Strategy; National Security Law.

[17] Inves­ti­ga­tions by Ziarul de Gardă into the Evrazia network and the financing of pro-Russian influ­encers and trolls (2024–2025); see also Kyiv Independent, 25 October 2024, and IFES, “A Lesson in Resilience”. Sources: Kyiv Independent; IFES Study.

[18] Pre-electoral joint monitoring: G7 RRM (April 2026 report); East StratCom Task Force /​ EEAS (2025 EEAS Report on Countering FIMI); EU Partnership Mission in Moldova (since 2023). Sources: G7 RRM Report; EEAS Report.