The Russian FIMI Playbook in Moldova

Russland nutzt in Moldau gezielte Infor­ma­ti­ons­ma­ni­pu­lation als Teil einer umfas­senden hybriden Strategie, um demokra­tische Prozesse zu desta­bi­li­sieren und das Vertrauen in staat­liche Insti­tu­tionen zu unter­graben. Die Erfah­rungen in Moldau zeigen jedoch, dass Resilienz, gute Regie­rungs­führung und demokra­tische Kontrolle wirksamere Antworten darauf sind als Zensur allein.

Executive Summary

Moldova underwent the most intensive FIMI (foreign infor­mation manipu­lation and inter­fe­rence) Europe has ever seen, and its defences held. The core lesson: FIMI is a gover­nance challenge, not a media challenge; Russian opera­tions amplify gover­nance deficits that already exist. Five priorities follow, for Chișinău and Brussels alike: treat FIMI as a good-gover­nance problem; prioritize resilience over censorship; follow the money — banks, cards, crypto; learn faster than the adversary; and treat democratic oversight as an asset, not an obstacle. Ultim­ately, Russia is competing less for control over infor­mation than for control over citizens‘ trust. 

I. Country context and strategic relevance

Why Moldova matters to Russia. Moldova’s importance is defined less by what it is than by where it stands: an EU candidate country negotiating accession on the immediate flank of the war against Ukraine. Whether a post-Soviet state can complete a democratic, European trajectory in the face of sustained Russian resis­tance is a question now being tested on Moldovan soil. For Moscow, “losing” Moldova would puncture its claim to a privi­leged sphere of influence; by keeping Moldova unstable, Russia retains its leverage over the wider Black Sea region and compli­cates the provision of support to Ukraine. Moldova is also a low-cost, high-yield target, one with limited adminis­trative resources, no collective-defence guarantees, and permanent neutrality enshrined in the Consti­tution.^[1] That neutrality is treated by Moscow not as a constraint to be respected but as a grey zone to be exploited — inter­fe­rence escalates while remaining below any threshold that would trigger an allied response. The Trans­nis­trian region adds a struc­tural vulnerability: an unreco­gnized adminis­tration, a residual Russian troop presence, and an infor­mation and financial space serving as a platform for influence opera­tions against the rest of the country.

State of relations with Russia. Since February 2022 the relati­onship has been de facto adver­sarial: Moldova has aligned with EU sanctions, drasti­cally reduced its energy depen­dence on Russia, and expelled intel­li­gence officers operating under diplo­matic cover. In response, coercive diplomacy has given way to a sustained hybrid campaign in which the infor­mation domain is the main focus of activities and elections themselves the main objective.

Exploited vulnerabi­lities. Russian FIMI rarely creates vulnerabi­lities; rather, it succeeds by identi­fying, exploiting, and ampli­fying gover­nance deficits that already exist. Corruption, weak insti­tu­tions, gaps in public services, and low insti­tu­tional trust are the true fertile ground and the principal focus of Russia’s infor­mation manipu­lation. Russia also exploits infor­mation vulnerabi­lities, the most conse­quential of which is a fragmented infor­mation space that functions as parallel ecosystems: Romanian-language media broadly support the European course, while a large Russian-language segment remains permeable to Kremlin narra­tives; the media environ­ments in Gagauzia and Trans­nistria are almost entirely dependent on Russian content and infra­structure. Different commu­nities thus inhabit different perceived realities. This fragmen­tation inter­sects with chronic distrust of central insti­tu­tions — a legacy of corruption and insta­bility — while trust remains concen­trated in local figures, such as priests, mayors, and teachers, who become preferred vectors of influence. The pattern extends to the very top of the state: even under the current pro-European government, trust is attached to the President as a person rather than to the ruling party, Parliament, the Government, or even the presi­dency as an insti­tution.[2] Socio-economic grievances (energy prices, inflation, emigration), lingu­istic and identity divisions, and instru­men­ta­lized histo­rical memory (the Soviet victory cult, nostalgia narra­tives) complete the attack surface.

FIMI within the broader toolkit. In Moldova, FIMI is not a standalone media problem but the connective tissue of a coordi­nated hybrid strategy. Infor­mation manipu­lation amplifies electoral corruption networks, mobilizes paid protests, magnifies the effects of cyber­at­tacks and energy pressure, and disguises covertly financed political activity as sponta­neous civic sentiment — a snowball effect in which each instrument raises the yield of the others. Any analysis or response that isolates “disin­for­mation” from this system will undere­stimate it. This paper argues that Moldova offers an important lesson for Europe: FIMI is primarily a gover­nance challenge rather than a media challenge.

II. The Russian FIMI playbook

Strategic objec­tives. The purpose of Russian infor­mation activity in Moldova is desta­bi­lization rather than persuasion. Campaigns aim to generate confusion, corrode trust in insti­tu­tions, polarize society, and paralyze democratic decision-making — the logic of reflexive control. The opera­tional goals are concrete: derail EU accession, delegi­timize the pro-European government and electoral outcomes, and hold Moldova in strategic limbo.

Dominant narra­tives. The narrative set is stable and locally tailored: EU integration means war, loss of sovereignty, and loss of tradi­tional values; the West is dragging Moldova into the Ukraine conflict; the government is a Western puppet and elections are rigged; Moldova is a failed state that cannot survive without Russia; Russia is the protector of peace, faith, and affordable energy. Distinct narrative packages target Russian speakers (sovereignty, NATO aggression, “gender ideology”), rural commu­nities (messages carried by trusted local figures), and the autonomous and separatist regions (loss of autonomy, “Central power is controlled by the West”).

Tactics, techniques, and proce­dures (TTP). The TTP reper­toire has indus­tria­lized and incre­asingly relies on AI:

• Coordi­nated inauthentic behaviour at scale: troll farms, bot networks, and auto-generated pages — civil-society monitoring (WatchDog.MD) identified a network of over 2,000 auto-generated Facebook pages, including 146 pages tied to Șor struc­tures promoting political adver­tising.^[3]
• Imper­so­nation and infor­mation laundering: Operation Overload/​ “Matry­oshka” (Storm-1679), alongside Storm-1516 and Operation Undercut, produced fabri­cated videos imper­so­nating credible Western media and officials; AI-generated deepfakes targeted President Sandu and Western leaders.^[4]
• Platform migration as an adaptive response: after licenses for propa­ganda-linked television broad­casters were suspended,^[5] activity shifted to Telegram, TikTok, and YouTube; campaigns demons­trably learn from regulatory and platform countermeasures.
• Monetized influence: payments to “activists,” bloggers, and protesters via MIR cards issued by the sanctioned Promsvyazbank and, incre­asingly, via crypto infra­structure (the A7/​A7A5 sanctions-evasion ecosystem).^[6]

Actors and channels. State actors — intel­li­gence services and the Russian state media ecosystem with its proxy portals — operate through a dense layer of local inter­me­diaries: the networks of fugitive oligarch Ilan Șor (the Evrazia organization, the “Victory” bloc, the Moldova24 channel)^[7], pro-Russian parties and regional elites (the Gagauz executive under Evghenia Guțul signed coope­ration agree­ments with Evrazia and Promsvyazbank)^[8], and societal vectors including segments of the Moldovan Orthodox Church. A case in point: in 2024, dozens of priests joined Moscow “pilgrimages” financed through Evrazia.^[9] Primary audiences are Russian-speaking commu­nities, older rural TV audiences, Gagauzia, Trans­nistria and Bălți, the diaspora in Russia, and youth reached through TikTok.

Landmark opera­tions, 2022–2026. During the 2022–2023 energy crisis, panic campaigns and waves of paid protests organized by Șor-linked struc­tures sought to convert economic anxiety into pressure for regime change. The October–November 2024 EU referendum and presi­dential election saw inter­fe­rence of unpre­ce­dented scale: Moldovan police documented the transfer of roughly USD 39 million through Promsvyazbank to some 138,000 citizens in a vote-buying scheme,^[10] which was accom­panied by mass disin­for­mation and bomb threats against diaspora polling stations. The referendum passed by the narrowest of margins – 749,719 “yes” votes vs. 739,155 ”no” votes, a margin of some 10,500 out of almost 1.49 million validly cast.^[11] The September 2025 parlia­mentary elections drew the most intensive FIMI effort ever recorded in the country: G7 Rapid Response Mechanism joint monitoring documented over 450 pieces of FIMI content;^[12] Matry­oshka alone generated several times the output observed around recent US elections;^[13] autho­rities reported the removal of roughly 100,000 fake TikTok accounts and over 1,000 cyber­at­tacks on state systems.^[14] The governing pro-European party nevert­heless retained its majority, and post-election protest mobilization failed. Since late 2025, the financing of influence networks has visibly migrated toward crypto rails, and narrative seeding for the next electoral cycles is already under way. Much of this is a preview for the rest of Europe: the crypto-based financing, AI-generated content, and platform migration observed in Moldova are likely to surface elsewhere on the continent next.

III. Resilience and countermeasures

What has worked. Moldova’s response has evolved from impro­vised emergency measures toward an insti­tu­tio­na­lized, whole-of-society – indeed whole-of-democracy – model, engaging parliament, the courts, electoral autho­rities, media, and civil society alongside the executive. The Centre for Strategic Commu­ni­cation and Countering Disin­for­mation (estab­lished by law in 2023, opera­tional since 2024 and streng­thened in 2025)^[15] monitors the infor­mation space, publishes exposure reports, and coordi­nates pre-bunking. The 2023 National Security Strategy, the 2024–2034 National Defence Strategy, and the 2025 National Security Law^[16] expli­citly securitize hybrid threats and infor­mation manipu­lation, creating a lasting legal basis for the response. During the 2024–2025 electoral cycles, it was the combi­nation of responses that was decisive: law-enforcement disruption of vote-buying networks, tenacity on the part of the electoral authority and courts, inves­ti­gative journalism (Ziarul de Gardă’s exposure of the Evrazia scheme)^[17], NGO monitoring and fact-checking (WatchDog.MD, Promo-LEX), and pre-electoral joint monitoring with inter­na­tional partners (G7 RRM, EEAS StratCom Task Force East, the EU Partnership Mission).^[18] Election integrity was preserved despite record-scale inter­fe­rence — a test of insti­tu­tional resilience passed under fire — and Moldova is currently less a victim case study than a resilience laboratory: the site of the most intensive testing in Europe, from vote-buying and illicit financing to AI-generated FIMI, and a source of lessons for the wider continent.

The democratic dilemma. Restrictive measures — license suspen­sions, website blocking — were largely grounded in state-of-emergency powers, and the limited trans­pa­rency and judicial review of these measures hand the adversary its most effective counter-narrative — the “censoring regime”: provoking democratic overreach is part of the design, and the ultimate objective of the Moldovan government  is not only to counter Russian manipu­lation but to preserve democratic legitimacy while doing so — a parti­cular challenge as a permanent, court-tested legal basis for FIMI response is still under construction. Success in countering FIMI must therefore be measured not only by how much manipu­lative content is removed, but by how much insti­tu­tional trust is preserved.

Remaining vulnerabi­lities and gaps. Three gaps stand out. The first is the democratic dilemma described above — striking a balanced response without damaging the democratic legitimacy it is meant to protect. Second, insti­tu­tional sustaina­bility: the counter-FIMI archi­tecture is young, concen­trated in a small pool of specia­lists, and exposed to political and funding cycles — resilience built over five years could be unbuilt in one. Third, the audiences that matter most remain the hardest to reach: Russian-speaking commu­nities, Gagauzia, and Trans­nistria still lack credible public-interest media in their own languages, so debunking and quality journalism rarely penetrate the ecosystems where FIMI is most effective.

Trans­ferable lessons. Moldova’s experience suggests five lessons. Treat FIMI as a national-security and good-gover­nance problem, not a media problem, and insti­tu­tio­nalize the response before the crisis, not during it. Prioritize resilience over censorship: in the long term, the battle is one over trust in democratic insti­tu­tions, and the weapons are media literacy, independent journalism, and government commu­ni­cation that answers citizens’ practical questions rather than restating policy abstrac­tions. Follow the money: FIMI is insepa­rable from illicit financing, and disrupting its payment infra­structure — banks, payment cards, crypto — measurably degrades opera­tions. Insti­tu­tions must also learn faster than the adversary: FIMI adapts between electoral cycles, and standing lessons-learned mecha­nisms matter more than one-off fixes. Finally, democratic oversight of counter­me­a­sures is itself a resilience asset: propor­tionate, trans­parent, and accoun­table responses deny the adversary its most effective counter-narrative; parlia­mentary and judicial scrutiny are not obstacles to countering FIMI but the compe­titive advantage of democracies.

Policy recom­men­da­tions. At the national level: replace emergency-based instru­ments with a permanent legal framework for FIMI response that is subject to judicial review and parlia­mentary oversight; strengthen the basis for theana­ly­tical indepen­dence of the strategic commu­ni­cation function, and secure its resourcing; invest in Russian-language public-interest media and in media literacy across the education system; and make the disruption of illicit financing — banks, payment cards, crypto — a standing pillar of FIMI response rather than an electoral emergency measure. Democratic resilience depends not only on a pro-European political orien­tation but equally on the continued streng­thening of checks and balances, judicial indepen­dence, parlia­mentary oversight, and insti­tu­tional accoun­ta­bility – in short, on good gover­nance. At the European level: treat Moldova as a front-line source of FIMI lessons and syste­matize their transfer across the enlar­gement space; make joint monitoring of the G7 RRM type permanent rather than election-bound and extend it to other exposed partners, backed by common analy­tical cells and a shared TTP database; take action at the EU level on platform accoun­ta­bility — above all Telegram and TikTok — and on crypto-based FIMI financing; and integrate FIMI-resilience and gover­nance-quality bench­marks into the enlar­gement metho­dology itself. Rather than treating FIMI as one instrument among many, European policy should under­stand it as the connective tissue that links and amplifies all other hybrid instru­ments. Russia seeks to weaken democracy not only through disin­for­mation, but also by eroding the insti­tu­tions that generate public trust; the most sustainable response is therefore not stronger censorship, but stronger democratic gover­nance. Ultim­ately, Russia competes less for control over infor­mation than for control over citizens’ trust.

*The views expressed are the author’s own and do not neces­s­arily reflect the position of any organization with which the author is affiliated. Generative AI tools were used to support the drafting and editing process, including source verifi­cation and referencing; the analysis, inter­pre­ta­tions, conclu­sions, and recom­men­da­tions are solely the author’s, who assumes full respon­si­bility for the content.

[1] Consti­tution of the Republic of Moldova, Preamble (European Integration), Art. 11 (permanent neutrality). Official texts of Moldovan legis­lation: https://www.legis.md. Source: Consti­tution

[2] Public Opinion Barometer (BOP) surveys; CBS-Research /​ Institute for Public Policy; see, for example, the September 2025 edition. Source: Barometer survey

[3] WatchDog.MD, report of May 2025: 146 anonymous Facebook pages affiliated with fugitive oligarch Ilan Șor for political adver­tising, plus 315 pages held “stand-by”, forming part of a network of at least 2,167 auto-generated pages. Source: Watchdog Analysis

[4] Attri­bution per Recorded Future, “Russian Influence Assets Converge on Moldovan Elections”, 3 September 2025, and the G7 RRM report on the 2025 elections. Operation Overload is also known as Matry­oshka /​ Storm-1679; see also Storm-1516 and Operation Undercut. Source: Recorded Future Report.

[5] The suspen­sions rested on state-of-emergency powers: Dispo­sition No. 1 of 24 February 2022 of the Commission for Excep­tional Situa­tions (suspension of certain media broad­casts) and the Order of the SIS Director of October 2023 blocking online sources, issued under Parliament Decision No. 41/​2022. Source:  SIS Order

[6] OCCRP /​ CU SENS /​ RISE Moldova, 15 October 2024. A7 is a payments/​crypto firm jointly owned by Șor and the sanctioned Promsvyazbank, which is used to evade Western sanctions; the associated A7A5 rouble-backed stablecoin has since been reported to be used to finance influence opera­tions (EDMO, September 2025). Sources:  OCCRP Report; EDMO Report.

[7] See the SIS report of November 2023 on the criminal group led by Ilan Șor; and Recorded Future (2025) on the Evrazia organi­sation and the Moldova24 television network. Source: Recorded Future Report.

[8] Balkan Insight, 10 April 2024; OSW, 26 April 2024; OCCRP, 15 October 2024. Governor Evghenia Guțul signed coope­ration agree­ments with both Evrazia and Promsvyazbank on monthly “humani­tarian” payments channelled via MIR cards. Sources: Balkan Insight Analysis; OSW Analysis; OCCRP Report.

[9] Inves­ti­ga­tions by deschide.md and Ziarul de Gardă (2024); C. Lowe, P. Nikol­skaya, A. Zverev, “Holy war: How Russia recruited Orthodox priests to sway Moldova’s voters”, Reuters, 26 September 2025. Clergy received MIR cards from the sanctioned Promsvyazbank and were promised roughly €1,000/month for “church repairs”. Sources: ZdG Inves­ti­gation; Reuters Special Report.

[10] General Police Inspec­torate (chief Viorel Cernăuțeanu), press confe­rence of 24–25 October 2024, cited by RFE/​RL and bne Intel­liNews: about USD 39 million (USD 15 million in September, USD 24 million in October) trans­ferred via Promsvyazbank to some 138,000 documented transfer recipients; the autho­rities assessed the actual number of benefi­ci­aries to be higher, though undeter­mined. Sources: Radio Free Europe; Intelli News.

[11] Consti­tu­tional Court of the Republic of Moldova, Judgment No. 24 of 31 October 2024 confirming the results of the consti­tu­tional referendum of 20 October 2024 (case No. 212d/​2024): 1,488,874 valid votes, of which 749,719 were in favour and 739,155 were against; turnout was 50.72% of regis­tered voters. Neither the CEC nor the Court cites results in percentage terms; the widely cited c. 50.35% “in favour is derived from these figures. Source: Briefing by the President of the Consti­tu­tional Court.

[12] G7 Rapid Response Mechanism, “Joint Monitoring of the 2025 Moldovan Parlia­mentary Elections”, Global Affairs Canada, April 2026. Russian state-aligned opera­tions accounted for about 91% of FIMI content aimed at Moldova. Source: G7 Rapid Response.

[13] Valeriu Pașa (WatchDog.MD): the output of Operation Matry­oshka was roughly five times the volume of content targeting Moldova’s elections seen during the last two US elections (New Eastern Europe, 10 October 2025). Source: New Eastern Europe.

[14] Prime Minister Dorin Recean: more than 1,000 cyber­at­tacks on state systems since the start of the year and 100,000 fake TikTok accounts removed (New Eastern Europe, 10 October 2025). TikTok reported blocking over 100,000 fake accounts between 1 July and 9 September 2025 (IWPR). Source: IWPR Report.

[15] Law No. 242/​2023 of 31 July 2023 on the Centre for Strategic Commu­ni­cation and Countering Disin­for­mation (Official Gazette No. 318–321/2023, art. 566), amended by Law No. 247 of 10 July 2025. Official text: StratCom Law.

[16] National Security Strategy, approved by Parliament Decision No. 391 of 15 December 2023 (Official Gazette No. 17–19/2024, art. 28); National Defence Strategy 2024–2034, approved by Parliament Decision No. 319 of 26 December 2024 (Official Gazette No. 1–4/2025, art. 15); Law No. 249/​2025 on the national security of the Republic of Moldova. Official texts: National Security Strategy; National Defence Strategy; National Security Law.

[17] Inves­ti­ga­tions by Ziarul de Gardă into the Evrazia network and the financing of pro-Russian influencers and trolls (2024–2025); see also Kyiv Independent, 25 October 2024, and IFES, “A Lesson in Resilience”. Sources: Kyiv Independent; IFES Study.

[18] Pre-electoral joint monitoring: G7 RRM (April 2026 report); East StratCom Task Force /​ EEAS (2025 EEAS Report on Countering FIMI); EU Partnership Mission in Moldova (since 2023). Sources: G7 RRM Report; EEAS Report.