Language selection

Government of Canada Government of Canada

Search

G7 Rapid Response Mechanism Report: Joint Monitoring of 2025 Moldovan Parliamentary Elections

On this page

Executive Summary

Moldova has long been the target of Russian state-aligned foreign information manipulation and interference (FIMI). Like so many other countries, it has increasingly felt the damaging real-world effects of adversarial efforts seeking to polarize open society and undermine democratic processes.

Recognizing that Russian state-aligned actors continue to leverage digital infrastructure and known information operations to target Moldovan audiences, several G7 Rapid Response Mechanism (G7 RRM) members and associate members joined efforts, in consultation with the Moldovan government, to monitor foreign information threats targeting Moldova’s information space leading up to its parliamentary election on September 28, 2025.

This report provides an overview of the G7 RRM’s observations, including:

Foreign Interference

Monitoring for state-sponsored foreign information manipulation and interference (FIMI)Footnote 1 operations took place in three phases.

Phase 1: November 2024 to August 2025

Russian state-aligned FIMI operations accounted for 91% of the FIMI content targeting Moldova. Operation Overload produced more than half of this content. The operations seeded and amplified FIMI content timed with events of strategic importance.

Phase 2: August 2025 to September 2025

Operation Undercut produced more than half of recorded FIMI content, but content attributed to Storm-1516 had the widest reach and garnered the most attention from online audiences.

Phase 3: September 2025 to October 2025

Activity peaked during the weekend of the election (September 27th and 28th) across all Russian state-aligned FIMI networks.  Some of these networks expanded their assets and increased content production to target Moldova and its election process. Notably, Storm-1516 developed a new network dedicated to Moldovan and Romanian audiences.

Actors, Networks and Channels

Overall, G7 RRM partners detected over 450 pieces of FIMI content targeting the 2025 Moldovan parliamentary elections – assessed with high confidence to be linked to known Russian FIMI operations. Several of the most prominent operations – including Operation Overload, Operation Undercut, and Storm-1516, displayed high levels of coordinated activity in attempting to interfere in the election.

Operation Overload

Operation Overload, also known as Matryoshka, was one of the most active campaigns interfering with the election. Through coordinated inauthentic behaviour (CIB)Footnote 2 on platforms such as X, Bluesky, and Telegram, the operation disseminated short-form videos that frequently impersonated authentic news outletsFootnote 3 and exploited narratives that largely targeted President Maia Sandu, in a likely attempt to discredit her individual character and the party’s leadership.

Videos assessed to be created and disseminated by Operation Overload impersonated both Western and Moldovan outlets, producing and disseminating content in English, French, German, Romanian and Russian.

Within Operation Overload-linked videos, the following manipulative narratives were observed:

Figure
Text version

Image of a BlueSky video post disseminating highly likely Operation Overload content. This video impersonated an academic from Harvard Business School and labelled Maia Sandu as the “most talentless president” in the world, 18 April 2025.

Text on the image: “Harvard Business School says Maia Sandu is the most talentless president in the world @hardvard.edu @harvardpress.bsky.social @euronews.com @washingtonpost.com @bloomberg.com @politico.eu”

Figure
Text version

Screenshot of a likely Operation Overload video that was disseminated across Bluesky, X, and Telegram, and claims that Moldova is preparing to open a second front against Russia. The video uses the Euronews logo in a likely attempt to appear as an authentic Euronews news reel.

Text on the image: “Moldova might be preparing to open a second front against Russia.”

Figure
Text version

Example of a likely Operation Overload video which attempts to appear as a EuroNews newsreel, claiming that the “corrupt” Moldovan government turned Moldova into “Epstein’s island.”

Text on the image: “Corrupt government has turned Moldova into Epstein’s island, Romanian foreign minister says.”

Operation Undercut

Operation Undercut, linked to Social Design Agency, Structura and ANO DialogFootnote 5, disseminated videos on X and TikTok. The videos produced AI-generated voiceovers and images and often featured screenshots of mainstream media content, telegram posts and infographics to increase the image of credibility.

Operation Undercut primarily focused on domestic issues and produced content in local languages. However, some Operation Undercut videos have targeted NATO in relation to Moldova, pushing narratives that NATO represents a threat to the country, that a PAS victory would endanger Moldova’s neutrality, and that preparations are being made for NATO to intervene in the transnistrian region.

Operation Undercut demonstrated a high level of resilience, continuously activating new networks within 24 hours of removal of previous networks on X. For example, Operation Undercut activity targeting Moldova was temporarily disrupted when its dedicated X network was removed on September 22. Nevertheless, a new network was activated within 24 hours, a pattern that had already been observed previously. Despite a high volume of publications and resiliency, Operation Undercut content failed to generate significant engagement.

Storm-1516

Storm-1516 leveraged its known pattern of seeding narratives on inauthentic local news websites and publishing videos that were likely AI-generated, and then later promoting this content across a network of X accounts, some of which were verified. Much of the content assessed to be part of Storm-1516 was aimed at discrediting Maia Sandu and PAS, and NATO figured prominently as a direct or indirect target of likely Storm-1516 activity related to Moldova.

During the weeks leading up to the election, Storm-1516 intensified its activity targeting Moldova by exploiting a newly established network of at least 45 new inauthentic websites. These assets posed as Moldovan or Romanian media outlets and posted fabricated stories in Romanian. While Storm-1516 produced less content, the reach of its content was significant – at times generating over a million views. It is believed that Storm-1516 was part of a broader network of over 250 websites that targeted the elections.

Examples of Storm-1516 campaigns included:

Figure
Text version

Screenshot of a likely Storm-1516 video disseminated on X, which promotes false claims about PAS’s alleged political program.

Text on the image: “PAS party – the ruling party of Moldova has unveiled their disastrous political program. They plan to increase personal income taxes, increase the retirement age to 70 years and introduce mandatory conscription for women.”

Figure
Text version

Screenshot of a likely Operation Overload video that was shared on X and shares the false narrative that the United Kingdom would be sending soldiers to serve in Ukraine and Moldova.

Text on the image: “The British government is reportedly seeking to deploy its troops in both Ukraine and Moldova.”

Figure
Text version

Screenshot of a likely Storm-1516 video claiming that the Moldovan government has instructed security forces to violently quell mass protests, allegedly anticipated after the election.

Text on the image: “Moldova’s authorities are prepping their security forces for mass riots. We’ve seen this playbook before on January 6th – first, they steal the election, then they jail anyone who disagrees. #Moldova #ElectionFraud.”

Figure
Text version

Screenshot of pro-Kremlin Telegram channel targeting Moldova’s Gagauz community, sharing a likely Storm-1516 post that claims actors were hired to vote for PAS in diaspora communities.

Text on the image: “Moldovan voter extras: the same people are voting at different polling stations in Verona. Evidence of unusual voting practices among the Moldovan diaspora in Italy has surfaced on social media. It turns out that the same people are acting as voters at different polling stations in Verona.”

Figure
Text version

Screenshot from likely staged Storm-1516 video, which depicts an unidentified man working in a ballot office, burning ballots that were stamped for pro-Russian parties.

Doppelgänger

The Russian state-directed Doppelgänger network showed limited detected activity targeting Moldova. However, this network strategically exploited the recent sentencing of Gagauzia’s Governor Evghenia Guțul to publish and distribute false claims, framing President Sandu as a threat to democracy. The FIMI content was published on the inauthentic French-language site roserouge.org, associated with Reliable Russian News (RRN)Footnote 6, and included a video interview with a purported associate of Evghenia Guțul. Both the article and video were amplified by CIB accounts on X and generated approximately 30k views each.

Portal Kombat

Portal Kombat, also known as the Pravda network, is a Russian state-aligned coordinated FIMI operation comprising of at least 193 websites that disseminated Russian state-aligned content across various languages. The Portal Kombat network used its Moldova-dedicated portalsFootnote 7 to direct Russian FIMI content towards Moldovan audiences, both in Russian and Romanian.

It is likely that Portal Kombat uses generative AI to help produce its content and content republished from Russian overt and covert media sources and Russian state-aligned Telegram channels in a likely attempt to flood the information environment and create the illusion that it posted local Moldovan news and diverse perspectives.Footnote 8

The Portal Kombat network was regularly used as an avenue for amplifying content from Storm-1516 and Operation Overload. While Portal Kombat pages shared hundreds of largely Russian state-aligned content each day, it received minimal levels of authentic engagement.

Russian Foreign Intelligence Service (SVR)

Five days before the election, the Russian Foreign Intelligence Service (SVR) published a press release falsely claiming that the EU and NATO were planning to occupy Moldova. At least 33 articles reporting on the release were published across the websites of state-controlled media, state-linked and unattributed channels across X and Telegram. The articles were published in various languages, including Russian, English, Romanian, and French. The Portal Kombat domains dedicated to Moldova and Romania demonstrated the highest levels of amplification of the release. The release was also amplified by state-controlled media from Belarus and accounts of the Russian and French editions of Chinese state-controlled CGTN.

Key Narratives and Sub-Narratives

Leadership and Governance

One set of narratives targeting Moldova often centered on delegitimizing the Moldovan government and promoting corruption allegations. They attempted to portray the Moldovan government as pawns of Western institutions – including accusing President Sandu and PAS of election fraud, orchestrated by the EU and NATO. The EU was a consistent target, including targeting specific individuals and institutions, such as HR/VP Kaja Kallas, the European Commission, and its President, Ursula von der Leyen.

This narrative peaked during election weekend, with FIMI actors leveraging ongoing accusations of voter fraud and election manipulation by the current government. The Moldovan government was accused of repressing the opposition and manipulating election results by destroying ballots. Russia state-aligned actors promoted narratives that the Moldovan government was limiting choices, bribing voters or giving priority to Moldovan diaspora living in Western countries over those living in Russia.

Targeting President Maia Sandu

President Maia Sandu was the primary target of Russian influence operations. She was frequently portrayed as an inconsistent, mentally unstable, and ineffective leader lacking genuine support from the population. Russian state-aligned FIMI networks also amplified narratives implicating President Sandu in illicit activities, such as drug trafficking, illegal weapon smuggling and human trafficking. Narratives also accused President Sandu of silencing opposition voices in a bid to dismiss her warnings regarding Russian interference.

Foreign Influence and Security

Narratives surrounding the potential militarization of Moldova and its involvement in the war in Ukraine were a dominant, recurring theme throughout the monitoring period. These narratives were used to fuel security concerns, as well as fears around Moldovan sovereignty.  Inauthentic documents and out-of-context videos were leveraged to allege Ukrainian plans to invade the transnistrian region or accusing NATO of allegedly preparing to invade the transnistrian region after the elections. Allegations of bomb threats were also exploited to discourage voter participation. The Moldovan government was repeatedly accused of engaging in suspicious military activity, providing Ukraine with infrastructure, and sending military volunteers to Ukraine.

NATO as aggressive, expansionist, and a threat to Russia

Framing NATO as an aggressive and expansionist threat to Russia was a key part of Russia’s FIMI activity employed in Moldova. PAS was portrayed as a NATO puppet, acting against the country’s constitutional neutrality and the population’s interests. These narratives were disseminated in a coordinated manner across different platforms, particularly on Telegram. Anti-NATO content was subsequently amplified across broader networks, including Russian state-controlled media outlets and other social media platforms, notably X. The Portal Kombat network played an important role in amplification.

Exploiting Domestic Issues

FIMI activity frequently exploited domestic issues prevalent in Moldova, with topics such as immigration, LGBTIQ+ rights and economic concerns. Often, these narratives were leveraged during relevant events, such as claims during the 2025 Moldovan Pride parade that the West is destroying traditional values in Moldova. Other exploited events included: the EU-Moldova Summit, the EU-Moldova Energy Dialogue, the sentencing of Evghenia Guțul, the detention of Alexei Lungu, the military exercise Fire Shield 25, and the no-confidence vote of President Ursula von der Leyen.

Conclusion

Russian state-aligned FIMI assets exploited a wide array of techniques and narratives to target the 2025 Moldovan Parliamentary elections. These networks, dominated by Operation Overload, Operation Undercut and Storm-1516, demonstrated a relentless effort by Russian state-aligned assets to interfere in the democratic processes of a sovereign country and shape public opinion around key narratives.

The G7 RRM will continue to monitor the digital environment for foreign information operations and remains committed to shining a light on these threats.

Date modified: