Russia is one of the critical geopolitical challenges of our time. The threat the Kremlin poses is not simply one of hard power, as we see in Ukraine, but a more complex hybrid challenge that is present in different dimensions in many countries, particularly in Europe.
To fully respond to this threat, we need to fully understand it. Moldova represents a front line in Russia’s hybrid style of warfare that combines conventional military tools with irregular tactics including cyber-warfare, disinformation and economic coercion. The scale and scope of interference in Moldova’s October election, for example, was striking. It set the scene for events in Romania, where interference was deemed so extensive by the Constitutional Court that it took the extraordinary step of annulling the results of the first round of the presidential election and calling for new elections, and contested parliamentary election results in Georgia.
The example of Moldova offers important lessons on the nature of the Kremlin’s asymmetrical threat, as well as how to respond to it.
Beyond Disinformation: Understanding What Is Going On
Understanding Russian hybrid warfare begins with recognising that it rests on the deliberate exploitation of vulnerabilities within open societies. The tools and mechanisms for influence and interference are important, but the starting point is vulnerability.
Authoritarian regimes like Russia have weaponised digital platforms to undermine democracies by exploiting societal openness, embedding their narratives into political discourse, and leveraging economic and social weaknesses.
These influence campaigns are particularly effective because they play on real and persistent challenges within democracies, such as inequality, educational gaps and declining public trust.
Leaders face difficult trade-offs in responding. Cracking down on misinformation risks restricting free media and reinforcing the very narratives these regimes propagate. Meanwhile, addressing long-term structural vulnerabilities requires sustained effort, leaving democracies exposed in the short term.
The understanding of information warfare is hindered by the definitions that are currently favoured. “Disinformation” is a poor way to describe campaigns that often exploit real events and subjective viewpoints. “Foreign interference” does not easily describe a system based on leveraging internal division using local proxies. The idea that it can be countered by simply providing more “facts”, improving media literacy or banning foreign voices is a flawed one.
Moldova’s experience highlights the need for a strategic approach to counter hybrid threats without compromising democratic principles.
Moldova as a Case Study
Moldova has faced an unprecedented series of challenges to its democratic processes in recent years. Between 2021 and 2024, the country underwent three major elections – a presidential election in 2020, parliamentary elections in 2021, and the most recent presidential election and referendum that narrowly backed European Union accession in October 2024. Throughout this period, Moldova has been a testing ground for sophisticated disinformation campaigns and hybrid-influence operations aimed at destabilising its pro-European trajectory.
These campaigns have blended propaganda, financial inducements and community manipulation to exploit societal divisions and undermine public trust in democratic institutions. By October 2024 these hybrid-warfare tactics had reached new heights.
Moldovan fugitive émigré Ilan Shor, who has deep links with Moscow and in 2024 was given Russian citizenship, established Kremlin-backed networks at the centre of what the Moldovan government, the European Union and international election observers say was a multipronged strategy to sway the outcome of the elections. Shor and Moscow have denied having any role in interference.
Western governments suggest that it took Russia several years of preparation to wage this hybrid campaign. Among other things, this effort involved careful selection of vulnerable communities, sociological study and tailoring of narratives that were designed to “ring true”, crowdsourcing recruitment and content production, and financial incentives to galvanise action and protest.
The Atlantic Council’s Digital Forensic Research Lab (DFRLab) provides a detailed account of how Shor built his network. It outlines how mainstream social media, fake accounts and bots, along with paid advertising, helped draw people into a “funnel” where Telegram bots offered cash and other incentives to register themselves and recruit others. Russian bank accounts were set up in the names of these users, who were then tasked with recruiting others. Although major platforms such as Meta eventually removed many fake accounts, the shift to alternative platforms made these networks more resistant to moderation efforts.
The DFRLab research (and extensive research by multiple local and regional journalists) shows how Russian-backed influence operations in Moldova strategically targeted vulnerable communities, using tailored narratives to exploit societal divides. Ethnic minorities were drawn in by messaging that framed Russia as their protector against a hostile or indifferent government in Chisinau, while socially conservative groups were mobilised with fears that EU integration threatened traditional values. Economically disadvantaged populations were especially vulnerable, as propaganda idealised the Soviet era and attributed current hardships to government reforms linked to Western alignment.
Disinformation campaigns operated on multiple channels, from Russian state TV, banned in Moldova but still widely available in Transnistria and autonomous Gagauzia, to Shor-linked TikTok channels, and the propagation of content – often from TV – onto YouTube and other platforms.
Disinformation seamlessly transitioned into organised vote-buying efforts, according to Moldovan officials and international election observers. These operations leveraged the sense of community fostered by propaganda, offering not only financial incentives but also participation in concerts, protests and events that provided belonging to those who felt marginalised. This hybrid approach – blending emotional appeals, community-building and financial inducements – effectively blurred the lines between persuasion and manipulation.
By the time of the presidential elections in October 2024, Moldova says Shor and his associates had established an extensive operation. Following the elections Viorel Cernauteanu, Moldova’s chief of police, stated that approximately 138,000 phone numbers were documented as having received text messages with instructions or links related to accounts with the Russian bank Promsvyazbank (PSB). The PSB accounts, linked to MIR payment cards usable primarily in pro-Russia territories, were allegedly part of a $39 million scheme to influence voters.
Moldovan police and other government officials said the operation involved thousands of “organisers”, “sympathisers” and “couriers”, including several government employees. Local journalists also provided evidence from efforts to infiltrate the network. Organisation was so tightly controlled that participants were instructed to vote against the referendum and President Maia Sandu but were not informed which rival presidential candidate to support until the day before the first round of voting.
In response to these efforts Moldova utilised a combination of strategic communications, law enforcement and grassroots mobilisation.
A strategic-communications centre was established to enhance Moldova’s ability to identify and counter disinformation. Using forensic analysis, the centre exposed manipulation networks on platforms such as Telegram and Facebook. Working in tandem with this centre, Moldovan law enforcement dismantled Telegram groups tied to vote-buying operations and disrupted financial channels linked to Russian proxies. These efforts were bolstered by media-literacy campaigns and engagement with civil society to build societal resilience against propaganda. Without these measures, the impact of hybrid warfare on the elections could have been far more severe.
How to Respond
Despite ongoing efforts by social platforms to combat disinformation and coordinated inauthentic behaviour, significant challenges remain. Much of the content propagated by disinformation campaigns falls within the bounds of legal speech, complicating moderation. Suppressing genuine political dissent – amplified by illicit networks and paid promotion – raises ethical and legal concerns, particularly in politically sensitive environments like Moldova.
Platforms face sophisticated tactics, such as sleeper accounts, bot networks and cross-platform coordination, that evade standard detection methods. Addressing these issues is not merely a technical challenge. Even when AI-driven detection identifies probable cases of coordinated inauthentic behaviour, platform rules emphasising user rights to explanation and redress often hinder decisive action. The lack of local expertise further exacerbates these challenges, as platforms struggle to navigate the nuances of local political discourse without input from civil society and guidance from electoral authorities.
Governments, civil society and platforms must collaborate to bridge these gaps. For example, real-time reporting systems for suspicious activities, co-designed with local technical experts, could significantly enhance the detection and mitigation of disinformation campaigns.
International grants can temporarily address funding gaps, particularly for rural and minority-language communities, but sustainable solutions are needed.
At the same time, broader international assistance must address systemic vulnerabilities. Accelerating justice reforms and building capacity to tackle financial crimes are also crucial steps.
Lessons From Moldova
While many nations remain unprepared for the scale of the hybrid threat Russia poses, Moldova has witnessed it firsthand. While there remains much to do to tackle this threat there is a lot that can be learned from Moldova, both on the techniques Russia uses and ways to respond to them. Key lessons include:
Striking a careful balance between moderating content and free speech. Tackling information warfare requires careful partnership with platforms to protect free speech, identify illicit manipulation campaigns and give civil-society groups the right opportunities to contribute to discourse.
Developing deep cooperation at national and local levels. Government, civil society and platforms need to work closely and effectively to respond to threats in real time.
Building system resilience. This requires, for example, the right judicial reform, enforcement capabilities to tackle crime and funding to vulnerable communities. Reforms of these kind help alleviate pressure points that Russia exploits with its disinformation campaigns.
Whatever unfolds in Ukraine, Russia will remain a key threat to Europe, with hybrid capabilities at the core of this challenge. Efforts must focus on understanding these threats and responding to them effectively, using the best available evidence on what works.