Interfering from Exile

Fugitive Oligarch Ilan Shor’s Coordination and Promotion of Demonstrations in Moldova

Authors:

Saman Nazari, Alliance4Europe

Jakub Kubś, GLOBSEC

Hannah Schimmele, Polisphere

Ewan Casandjian, Alliance4Europe

Joel Boehme, Alliance4Europe

Thomas Smelter, Alliance4Europe.

Contributors:

Cu Sens

Ziarul de Garda

Executive Summary

This report outlines coordinated inauthentic behaviour (CIB) online ahead of the 2025 Moldovan parliamentary election. Researchers recorded what seems to be a coordinated inauthentic behaviour network that promoted a Telegram bot on Odnoklassniki, TikTok, Telegram, Facebook, and Instagram. Evidence seems to suggest that these networks and bot are connected to fugitive Moldovan oligarch Ilan Shor. 

Ilan Shor, who is in exile after fraudulently orchestrating bank transfers to various entities of a sum beyond $750 million, coordinated efforts in 2024 to directly pay Moldovan voters to vote “no” on the referendum on Moldova’s intentions to join the EU, as well as for participating in protests against the incumbent, pro-EU government and President Maia Sandu. 

Moldovan authorities estimate that $39 million was transferred into the bank accounts of thousands of Moldovans ahead of these votes. These offers were spread on social media platforms VK and Odnoklassniki.

In August 2025, Shor’s official OK profile advertised a Telegram bot called MD Live Check 897, which was seemingly used to rally participants, gather their personal details, and coordinate anti-government protests.

Key data:

• The identified inauthentic behaviour network on Odnoklassniki distributed 5,133 posts
• These posts were spread across 57 primarily apolitical groups on Odnoklassniki
• While a total of 259 unique authors were identified, 13 specific accounts were responsible for 4012 posts, representing 78% of the total dataset, displaying clear signs of automated or coordinated inauthentic behaviour
• In 46% of the cases, the suspected bot accounts posted explicit support for Ilan Shor
• A group of Telegram Channels targeting specific Moldovan cities was also identified as promoting the Telegram bot and Shor’s call for action, seemingly operated out of Russia.
• The Telegram bot was also promoted by another cross-platform network across Facebook, Instagram, and TikTok, seemingly reliant on engaging or paying regular people to republish the content published by Shor or his political coalition, the Victory Block. 
• The call for action and Telegram bot were distributed through channels and groups that had a total of 366k followers or members, reaching at least 30.5k users. The true reach is hard to say due to some social media companies not transparently declaring these numbers. These channels are continuously publishing content, meaning they can reach a significant number of Moldovan users over time. 
• Following the flagging of the video spreading the Telegram bot, TikTok took action, removing all but two accounts. Instagram and Facebook took down all instances of the video, but did not take any noticeable actions against the CIB network accounts.

1. Background and Biography

Ilan Shor is a Moldovan oligarch originally born in Israel and currently residing in Russia. Following his father’s passing, Ilan Shor took over his business empire, mainly consisting of duty-free stores and construction companies. 

Seeking to expand his business portfolio, Shor acquired a local Moldovan football club at the age of 23. Simultaneously, he cultivated his public image by connecting with the Moldovan elite and funding philanthropic projects. 

In 2012, Shor began purchasing shares in three major Moldovan banks. Then, by 2014, he was appointed as chairman of the Banca de Economii. Behind the scenes, Shor began enacting a complex heist plan. He first extended the bank’s lending capacity beyond normal range while also setting up several offshore companies hidden behind complex administrative structures. 

Between the 24th and 26th of November 2014, bank transfer loans exceeding $750 million in value were executed between Shor’s newly acquired bank and these offshore companies. To obfuscate the origin of the transactions, these transfers were ricocheted through multiple countries and accounts.

The following day, on Nov. 27, a van containing archival records from one of the banks was found burned down. The loss of data affected all three banks, with digital records wiped from their servers. 

In late 2014, to prevent a collapse of the economy, the government decided to bail out the three banks involved in the scheme: Banca de Economii, Banca Socială, and Unibank. The cost incurred by the heist amounted to 1/8th of Moldova’s Gross Domestic Product. 

The following year, the independent consultancy, Kroll, successfully traced the heist back to Shor. This report was later corroborated by a 2016 audit by the National Bank of Moldova. In 2017, Shor was sentenced to 7.5 years in prison for money laundering, fraud, among other charges. In 2019, while under house arrest, Shor successfully evaded charges by fleeing to Israel. 

He is believed to have subsequently travelled to, and settled with his family, in one of the most exclusive enclaves of Moscow’s suburbs, Rozhdestvenno, Barvikha. The Shor family home also happens to be a short drive away from Vladimir Putin’s spokesman, Dmitry Peskov’s estate. This affluent residence was previously undeclared during Shor’s time in public office in Moldova, but was discovered recently (March 2025) as a part of an investigation by RISE Moldova.

1.1 Political Career 

Despite his crimes in 2014 and susequent sentence in 2017, Shor decided to pursue a political career in Moldova. In 2015, he was elected mayor of the Moldovan town of Orhei with 62% of the vote. In 2019, he secured a seat in the Parliament of Moldova and was reelected in 2021, along with five other members of his “ȘOR Party”. In 2023, his bank fraud conviction was confirmed in the appeal court, leading to his removal from parliament and the banning of his party from participating in future elections.

Undeterred, Shor proceeded to create a new political entity, the ‘Victory’ bloc, in 2024. A year later, the bloc was sanctioned by the EU for vote-buying schemes in the 2024 election and was recently banned from participating in local elections, including the upcoming parliamentary races, by the Moldovan Central Election Commission (CEC).

1.2 Interference with the 2024 Moldovan referendum on the EU

During the 2024 presidential election and EU referendum, Shor was accused of buying votes, with authorities estimating that $39 million was transferred into the bank accounts of thousands of Moldovans. People were offered money to vote “no” in the referendum on Moldova’s EU accession, as well as to participate in protests against the incumbent, pro-EU government. 

The activity was reportedly coordinated via a vast network of Telegram bots, where people were instructed on how to open a bank account and which tasks to do in order to receive money. 

2. Demonstration Promotion video

On August 11, Shor published a video on his VK channel as well as on Telegram (channel blocked in the EU) and Odnoklassniki (OK.ru), calling on his followers to launch a demonstration against the current government, offering to pay them 3000 dollars per month. The protest was announced for August 16, 3:00 pm at the Great National Assembly Square. In his video, Shor explained that attendees would be given a bank account and start receiving daily payments, equating to a monthly sum of 3000 dollars. 

Four more videos followed this first call for demonstrations: 

• On August 12, Shor escalated his call for action against the government, asking people to bring tents and set up camp on Great National Assembly Square in Chișinău. He also encouraged viewers to engage in civil disobedience with actions such as refusing to pay taxes. Here again, he made the offer of $3000 in exchange for their participation. 
• On August 14, in response to the authorities’ action against the demonstration on the Great National Assembly Square, Shor announced the Chișinău railway station as the new protest location. In this video, he also argued that people were not paid to demonstrate – but rather “compensated for the wages they will not receive by coming to the protest”.
• On August 15, he directly urged police officers to dismiss any orders given by the authorities and to instead “take the side of the Moldovan people.” 
• On that same day, August 15, Shor followed up with another video, further promoting the demonstration, while also sharing a link to a Telegram bot called MD Live Check 897, advertising it as the way to become part of the action.

2.1 Telegram Bot

The Telegram Bot promoted in relation to Shor’s video was infiltrated by investigative journalists from Cu Sens and Ziarul de Garda, using fabricated details to register.

They found the following behaviour: 

1. The Telegram bot prompts users to choose either the Romanian or the Russian language. 

2. Thereafter, the bot informs the user of the location and time of the demonstration, telling them that they will have to perform important and significant tasks that will result in the participants receiving bonuses. 

These tasks are listed as:

• Participate in meetings and events;
• Maintain telephone contact with representatives of the organisation;
• Help organise and inform citizens;
• Express your opinion in surveys and discussions;
• Distribute informational materials;
• Be an active representative of the movement at events;
• Publish posts on social networks on the topic of the activity.

The bot then proceeds to instruct users that they need to register to participate. The bot requests the user’s passport data, phone number, location data, and an image of the user’s face. 

The day before the August 16th demonstration, the bot provided the following message: 

“The event will start this Saturday, August 16, at 3:00 PM, at the Chisinau Railway Station, Strada Piața Gării 1.

When you are at the event, you will need to share your geolocation. To do this, select 📎, then “Geolocation”, then “Geolocation broadcast”. After the event has ended or you have left it, the broadcast can be cancelled.”

Cu Sens and de Garda report that the bot is likely to be activated and used again, according to Ziarul de Garda.

2.2 Cross-Platform Amplification of Shor’s Video

Between 15 and 18 August, our investigation shows that 117 social media accounts amplified Shor’s video and accompanying text containing a link to the Telegram bot, re-uploading it across platforms: 64 groups on Odnoklassniki (Ok.ru), 9 channels on TikTok, 8 assets on Facebook, 8 on Instagram, 4 on Telegram, and 1 on YouTube. 

Ilan Shor operates OK.ru and VK social media channels where he publishes original content. Shor is sanctioned by the European Union, which means that social media platforms need to block his content from being accessible to European audiences, as made clear by Science Feedback and Alliance4Europe’s sanctions report. Ok.ru and VK have yet to comply with these sanctions, while all other social media platforms commonly used in Moldova do. 

The initial videos by Shor promoting the demonstration were published on his OK.ru and VK accounts. While both accounts were used to promote the video, the Ok.ru profile was found to have shared the link to the Telegram bot. 

Across social media platforms, a wide variety of accounts are systematically republishing the content from Shor’s account, circumventing sanctions against him. Some of these show clear signs of coordinated inauthentic behaviour, while others seemingly belong to covert malign influence operations. 

We have identified four different sets of accounts: One set belongs to Gagauznews, another is tied to a network operating on Ok.ru, the third is 23 Telegram Channels, and, lastly, a group of ostensibly coopted individuals republishing Shor content, presumably for payment, although we do not have direct evidence for this.

2.3 Gagauznews

Gagauznews was the platform with the highest reach among the amplifying entities. It is a news agency centred around publishing Russian propaganda within Gagauzia, an autonomous Moldovan region. As shown by a previous report by Alliance4Europe, Gagauznews is owned and controlled by close associates of Ilan Shor, who himself is also under EU sanctions, and is believed to be part of a wider propaganda network controlled by the oligarch. It has repeatedly encouraged Moldovan citizens to protest the government and reposted interview videos of Ilan Shor. For example, Gagauznews promoted the Telegram bot across their social media channels, sharing it to over 30,000 subscribers across several platforms. 

Image 1: Screenshot of Gagauznew’s Telegram channel advertising Shor’s bot

2.4 Social Media Platform Odnoklassniki

Odnoklassniki in Moldova has shifted over the past decade from a mainstream social platform to a niche network dominated by older, rural audiences. According to the Institutul de Politici Publice, an NGO based in Chișinău, between 2017 and 2019, the share of users over 50 nearly doubled from 16% to 31%, while younger users abandoned the platform in favour of Facebook and Instagram. By 2019, the typical Moldovan Odnoklassniki user was rural-based (57%), female (57%), and over 40 years old, with pensioners making up the largest occupational group at 38%. Despite this skew, the platform still counted around 810,000 monthly users in Moldova in 2019, making it the country’s second most popular social network at the time.

These accounts show clear signs of inauthentic behaviour, either via automated accounts, purchased accounts, or belonging to people being paid by Shor. Which of these three is prevalent is hard to provide without proprietary data. We believe there is evidence to suggest the latter as the operational structure of the scheme. For instance, in the post accompanying the Telegram bot, there is language informing participants that they were to “distribute informational materials” and “publish posts on social networks on the topic of the activity” and receive a “bonus” in return.

Image 2: Screenshots showing coordinated sharing of posts on groups by an account belonging to the pro-Shor bot network.

2.5 Influence Operation on Odniklassniki

Odnoklassniki has been identified as a conduit for Russian influence operations. In Moldova, researchers documented 170 active pro-Russian groups with over 1,000 members each, underscoring the way Odnoklassniki’s older, rural user base – a demographic which often suffers from lower media literacy – has been systematically targeted by influence operations. This vulnerability, combined with the reach of large groups, makes Odnoklassniki a continuing hub for coordinated propaganda, even as its mainstream popularity has waned.

This coordinated network was first discovered while researchers were tracing the circulation of an Odnoklassniki post encouraging readers to subscribe to a bot account on Telegram. This bot, according to the post, was used to pay participants for attending pro-Șor protests – a mobilisation technique documented in previous election cycles by ZdG. During the investigation into the distribution of this Telegram post, researchers identified roughly one hundred individual posts across different groups.

In total, 5,133 posts originating from 57 groups on Odnoklassniki were identified. These posts were produced by 259 unique authors, but, after further inspection, a much smaller subset stood out. 

Despite their small number, these suspected bots were highly prolific: they were responsible for 4,012 posts, representing 78% of the dataset, compared to just 1,121 posts (22%) generated by other accounts. Among the suspected bot accounts, 46% of their posts (1,841) contained direct support for Ilan Shor.

A closer look at the content shared by the suspected bot accounts shows that their activity is highly centralised. The overwhelming majority of posts originated from just two Odnoklassniki pages: “Молдова моей мечты”, which accounted for 1,746 posts, and “Молдова сегодня”, with 1,163 posts. Many of the other instances of posts mentioned above, are reposts of these original posts.

Beyond these two hubs, the bots also amplified content – though in much smaller volumes – from several other pages, including “Большая игра” маленькой Молдовы (321 posts), Зама ✼ Zama (253), Salut Молдова! (28), Drepturile omului în Republica Moldova (26), Комитет спасения Молдовы (21), Комитет спасения Молдовы свобода слова (18), Гагаузия сегодня (15), Россия-Молдова: история, политика, дружба (9), and Sputnik Молдова: новости в Молдове и мире (4).

During the analysis, a number of accounts were identified as closely resembling bots. These accounts were responsible for a large portion of the activity on the network, publishing thousands of posts altogether. The table below lists the most active ones:

 Table 1: Accounts engaged in the operation on OK.ru

These bots were active in groups which were primarily not political spaces. Instead, those groups make up a wide cross-section of ordinary online communities on Odnoklassniki, which can easily be exploited for coordinated messaging. Broadly, they fall into the following four categories: 

1. Every day, non-political spaces: A large share of groups are devoted to everyday topics such as buying and selling goods, job postings, parenting advice, or lifestyle interests. These spaces are created for practical purposes and attract large, active audiences. However, because moderation is often lax, these groups are particularly vulnerable to infiltration. Inauthentic political content can be published alongside posts about baby clothes, used cars, or local services without garnering any enforcement or reaction.
2. Local and regional communities: Another major cluster of groups focuses on specific towns and regions such as Edineț, Orhei, Bălți, Rîșcani, Taraclia, or Găgăuzia. Their content emphasises nostalgia, local pride, or community news. Content targeting these groups taps into shared identity and place-based belonging, making the messages more relatable and harder to dismiss.
3. Diaspora and national identity: Many groups connect Moldovans living abroad in countries like Germany, Italy, or France, while others are dedicated to celebrating national traditions and culture. These spaces highlight unity, patriotism, and cultural pride. When content circulates in this space, it positions itself as part of the conversation about “who we are” as Moldovans, extending the reach of the network far beyond national borders.
4. News and information channels: Finally, a portion of groups present themselves as news outlets. Some share updates under generic titles such as Latest news from Moldova (Ultimele știri din Moldova) or Moldova – News (Moldova – Știri), while others borrow the names of recognised media like Pro TV Chișinău or Argumenti.md. By blending in with what appears to be ordinary news content, inauthentic content gains an additional layer of credibility and spreads more easily across audiences.

This network of bots systematically exploits the openness of Odnoklassniki’s diverse groups – from classifieds to diaspora forums – ensuring that pro-Șor and pro-Russian narratives circulate widely in spaces where users do not expect to encounter organised political content. In total, these groups bring together 278,869 participants, meaning that the content is funnelled to very large audiences, effectively turning these groups into hubs for mass dissemination targeting Moldovan communities both at home and abroad.

The network of bots targeting open-access groups with election propaganda is visualised on the graph below.

Image 3: Green nodes represent the profiles that shared pro-Shor content to the red nodes that are OK.ru groups.

Analysis of the content shared by suspected bot accounts shows a clear alignment of narratives that both support pro-Russian opposition figures and attack the pro-European government and its partners:

Supportive narratives:

• Ilan Șor, Alexei Lungu, Evghenia Guțul, and Marina Tauber are framed as victims of political repression and as defenders of sovereignty, tradition, and “the people.”
• The Pobeda bloc, ȘANSĂ, and allied parties are presented as unfairly excluded from politics, yet positioned as the “true voice” of Moldovans.
• Russia is portrayed as a reliable partner offering markets, economic aid, migration benefits, and historic protection from fascism
• Pro-Russian regions (Gagauzia, Transnistria) are cast as oppressed by Chișinău and deserving solidarity.

Attacking narratives:

• Moldovan President Maia Sandu and her affiliated party, PAS, are consistently depicted as authoritarian, corrupt, anti-Moldovan, and as Western puppets selling out national interests.
• The EU and NATO are characterised as hostile or indifferent, promoting “Russophobia,” militarisation, and unwanted social agendas.
• Romania is occasionally framed as a direct threat to Moldovan sovereignty, tied to asset takeovers and potential unification schemes.

Videos and photos of the demonstration on 16 August are circulated widely on official Shor-associated channels as well as on supporter accounts, highlighting both the protest itself as well as reactions by law enforcement.

2.6 Moldovan Cities Telegram Channels

A network of 23 accounts and groups with names like “Cahul Today” and “Balti 24/7” were used to amplify the videos and Telegram bot (e.g. 1, 2, 3). 

These channels, all named after different Moldovan cities, commonly publish around the same topics during the same day, but use different imagery and wording to do so most of the time. Yet, they show clear signs of being part of the same coordinated inauthentic behaviour network. 

Looking beyond the narratives promoted, the accounts were all created or activated on the 1st of June 2024. Their first post, published by the accounts, all mention either the International Children’s Day or the first day of summer, showing a clear sign of being part of the same network.

Image 4: The Telegram account creation time. 

The Telegram analytics tool TGstat also claims that all the channels are being operated from Russia. 

Image 5: TGstat claiming that the channel is operated from Russia. 

Out of the 23 channels, all of them shared the Telegram bot or the call for action video by Shor.

Table 2: Telegram channels identified

While we cannot fully attribute this network to Shor, at the very minimum, we can say that they are promoting his and Russia’s interests. 

2.7 Co-opting Citizens to launder Shor and Victory Block Content

Across TikTok, Instagram, and Facebook, at least 20 social media channels republished the videos and the Telegram bot link. Some of these ostensibly belong to regular people, while others appear to have been created purely for the distribution of the content. 

These accounts often share nearly identical content, ostensibly originating from Shor’s OK and VK accounts, or the social media pages of Shor’s political coalition, the Victory Block. 

Image 6: Showing one of the Instagram channels republishing a post by Ilan Shor’s VK account. 

The activity shows signs suggesting coordination, given the Telegram bot’s own description of offering bonuses for distributing materials and posting online, and the pages regurgitating the same content, with only slight deviations from the original (e.g., different title or an opening sentence) (See images below). 

Out of the 20 accounts, 19 regularly publish in both Romanian and Russian. 

Often, the posts contained both languages at once, likely to be able to reach as many Romanian speaking users as possible. 

Images 7: Many examples of the same post being published across platforms. Click the image to see them all.

Six accounts appear to be authentic accounts, belonging to genuine users, whose motivations for participation in this initiative are unclear, but may involve compensation (as is suggested in the Telegram bot description). The authenticity of the accounts is judged based on several factors: their creation dates, initial postings, profile pictures, and overall activity. 

We believe these social media accounts are being used to amplify the messaging of the Victory Block and launder the content of the EU-sanctioned individual, Ilan Shor, reaching audiences that otherwise would not have been exposed to his content. The platforms have a legal obligation to geofence or remove sanctioned individuals from being able to reach European audiences through their services. By hiding the origin of the content, these accounts are circumventing the ban. 

Shor’s and the Victory Block’s use of regular citizens to spread content has been well documented by investigative journalists at ZdG, who infiltrated one of Shor’s influence operations. Their investigation uncovered how Shor is mobilising Moldovan citizens and offering to pay them to participate in different digital actions, including posting specific messaging. 

The true number of these channels is unknown. Our investigation focused on identifying those who amplified this specific video and Telegram bot. However, others have been identified that are operating in the same way.

3. Demonstration Narratives

In the video amplified by Shorm, Shor called for the demonstration with the explicit goal of “removing the regime”, referring to long-exploited narratives such as an alleged tyrannical system of foreign-imposed dictatorship, the government’s incapability and its responsibility for poverty, as well as Western propaganda and interference promoted by PAS. The authorities’ refusal to authorise the demonstration, from the perspective of The Victory Bloc, is declared undemocratic and framed as a means of intimidation, and silencing of the opposition. Alleged police brutality and unlawful behaviour, and arrests by law enforcement are overtly highlighted, playing into the overarching narrative of the “authoritarian state that is afraid of its own people”, and which has to resort to violence. 

4. DISARM Objectives and Techniques

DISARM is a taxonomy that allows researchers to codify the objectives and manipulative techniques used by influence operators. The objectives and techniques that are used in this particular disinformation campaign are capitalised, italicised, and are followed by parentheses () with the objective’s or technique’s number and a link to its description. E.g. Create Localised Content (T0101). 

This case illustrates how a Telegram Bot was promoted through a call-to-action video, distributed through a series of different mechanisms, and used to coordinate funded proxies to participate in an inauthentic demonstration. 

The videos and chatbot aimed to Cultivate Support for the demonstration (T0136.005) and Encourage (T0138.001) participation. The demonstration in turn aimed to Smear (T0135.001) the ruling government to topple it. 

The operation used the Call to Action to Attend (T0126.001) video on engaging Moldovan citizens, relying on their Authentic Local Persona (T0143.001, T0097.101) to give the operation legitimacy. These citizens were made into Funded Proxies (T0093.001), Paying for Physical Action (T0057.001) (participating in a demonstration), resulting in them having Fabricated Activist Personas (T0143.002, T0097.103). These proxies were seemingly Incentivised to Share (T0120) content, likely through a Direct Messaging App (T0153.007) (Telegram), where they received instructions. 

The amplification relies on Coopting Trusted Individuals (T0100.001), meaning regular Moldovan citizens with existing social media profiles, followed by friends and family. These profiles then amplify Shor and the Victory Block by Using Copypasta (T0084.001), the practice of Cross-Posting (T0119) content across accounts and Across Platform (T0119.002).

5. Potential Impact

While it is always difficult to establish the precise impact of an influence operation, we try to assess it based on two parameters: Reach (the amount of views, interactions, and followers) and Outcome (real-world impact of an operation). 

Reach is hard to correctly measure, as we lack view metrics from Instagram and Facebook, and these metrics are easy to fabricate. To supplement it, we use followers, giving the total number of people that potentially could be reached. 

5.1 Reach

In total, the video and Telegram bot were republished at least 139 times. 

These 139 republications gained 1795 interactions, 30.5k views, and were shared by accounts and groups that have over 366k followers and members in total. A large majority of the 366k followers are from platforms where the platforms do not declare the viewers, so the true amount of views could be significantly higher. For reference, the population of Moldova is close to 2.4 million.

5.2 Outcome

According to ZdG, only a few dozen people attended the demonstration on August 16, despite the Victory Bloc announcing up to 10,000 protestors. This followed strong messaging by the authorities in the previous days that no legal infractions would be tolerated. The police detained around 70 people during the protest for various offences, including accepting bribes to attend meetings, hooliganism, or disorderly conduct. 76 tents and four sleeping bags were seized, demonstrating that people’s actions were aligning with Shor’s desire for a longer-lasting protest. ZdG also reports that people were spotted receiving instructions on how to obtain their “compensation” for participating.    

Shor and his allies also called for another demonstration on August 23. 

The 16th of August demonstration, organised by Shor, was considerably smaller in both scale and impact when compared to those of previous years. This change can be largely attributed to the government’s mitigation efforts: The head of the Moldovan police appropriately communicated the legal risks that protestors may encounter before the demonstrations. During the protests, arrests and seizures of tents prevented prolonged activity.

6. Actions and Recommendations

The channels involved in these operations have all been flagged on the social media platforms for sharing content from a sanctioned entity and being part of a coordinated inauthentic behaviour network (platform policy violation). 

There was one platform, on which the behaviour was not flagged, OK.ru, as it lacks a system for reporting content beyond fraud.

The flagging to Facebook, Instagram, TikTok, and YouTube led to mixed results. 

TikTok removed 6 out of 8 accounts flagged to them. It’s unclear why the two others were not taken down. 

On Facebook, one flagged group was taken down, but the account of the administrator was left up. Another two accounts were also taken down, leaving 4 accounts online. While only two accounts were taken down, all the iterations of the video were removed. 

On Instagram, all the reported posts were taken down, but the accounts were all left online. 

It is unclear why Meta took action against the individual posts, long after the post had already served its purpose, and did not take action against the pages themselves. The takedown of the posts is at best a symbolic action, without any real impact, as the accounts can continue to operate and be used to inauthentically spread Shor’s and the Victory Blocks’ content. 

Telegram did not take any actions against the channels we flagged to them, continuing to allow the network to interfere in the Moldovan Elections.  

Following the first round of reporting, we flagged the accounts, instead of the posts.

Our recommendations for the course of action are as follows: 

1. EU institutions and member state authorities should support Moldova in pressuring Telegram to take down the Telegram bot, and its user records provided to the Moldovan authorities to investigate. Since April 30, 2025, Moldovan law explicitly prohibits the solicitation, acceptance, or receipt of financial incentives for participating in public assemblies, particularly those connected to political advertising.
2. Moldova should consider whether Ok.ru, a Russian social media platform owned by VK (mail.ru), should be blocked in the country during the election period to stop a clear avenue for manipulation.
3. Social media platforms should track the content posted by Shor and block the spread of his content by third-party accounts, enforcing EU sanctions, and ensuring that their content does not reach the Moldovan diaspora in Europe, a group that makes up around  21% of Moldova’s citizens.
4. Gagauznews, considering its ownership by a sanctioned entity, should be geofenced from European audiences by the social media platforms, adhering to EU sanction law. 
5. The EU and Moldova should continue to work closely together on enacting sanctions, including developing mechanisms for joint sanction enforcement.

   7. Project disclaimers

This report was made possible through the FIMI-ISAC project ‘FIMI Defenders for Election Integrity’ and the Counter Disinformation Network infrastructure.