1. Background and Biography

Ilan Shor is a Moldovan oligarch originally born in Israel and currently residing in Russia. Following his father’s passing, Ilan Shor took over his business empire, mainly consisting of duty-free stores and construction companies. 

Seeking to expand his business portfolio, Shor acquired a local Moldovan football club at the age of 23. Simultaneously, he cultivated his public image by connecting with the Moldovan elite and funding philanthropic projects. 

In 2012, Shor began purchasing shares in three major Moldovan banks. Then, by 2014, he was appointed as chairman of the Banca de Economii. Behind the scenes, Shor began enacting a complex heist plan. He first extended the bank’s lending capacity beyond normal range while also setting up several offshore companies hidden behind complex administrative structures. 

Between the 24th and 26th of November 2014, bank transfer loans exceeding $750 million in value were executed between Shor’s newly acquired bank and these offshore companies. To obfuscate the origin of the transactions, these transfers were ricocheted through multiple countries and accounts.

The following day, on Nov. 27, a van containing archival records from one of the banks was found burned down. The loss of data affected all three banks, with digital records wiped from their servers. 

In late 2014, to prevent a collapse of the economy, the government decided to bail out the three banks involved in the scheme: Banca de Economii, Banca Socială, and Unibank. The cost incurred by the heist amounted to 1/8th of Moldova’s Gross Domestic Product. 

The following year, the independent consultancy, Kroll, successfully traced the heist back to Shor. This report was later corroborated by a 2016 audit by the National Bank of Moldova. In 2017, Shor was sentenced to 7.5 years in prison for money laundering, fraud, among other charges. In 2019, while under house arrest, Shor successfully evaded charges by fleeing to Israel. 

He is believed to have subsequently travelled to, and settled with his family, in one of the most exclusive enclaves of Moscow’s suburbs, Rozhdestvenno, Barvikha. The Shor family home also happens to be a short drive away from Vladimir Putin’s spokesman, Dmitry Peskov’s estate. This affluent residence was previously undeclared during Shor’s time in public office in Moldova, but was discovered recently (March 2025) as a part of an investigation by RISE Moldova.

1.1 Political Career 

Despite his crimes in 2014 and susequent sentence in 2017, Shor decided to pursue a political career in Moldova. In 2015, he was elected mayor of the Moldovan town of Orhei with 62% of the vote. In 2019, he secured a seat in the Parliament of Moldova and was reelected in 2021, along with five other members of his “ȘOR Party”. In 2023, his bank fraud conviction was confirmed in the appeal court, leading to his removal from parliament and the banning of his party from participating in future elections.

Undeterred, Shor proceeded to create a new political entity, the ‘Victory’ bloc, in 2024. A year later, the bloc was sanctioned by the EU for vote-buying schemes in the 2024 election and was recently banned from participating in local elections, including the upcoming parliamentary races, by the Moldovan Central Election Commission (CEC).

1.2 Interference with the 2024 Moldovan referendum on the EU

During the 2024 presidential election and EU referendum, Shor was accused of buying votes, with authorities estimating that $39 million was transferred into the bank accounts of thousands of Moldovans. People were offered money to vote “no” in the referendum on Moldova’s EU accession, as well as to participate in protests against the incumbent, pro-EU government. 

The activity was reportedly coordinated via a vast network of Telegram bots, where people were instructed on how to open a bank account and which tasks to do in order to receive money. 

2. Demonstration Promotion video

On August 11, Shor published a video on his VK channel as well as on Telegram (channel blocked in the EU) and Odnoklassniki (OK.ru), calling on his followers to launch a demonstration against the current government, offering to pay them 3000 dollars per month. The protest was announced for August 16, 3:00 pm at the Great National Assembly Square. In his video, Shor explained that attendees would be given a bank account and start receiving daily payments, equating to a monthly sum of 3000 dollars. 

Four more videos followed this first call for demonstrations: 

• On August 12, Shor escalated his call for action against the government, asking people to bring tents and set up camp on Great National Assembly Square in Chișinău. He also encouraged viewers to engage in civil disobedience with actions such as refusing to pay taxes. Here again, he made the offer of $3000 in exchange for their participation. 
• On August 14, in response to the authorities’ action against the demonstration on the Great National Assembly Square, Shor announced the Chișinău railway station as the new protest location. In this video, he also argued that people were not paid to demonstrate – but rather “compensated for the wages they will not receive by coming to the protest”.
• On August 15, he directly urged police officers to dismiss any orders given by the authorities and to instead “take the side of the Moldovan people.” 
• On that same day, August 15, Shor followed up with another video, further promoting the demonstration, while also sharing a link to a Telegram bot called MD Live Check 897, advertising it as the way to become part of the action.

2.1 Telegram Bot

The Telegram Bot promoted in relation to Shor’s video was infiltrated by investigative journalists from Cu Sens and Ziarul de Garda, using fabricated details to register.

They found the following behaviour: 

1. The Telegram bot prompts users to choose either the Romanian or the Russian language. 

2. Thereafter, the bot informs the user of the location and time of the demonstration, telling them that they will have to perform important and significant tasks that will result in the participants receiving bonuses. 

These tasks are listed as:

• Participate in meetings and events;
• Maintain telephone contact with representatives of the organisation;
• Help organise and inform citizens;
• Express your opinion in surveys and discussions;
• Distribute informational materials;
• Be an active representative of the movement at events;
• Publish posts on social networks on the topic of the activity.

The bot then proceeds to instruct users that they need to register to participate. The bot requests the user’s passport data, phone number, location data, and an image of the user’s face. 

The day before the August 16th demonstration, the bot provided the following message: 

“The event will start this Saturday, August 16, at 3:00 PM, at the Chisinau Railway Station, Strada Piața Gării 1.

When you are at the event, you will need to share your geolocation. To do this, select 📎, then “Geolocation”, then “Geolocation broadcast”. After the event has ended or you have left it, the broadcast can be cancelled.”

Cu Sens and de Garda report that the bot is likely to be activated and used again, according to Ziarul de Garda.

2.2 Cross-Platform Amplification of Shor’s Video

Between 15 and 18 August, our investigation shows that 117 social media accounts amplified Shor’s video and accompanying text containing a link to the Telegram bot, re-uploading it across platforms: 64 groups on Odnoklassniki (Ok.ru), 9 channels on TikTok, 8 assets on Facebook, 8 on Instagram, 4 on Telegram, and 1 on YouTube. 

Ilan Shor operates OK.ru and VK social media channels where he publishes original content. Shor is sanctioned by the European Union, which means that social media platforms need to block his content from being accessible to European audiences, as made clear by Science Feedback and Alliance4Europe’s sanctions report. Ok.ru and VK have yet to comply with these sanctions, while all other social media platforms commonly used in Moldova do. 

The initial videos by Shor promoting the demonstration were published on his OK.ru and VK accounts. While both accounts were used to promote the video, the Ok.ru profile was found to have shared the link to the Telegram bot. 

Across social media platforms, a wide variety of accounts are systematically republishing the content from Shor’s account, circumventing sanctions against him. Some of these show clear signs of coordinated inauthentic behaviour, while others seemingly belong to covert malign influence operations. 

We have identified four different sets of accounts: One set belongs to Gagauznews, another is tied to a network operating on Ok.ru, the third is 23 Telegram Channels, and, lastly, a group of ostensibly coopted individuals republishing Shor content, presumably for payment, although we do not have direct evidence for this.

2.3 Gagauznews

Gagauznews was the platform with the highest reach among the amplifying entities. It is a news agency centred around publishing Russian propaganda within Gagauzia, an autonomous Moldovan region. As shown by a previous report by Alliance4Europe, Gagauznews is owned and controlled by close associates of Ilan Shor, who himself is also under EU sanctions, and is believed to be part of a wider propaganda network controlled by the oligarch. It has repeatedly encouraged Moldovan citizens to protest the government and reposted interview videos of Ilan Shor. For example, Gagauznews promoted the Telegram bot across their social media channels, sharing it to over 30,000 subscribers across several platforms.