Image credit: Maxence Peniguet on Flickr, creative commons licence, https://www.flickr.com/photos/maxxp/
Author:
Saman Nazari, Alliance4Europe.
This flash report was made possible through collaborations facilitated through the Counter Disinformation Network’s IDA project. For more information, please read the last section of this report.
Introduction
This report examines how a small set of Moldovan Russian influence operation channels, reportedly connected to convicted and exiled oligarch Ilan Shor, are helping media sanctioned by the Moldovan state to reach audiences on social media.
In October 2024, Moldova faced a critical election to decide the country’s next president and its potential accession to the European Union (EU) (1). Maia Sandu, the sitting president and a strong advocate for EU membership, used the election to consolidate a mandate for EU accession, successfully embedding this objective in the Moldovan constitution (2).
However, this pivotal moment in Moldova’s history was clouded by alleged Russian interference (3). Since the full-scale Russian invasion of Ukraine, Russia has taken more intense actions to maintain its influence in the region, intensifying its efforts to derail Moldova’s pro-European trajectory (4). Russia has reportedly used a myriad of tactics to undermine the elections and weaken Moldovan democracy, including cyberattacks, influence operations, vote buying, and financial support for pro-Russian candidates (5).
A project, led by the INFO OPS Poland Foundation in partnership with the Atlantic Council’s Digital Forensic Research Lab (DFRLab) has taken a deep dive into Russian influence in Moldova. We warmly recommend readers to also read the two reports they published (6, 7).
Ilan Shor is a sanctioned Moldovan oligarch who has been convicted for a major bank fraud case in 2023 (8). He has reportedly played a leading role in Russian-backed influence operations targeting Moldova (9). Notably, evidence was found of vote meddling, with Shor allegedly using undeclared foreign money to bribe candidates and voters. In June 2023, his party “Șor Party” was deemed unconstitutional and banned. After fleeing to Moscow, he founded the electoral bloc “Victory” which includes parties such as “Revival,” “Chance,” “Alternative and Salvation Forces of Moldova” (10). Current Gaugazia governor Evghenia Gutul was elected as the bloc’s executive secretary (ibid). In August, the Central Electoral Commission of Moldova forbade the recognition and certification of the Victory bloc in the October 2024 presidential election and 2024 Moldovan European Union membership referendum (11).
The Autonomous Territorial Unit of Gagauzia, situated in Southern Moldova is largely pro-Russian, posing a major challenge for the Moldovan government in Chisinau. The region is home to a small minority population, speaking its own Gagauz language, that is being heavily influenced by Russian influence operation media entities (12, 13).
In May 2024, Valentin Châtelet and Victoria Olari at DFRLab published a report exposing how the new website Gagauzinfo[.]md shared technical infrastructure with Moldovan Russia-backed political parties and pro-Russian media (14). They also found that gagauzia24[.]info was hosted in Russia and was sharing infrastructure with pro-Russian TV channels (ibid).
This report builds upon DFR Lab’s findings. We will show how four entities hiding their affiliations and identities targeting Gagauzia are covertly amplifying their content. Three of these are anonymous social media entities while the other is a news website and their social media ecosystem.
Analysis
In the following sections, we describe and analyse a small part of the social media ecosystem of channels targeting Gaguaz audiences with pro-Russian messaging. These channels appear to be running a series of interconnected influence operations, which may merit further investigation. Significantly, an apparently intricate network is targeting such a small minority population. That population, although small, is strategic in that it is positioned to potentially destabilize Moldova. In this report, we are only able to cover a small part of the social media ecosystem targeting the Gagauzia region. Many more channels and outlets were detected, some of which are known while others are not documented.
Gaguaznews – Sanctioned Media – Simple Circumvention
Gaguaznews does not reveal its ownership or editorial staff in its About Us section nor anywhere else on the website (15).
Media Ownership Monitor Moldova describes the website as a “Russian-language portal that publishes news about the Gagauz region, as well as national and international news with a focus on the Russian Federation” (16). They also attribute the ownership of the website to Victor Petrov.
Victor Petrov is a businessman from the autonomous region of Gagauzia who has made anti-EU and anti-NATO statements in Moldova (17). Because of his backing by Ilan Shor and the disinformation activities carried out via Gagauznews, he has been sanctioned by the EU (18).
Media Ownership Monitor Moldova elaborates that Victor Petrov serves as vice president of the Executive Committee of Gagauzia, led by the governor of Gagauzia, Evghenia Gutul, a close affiliate of Ilan Shor (19).
The website Gagauznews[.]md was initially blocked by the Information and Security Service (SIS) of Moldova, which the website circumvented by getting a new domain name, Gagauznews[.]com (20).
A Sanctioned Entity
In “COUNCIL IMPLEMENTING REGULATION (EU) 2024/739” (21) which is an amendment of the “Council Regulation (EU) 2023/888 of 28 April 2023 concerning restrictive measures in view of actions destabilising the Republic of Moldova” (22), we can see that Victor Petrov owns the website. He is also said to have received political support from the sanctioned Pro-Russian Oligarch Ilan Shor. Through this Council Regulation, Petrov is sanctioned by the EU.
The nature of the sanctions against Petrov entails the “prohibition to make funds and economic resources available” to the sanctioned entity. Considering the sanctions and his ownership of the media, it is likely that the sanctions can be extended to the media entity.
In May 2024, the European Commission clarified that sanctions against Russian entities also entail that social media platforms are not allowed to host their content, as the Commission views this as making “economic resources available to the listed persons” (23).
Considering that the Council regulation stipulating the sanctions against the Moldovan entities also restricts making “economic resources” available to the sanctioned entities, we interpret the Commission’s clarification to apply to the Moldovan sanctions. If this is the case, social media platforms should prohibit the website Gaguaznews.com’s availability in the EU.
Victor Petrov also has a Facebook page that he is using to post content (24, 25), which is likely a violation of the sanctions as well.
Content Analysis
We have analysed the origin of the content found on the Facebook and YouTube accounts of Gaguaznews. We went over small samples of their content.
Between the 15th and the 22nd of December, Gagauznews’ Facebook page posted around 190 posts. 100 of the 190 posts came from sources that have relevant ties to threat actors as described below.
The 100 posts originated from a limited number of entities, all reportedly tied to Ilan Shor or Russia. In some cases, this channel is making content that is banned in Moldova, available to users.
These include:
People’s Anti-Crisis Headquarters (NAS) – the organisation behind Gagauznews (26). Gagauznews promotes its other activities (e.g. 27, 28)
Gagauzinfo[.]md – this aforementioned website reportedly shares technical infrastructure with several Moldovan Russia-backed political parties and pro-Russian media (29). Gagauznews republishes its content (e.g. 30, 31).
The Victory Block – Ilan Shor’s pro-Russian political alliance (32), which Gaguaznews promotes by posting speeches and media appearances from members of the Block (e.g. 33, 34).
Promoting Găgăuzia Land Christmas event – The amusement park was promised as part of the election campaign of the pro-Russian governor of Gagauzia Evghenia Guțul (35) and is supported by Ilan Shor. Evghenia Guțul claims that the project was an idea of Shor (36) and it’s reported by Radio Chisinau that Shor is also the founder of the project (37). The videos on Gaguaznews promote the amusement park, its alleged success, and its positive impact on Gagauzia, and thank Ilan Shor for his role in the creation of the park (e.g. 38, 39).
Ilan Shor and the Myron Shor Foundation – Shor’s team and Myron Shor Foundation, named after Ilan Shor’s father, activities in Gagauzia are also promoted, showing how they hand out presents or organise events (e.g. 40, 41).
MD24 – A 24/7 news channel banned by the Moldovan Intelligence and Security Service (SIS), who also claimed MD24 is linked to Shor (42). The publication Newsmaker claims that the main studio of MD24 is in Russia (43). Gaguaznews republishes MD24’s content (e.g. 44, 45)
Gagauziya Radio Televizionu” Company (GRT) – public broadcaster of the autonomous territorial unit of Gagauzia that broadcasts primarily in the Gagauz language (46).
Newsmaker claim that the media is now under the control of Shor (47).
A group of media civil society organisations launched a joint protest against the alleged censorship of an article claiming that the promise to provide Gagauzians with natural gas at the price of 10 lei is based on forgeries and manipulation (48). GRT’s content is republished by Gaguaznews (e.g. 49, 50).
RT, Ria Novosti, Russia 1, Russia 24, and Sputnik Moldova – Russian-sanctioned state-controlled media. Republishing their content (e.g. 51, 52, 53, 54, 55).
TASS – Republishing the Russian state news agency TASS content (e.g. 56, 57).
Russian House and the Embassy of Russia – republishing content produced by the embassy and the Russian state-controlled cultural centres (58) (59, 60, 61).
YouTube
Between the 24th of November and the 20th of December, the Gagauznews YouTube channel published 36 videos (e.g. 62, 63). The channel has over 23,200 subscribers and has published over 2300 videos since its creation in 2016. The channel has amassed a total of 10,4 million views, according to YouTube (64).
The origin of the YouTube channel’s videos was very similar to the origins of the content they published on their Facebook page. For example, both the Facebook page and YouTube channel feature the same Christmas footage with the Gagauzia governor Evgenia Gutul (65, 66). Across time, the two channels feature the same EU-sanctioned (67) political figures such as Mikhail Vlah, Deputy Head of Gagauzia and Adviser on Communications (68,69).
Image 1 and 2: Gagauznews Facebook page and YouTube channels posting similar content. On the left, Christmas footage with Gutul. On the right, EU-sanctioned politician Mikhail Vlah.
Gagauzia 24
Not much has been written about the online publication Gagauzia 24. The DFRLab revealed that they share a Google Analytics code with the pro-Russian TV channel Accent TV and that they are hosted in Russia (70). The Moldovan Council for the Promotion of Investment Projects of National Importance revoked the broadcasting license of Accent TV for hiding its financial connection to Shor (71).
Gagauzia 24 has active YouTube, Telegram, and TikTok channels (72, 73, 74), but their Facebook page seems to have been shut down.
The content shared on these social media channels seems to be mostly from third parties, but there is also some original content. These pieces of original content are laundered through two other pages which we highlighted below.
Gagauzia 24 is likely an influence operation considering that it is hiding its affiliations and funding, its Russian hosting, and the use of anonymous secondary social media accounts to spread its content. Moreover, as illustrated below, the content posted by the platform is systematically promoting members of the Shor network, some of which are under EU and Moldovan sanctions.
Two different and separately branded social media channels republish the content of Gagauzia 24, Experts Gaugazia and Voice of Gaugazia. Below, we show how their content is amplified across Gagauzia-related Facebook Groups. The same Facebook groups are used by the same Facebook account to amplify another page which could not be fully attributed but is also described below.
Experts Gagauzia
On September 17th, the Facebook page and TikTok channel Эксперты. Гагаузия (Experts. Gagauzia) was created, just a month before the elections.
Since then, the Facebook page has only attracted 25 followers. The TikTok account has been more successful, gaining 2532 followers and 30800 likes on its videos.
Content
Both pages only share excerpts from longer interviews originating from the Gagauzia24 series “CONTEXT” which mostly broadcasts members of Shor’s network. The interviews, posted across both TikTok and Youtube, include notable figures such as:
Victoria Furtună (75,76), who was presented as an independent presidential candidate during the 2024 presidential elections. She played a key role in the network orchestrated by Ilan Shor to influence Moldova’s political landscape. She propagated anti-European Union narratives in public gatherings, coordinated via Shor’s activists (77).
Sergey Mishin (78,79), the Chairman of the Revival Party which is a satellite party of the banned Shor party (80, 81, 82, 83).
Ilya Uzun (84), the deputy governor of Gagauzia sanctioned by the EU (85). He openly supports Shor and even dismisses the accusations of fraud and condoning “money for votes” scheme (86).
Mikhail Vlah (87) is the deputy to the Governor (Bashkan) of Gagauzia, Evghenia Gutul. He is also Evghenia Gutul’s media relations advisor. He is sanctioned by the EU (88).
Vasiliy Bolya (Vassily Bola) (89,90) is a member of the Moldovan parliament. He is part of the Revival Party, which has ties to Shor. In August 2024, Bolya tried to run for the Presidential Election with Shor openly supporting his candidacy, referring to him as “our candidate”. He was backed by Shor’s Victory party but ran as an independent. His candidacy was rejected by the Central Electoral Committee (91,92,93).
Alexander Diulger (94,95) is a Deputy of the People’s Assembly of Gagauzia (PAG) and head of the Gagauz territorial division of the Revival party linked to Shor (96).
It’s noteworthy that the description of the speakers has been re-positioned in these anonymised videos, as it might indicate that the creators have access to the source material. The description provides the same name and affiliation, using the same font, as the original video.
Image 3 and 4: Sergey Mishin interview on both TikTok and Youtube. On the left, the interview has been shortened. Note on the right, the description has been re-positioned.
Voice of Gagauzia
Between August 26th and 27th, 2024, a Facebook page, YouTube channel, and TikTok channel called Voice of Gagauzia (Голос Гагаузии) was activated (97, 98, 99).
Since then, the TikTok channel has gained around 5100 followers and 115,000 likes on their content.
The YouTube channel has received around 6850 followers and 4,1 million views.
The Facebook page has received around 1900 followers but the success of the videos varies from only 1000 to over 300.000 views (e.g. 100, 101, 102).
Content
The channels are only posting short-format videos. The videos seem to be interviews they had as part of larger segments of Gagauzia 24’s videos. In the Gagauzia 24 videos, the content was cut down from larger interview segments. These interview segments are reposted on Voice of Gagauzia as standalone longer videos (e.g. 103, 104. 105, 106. 107, 108. 109, 110. 111, 112).
The videos are all alleged Gagauzian people being interviewed about topics like the standard of living, the election, and criticism of the current Moldovan government.
One of the ways we used to identify that the videos originated from Gagauzia 24 is that Gagauzia 24 consistently uses the same rather distinct clip-on microphone in almost all of their content. This specific microphone can also be found on all the Voice of Gagauzia videos.
Images 5 and 6: on the left, Voice of Gagauzia reel and on the right, Gagauzia 24 reel. Note the same hand and microphone appear in both.
Express News
On November 26, after the October election was over, a set of new Facebook, YouTube, and TikTok pages were set up under the brand of “Express News”, publishing short news clips (113, 114, 115). The videos are hosted by Vartanyan Valeriya, a journalist who has worked for gagauzinfo[.]md, Gagauzia 24 and the Russian-sanctioned media Izvestia (116, 117, 118). It’s not fully clear who controls Express-News. It could be independently run by Vartanyan Valeriya or, most likely Gagauzinfo[.]md or Gagauzia 24.
Content
We can see that another Instagram page that shares the same name as gagauzinfo[.]md’s Telegram page “Gagauzportal” (119, 120) has republished 7 of the 9 videos while tagging Vartanyan Valeriya’s Instagram account (e.g. 121, 122), which does not have any mention of Express-News.
The TikTok account of Gagauzia 24 has republished 5 of the 9 videos, not revealing the source of the video (e.g. 123, 124).
There is an Instagram story on Vartanyan Valeriya’s personal Instagram where she shows off the same model of DJI microphone that is usually used in the interviews of Gagauzia 24 that are converted to videos for Voice of Gagauzia. In the story, she writes that she is heading out to do a “survey”, also showing a Canon camera.
Image 7: Reel on Vartanyan Valeriya’s personal Instagram showcasing the same microphone used in Gagauzia 24’s videos (image 5-6). The text reads “When life gets too easy, we go out to do a survey”.
On her Instagram and the Express-News videos, we also observe how she regularly has elaborate acrylic nails, which can also be observed in the Voice of Gagauzia videos. We cannot confirm that it is the same person who is filming these videos but could warrant further investigations.
Image 8-9: On the left, a post on Vartanyan Valeriya’s personal Instagram shows similar nails as the ones on the video posted on the Voice of Gagauzia Facebook page (on the right).
Further investigations into the ownership and relationships of Express News would be potentially valuable.
Facebook cross-posting
On Facebook, the pages Experts Gagauzia, Voice of Gagauzia, and Express-News are having their content cross-posted by other accounts to a wide range of Facebook groups related to Gagauzia. At a minimum, the posts receive 12 shares. Nine of them are public groups, while we suspect that another 3 might be private groups – which are not visible -, considering the consistency of sharing of always 12 shares.
From the 25th of September to the 25th of December, an account @oleg.dimitrov.2023 (Олег Димитров) cross-posted the videos to the Facebook groups: “Typical Gagauzia” (Типичная Гагаузия) (125, 126, 127), “Gagauz people, come here!” (Гагаузы, все сюда!) (128, 129, 130), “Gagauz of Russia.” (Гагаузы России.) (131, 132, 133), “Gagauz group “KARDASH”” (Гагауз группасы ,,КАРДАШ”) (134, 135, 136), “Gagauzia is our home” (Гагаузия – наш дом родной) (137, 138, 139), Gagauz info (Гагауз инфо) (140, 141, 142), Our Gagauzia (Bizim Gagauziya) (143, 144, 145), Transnistria and Gagauzia (Приднестровье и Гагаузия) (146, 147, 148), and ATO Gagauzia (149, 150, 151).
Image 10, 11, 12: oleg.dimitrov.2023 crossposting content from Experts Gaugazia on the groups Typical Gaugazia, Gagauz people, come here! and Gagauz group “KARDASH.
The account @oleg.dimitrov.2023 was created in December 2023 and does appear authentic. It only has a profile picture of a car and is friends with less than 100 people.
On the 23rd of September, we also observed the first cross-posting of content from Experts Gagauzia. It was done by the account Ирина Топал (Irina Topal). This account posted the video in the groups “Gagauzia is our home” (152), “Gagauz ERI” (Гагауз ЕРИ) (153), “ATO Gagauzia” (154), “Typical Gagauzia” (155), “News of Gagauzia and the south of Moldova” (Новости Гагаузии и юга Молдовы) (156), “CHADIR-LUNGA: WE MANAGE THE CITY TOGETHER” (ЧАДЫР-ЛУНГА: УПРАВЛЯЕМ ГОРОДОМ ВМЕСТЕ) (157), “Gagauz of Russia” (158), “Ukrainians in Moldova” (Украинцы в Молдове) (159), Group ‘News 24 information news portal (160), “Gagauz” (161), “Gagauz group “KARDASH”” (162), “Gagauz people, come here!” (163), and “GAGAUZ HALKI” (164).
The Irina Topal account added their profile picture 7 years ago (as of 27/12/2024). The account follows a variety of pages, including local pages related to her region. This could indicate that the account is authentic or at least belongs to someone from the region.
The Facebook groups “Gagauz people, come here!” and “ATO Gagauzia” are administered by the accounts @oleg.dimitrov.2023 and Irina Topal, who are sharing the posts to these groups.
Irina Topal is also the administrator “Gagauzia is our home”.
Going further back, Irina Topal has consistently and exclusively been sharing articles from gagauzia24[.]info to these pages since at least the beginning of 2024 (e.g. 165, 166, 167). In October 2024 another newly created account was added as an admin to the “Gagauzia is our home” group (168).
It seems like at some point, the Facebook page of gagauzia24[.]info was removed, potentially explaining why these pages have been created to launder their content.
DISARM Techniques
The DISARM Red Framework gives us a common language to describe the tactics and techniques used by threat actors and helps us understand the vulnerabilities they exploit (169).
In this section of the report, we will focus on the core objectives and techniques we identified being used by the different influence operations.
Objective
Two core objectives have been identified:
T0139.001: Discourage – The influence operations was also trying to dissuade people from voting to join the EU and voting for the pro-EU candidate.
T0136.004: Boost Reputation – The influence operations are also trying to improve the reputation of Russia and Shor.
Manipulative techniques
What follows are the four core manipulative techniques we identified in this report.
T0128.002: Conceal Network Identity – Many of the pages identified hide their ownership and affiliations, making it harder to attribute them to a specific actor or network. This allows them to circumvent restrictions against specific actors and avoid being dismissed due to their previous reputation.
T0130.001: Conceal Sponsorship – The influence operations are also hiding where they get their funding from. We cannot with high certainty say that the pages we described here are funded by Russia or Shor. We also don’t have clear evidence that he is paying the actors we have identified. This lack of transparency is a clear vulnerability that should be addressed.
Technique T0098.002: Leverage Existing Inauthentic News Sites – Many of the websites and channels we identified were seemingly created many years before Shor started his activities.
T0119.001: Post across Groups – Cross-posting content across groups was used to amplify the content to locals in Gagauzia. This type of systematic cross-posting by anonymous accounts is a common vulnerability we have seen across several cases.
Conclusions and Recommendations
In this report, we have outlined what seems to be a part of the oligarch Ilan Shor’s network of media running an apparent intricate influence operation targeting Gagauzia. While we have only scratched the surface, we have sketched out a part of the ecosystem, highlighted some of the techniques being employed by the network and found possible vulnerabilities they exploit. It is significant that this sophisticated network is targeting such a small minority community, which is strategically significant for destabilising Moldova.
Our findings and previous research on the Autonomous Territorial Unit of Gagauzia indicate ongoing efforts by Ilan Shor and Russia to influence the people in the region.
Across all the channels studied, we repeatedly found narratives highlighting people’s monetary concerns and direct monetary support from Ilan Shor being used to promote Shor and Russia while discrediting the EU and the Moldovan government.
Social media platforms, including Facebook, YouTube, and TikTok, are being leveraged to disseminate content from entities that seemingly have had their websites blocked or are under sanctions. The restrictions put on these entities by the Moldovan state should extend to social media. If this is already the case, these sanctions should be enforced.
Ramping up enforcement of sanctions remains essential, in order to ensure their effectiveness. Blocking websites without proper monitoring of mirror websites and alternative pages amplifying the banned content is not sufficient. Sanctions should also target the social media assets and the actual content of influence operations. This recommendation is consistent with our previous reports on sanction violations, published with Science Feedback.
The Moldovan government could work with civil society to identify these violations and flag them to social media platforms.
A possible communication strategy countering the narratives used by this influence operation would be addressing the monetary concerns of ordinary people and better communicating how EU monetary support benefits Moldova(170), highlighting its positive effect on Gagauzia.
The upcoming 2025 Moldovan parliamentary election will be a pivotal moment in Moldova’s future. European Civil Society should work together to monitor and protect the elections from influence operations.
Acknowledgement and Funding
A special thank you to Info Ops’ Kamil Basaj, and Ruslan Trad of the DFRLab for providing your insights on Moldova which helped us shape the focus of this report.
The Counter Disinformation Network (CDN) is a collaborative platform that gathers more than 150 information manipulation-countering practitioners from civil society-, media-, and fact-checking organizations as well as universities. The network works to defend democracy and information integrity using common approaches and methods. It enables coordinated action on major events and crises, supports community initiatives and distributes research findings.
This report was written through the Information Defence Alliance project of the CDN, financed by the Ministry of Foreign Affairs of the Republic of Poland within the grant competition “Public Diplomacy 2024-2025 – the European dimension and countering disinformation.
The opinions expressed in this publication are those of the authors and do not reflect the views of the official positions of the Ministry of Foreign Affairs of the Republic of Poland.