Executive Summary
Russia is waging an intense hybrid war against Moldova. The lines of attack involve the use of political parties as proxy disruptors, spreading disinformation and propaganda, buying influence and votes, corruption, cyberattacks, and hooliganism and sabotage. Despite their limited resources and low institutional capacity, the Moldovan authorities are pushing back on multiple fronts and in innovative ways.
The stakes are high not only for Moldova, but also for the EU and Ukraine. Should Russia succeed in its hybrid war, Moldova could become a launchpad for more hybrid attacks against the EU and Ukraine. The EU has made a strong geopolitical commitment to Moldova by granting it candidate status; now the EU needs to provide a security commitment to match its political and economic commitment.
Supporting Moldova’s capacity to take countermeasures against hybrid attacks should be at the heart of this security commitment. Among other things, this support should comprise: funding for long-term communication efforts to promote the EU and counter disinformation; further sanctions against actors working to destabilise Moldova; expanding the mandate and resources of the EU Partnership Mission; providing experts and sharing intelligence on illicit money flows; providing political support to force the major social media companies to take more responsibility for countering disinformation; and providing training and equipment for the police.
Introduction
While Russia wages a kinetic war against Ukraine, it wages a hybrid war against Moldova. Russia ramped up its hybrid attacks against Moldova in the late spring of 2022 – after Russian forces failed to reach Moldova through the south of Ukraine. This hybrid war is characterised by its intensity, scale and scope. Russia’s ultimate objective is to topple the reformist government in Chișinău, take political control of Moldova and prevent it from moving closer to the West, most notably by joining the EU. Russia’s ambitions in Moldova are part of Putin’s imperial project to subjugate its neighbours and restore Russia as a great power. It is testament to how Russia’s imperial project extends beyond Ukraine.
Russia has previously tried to violently overthrow the government in Chișinău. In February 2023, the authorities in Chișinău – following a tip from Ukraine – sent back 12 Serbian citizens suspected of heading to Chișinău to take part in a coup attempt in Moldova, planned by Russian Wagner mercenaries.[1] The Serbs had tried to enter Moldova posing as football fans and were planning to take part in violent actions against government institutions, according to the Moldovan authorities.[2]
Moldova is vulnerable to Russia’s onslaught. Although a majority of Moldova’s 3.3 million people favours the country’s western trajectory, a sizeable part of the population is still more aligned with Russia.[3] Weak societal resilience adds to Moldova’s vulnerability to hybrid attacks. Russia maintains leverage over Moldova through the breakaway region of Transnistria, where Russia maintains around 1,500 Russian troops, many of whom are originally from the region. Russia is also promoting secessionism in Gagauzia, a region in the south of the country, as a way to destabilise Moldova.
Daily hybrid attacks range from disinformation operations to cyberattacks to sabotage and hooliganism. These are primarily carried out in Moldova, but also in the EU in order to harm Moldova’s interests abroad and damage relations with key partners. Among the activities that originate from inside Russia are fake bomb threats, disinformation campaigns, the training of agents and transfers of illicit money. Russia often relies on third-country jurisdictions as transit countries, especially in the South Caucasus and Central Asia, to move money and agents.
Russian hybrid attacks aim to sow discord in Moldovan society and scare people from supporting Moldova’s western orientation. Russia uses the threat of war as a leitmotif to fuel fear in a society already rattled by Russia’s war against Ukraine. Russia’s foreign minister, Sergei Lavrov, made a not so veiled threat in March that Chișinău risked “following in the footsteps of the regime in Kyiv”.[4]
The hybrid attacks are also meant to undermine and overwhelm state structures. Saturating state structures with a steady barrage of such attacks forces Moldova to dedicate considerable resources to countering them – often at the expense of focusing on reforms. The instability caused by the attacks and the threat of war also scares off foreign direct investment. [5]
Today, Russia’s immediate targets are the presidential elections and a referendum on whether to enshrine Moldova’s EU aspirations in the constitution on 20 October. A positive result in the referendum would run counter to Russia’s aim of forcing Moldova into its sphere of influence. Codifying Moldova’s EU ambitions in the constitution would make it more difficult for Russian proxy political parties to undermine Moldova’s path to EU membership. Moldova, together with Ukraine, received formal candidate status from the European Council in June 2022 and began accession talks in June 2024.
The government in Chișinău is pushing ahead with reforms while fighting back against Russia’s hybrid war on multiple fronts. It is using often innovative and forward-leaning methods to counter the attacks, but Moldova needs more assistance from its international partners to hold the line. Limited resources and low institutional capacity remain major challenges for the government. Moldova has undergone a brain drain since independence in the early 1990s. Following President Maia Sandu’s rise to power, however, a number of western-educated Moldovans have returned to the country to help with reforms.
Russia’s hybrid war in Moldova manifests itself in the following ways:
1. Proxy parties
Russia finances and coordinates several political parties in Moldova, notably offshoots of the banned Shor Party. The Russia-linked oligarch, Ilan Shor, who was sentenced in absentia to 15 years for stealing US$ 1 billion from Moldova’s banking system, has been at the forefront of Russia’s hybrid attacks. Some of these parties are effectively Russian proxies. Rather than propel them to power, their actions are intended to destabilise domestic politics and sow discord.
Russia has spent considerable funds on these efforts. Shor-type clone parties are estimated to receive around €100 million from Russia this year alone, according to a Moldovan official.[6] In 2023, Russia spent around €50 million to destabilise Moldova ahead of local elections there, according to Moldova’s Security and Intelligence Service.[7] Russian networks have bribed 130,000 Moldovans to vote no in the referendum.[8] This is about five percent of registered voters.
Proxy party operatives are being trained in Russia on how to organise violent protests and taught tactics on how to provoke the police.[9] This includes being trained in how to trigger the use of special measures such as tear gas. Violent clashes with the police are intended to fuel anxiety throughout society. Sports clubs are used to find willing provocateurs, in a tactic that has been used by Russia in other countries in the region.
Different parts of the Russian security structure are involved in running the proxy political parties. However, a lack of internal coordination, as well as competition between the Russian proxies sometimes leads to contradictory outcomes.[10] For instance, some proxy parties have called for a boycott of the referendum in order to avoid reaching the one-third threshold required for the result to be valid, while other Russian proxies are calling for their members to turn out in large numbers to vote no.
2. Disinformation and propaganda
Moldova has faced a constant barrage of disinformation attacks from Russia. These attacks have increased substantially since 2022. The attacks have also become more decentralised than in the past and shifted to social media since the government suspended a number of Russia-backed and Shor-affiliated television channels in 2022.[11] Shor is the principal mouthpiece for Russian narratives about Moldova. Fake opinion polls and fake experts are also used to spread narratives in international media.
Russian disinformation campaigns are centred around key themes. They involve attacks on the democratic credentials of the government and the legitimacy of state institutions, and accusations that the government is pushing a foreign agenda. They accuse public institutions, notably schools, of being decadent and inefficient, and elites of being foreign agents. The government’s track record, especially on the economy, is also under constant attack. According to an official, the tactic is often to “throw eggs at the wall” to see what sticks.[12]
President Sandu has been a primary target of these attacks. They seek to discredit her ahead of the presidential elections with the use of deep fakes and forged “kompromat”, or compromising material, involving allegations of hidden wealth and bribery. Russia is also pushing the narrative that her government’s western orientation will lead to war. The threat of war – especially against the backdrop of Russia’s aggression in Ukraine – creates and amplifies widespread fears in society and aims to scare off even pro-European voters. There are also absurd deepfake videos of Sandu that are not meant to be believed but only to go viral and be talked about because of their absurdity, which has a subtle but powerful impact on views about the president.
As the elections and referendum approach, the Central Electoral Commission is also coming under increased attack. This is a deliberate effort to undermine the Commission’s credibility and prepare the ground to attack the legitimacy of the outcome of the voting in October.[13]
TikTok and Telegram are the primary platforms used for disinformation campaigns, although Facebook and YouTube have also been used. Disinformation on Telegram, notably about Sandu and the ruling party, is often used as a testing ground before being spread to other social media platforms.[14] Telegram has also been used to coordinate sabotage operations and recruit people to take part in those operations. Russia and its proxies also pay for tailor-made advertising on Facebook, often using Artificial Intelligence (AI).
Content on TikTok, which is used by young people, has a real impact and is relatively cheap to produce. While shutting down an account is useful, it is not enough since the vacuum is quickly filled with other content.[15] Often, a new channel with similar content appears immediately after one has been closed. Ukraine has demonstrated that fighting disinformation requires proactive production of content. It also requires proactive policing of platforms with the help of AI.
Telegram and Meta have been largely unresponsive to requests from Moldova to take down fake accounts and disinformation. Some advertisements were taken down after the companies were publicly named and shamed. Following the visit by US Secretary of State Antony Blinken to Moldova in May 2024, Meta became somewhat more cooperative.[16] Even then, however, following the removal of pages of disinformation sponsored by fugitive oligarchs, new pages would pop up almost immediately.
According to an official in Chișinău, pressure on the larger social media companies from the EU Institutions would be extremely helpful. It would be particularly useful if companies, notably Meta, could be compelled to provide the credit card details of those who are paying for the adverts, as this would help to identify who is behind the disinformation efforts. However, the social media platforms do not appear to be interested in helping Moldova fight disinformation even ahead of the elections, according to an official.[17]
3.Money
Russia has dedicated considerable resources to its hybrid war. This includes bribing politicians, judges and voters. Russia has been particularly skilful at exploiting Moldova’s vulnerabilities, such as corruption in the judiciary and the general level of poverty. For instance, protestors are routinely paid to participate in anti-government protests. A protestor staying in a protest camp in central Chișinău could receive up to €100 per night. Illan Shor has offered voters US$ 29 dollars to register with his campaign and promised additional money to those who vote no in the referendum.[18]
Russia is using peer-to-peer money transfers and smuggling cash into Moldova, according to an official in Chișinău. Among the network of individuals receiving the money transfers are a mix of proxy party members, local councillors and unaffiliated individuals. There is often a nexus between the Russian proxy parties and organised crime. Individuals in Central Asia, primarily Kazakhstan and Uzbekistan, and the South Caucasus, are typically used as intermediaries to bypass sanctions against Russia.[19]
Russia has created an NGO in Moscow, EVRAZIA (Eurasia), in an attempt to bypass sanctions and find a legal way to transfer money from Russia to Shor’s operatives in Moldova, recruiting people on “service contracts”. This NGO has also been used to recruit and bring young people from Moldova to Russia for training on disinformation and sabotage. The US has blacklisted the NGO but thus far the EU has not. According to an official in Moldova, Shor has received money and other forms of support from Russian oligarchs such as Roman Abramovich, the Rotenberg brothers, and Yuri Kovalchuk.[20]
Group trips to Russia and elsewhere have been organised to move cash into Moldova. Individuals on a trip typically bring back €8–9,000 each in cash to Moldova, under the €10,000 threshold for declaring the money. Thousands of Russian MIR payment system debit cards with hundreds of euros on them have been provided to pensioners in Gagauzia to buy their votes.
Tracing and stopping money flows has become a critical means of countering Russian influence. Moldovan law enforcement agencies have been relatively effective at seizing money but the quantities are substantial and much of it still manages to bypass law enforcement efforts. The anti-money laundering legislation is compliant with international standards but there is a need to strengthen institutional capacity and modernise equipment and software. The increasing use of cryptocurrency is an area in need of regulation.
4. Cyberattacks
Cyberattacks are a primary aspect of destabilisation efforts in Moldova. These include denial of services attacks and use of ransomware, malware, vulnerability tests, and phishing emails. These attacks are often intended to undermine citizens’ trust and confidence in state institutions. For instance, Moldova’s health service, postal service and government payroll system have been the target of such attacks.[21] Attribution is a challenge, especially with denial of service attacks, but the sophistication of some of the attacks clearly points to a hostile state actor being behind them.
In one case, the Police website was attacked 2,800 times in one night, paralysing IT systems and disrupting ongoing operations. There have also been denial of service attacks against the Central Electoral Commission,[22] as well as sabotage hacks on a website on President Sandu’s 100 first days in office, against the public broadcaster and on independent online media. Moldova’s cybersecurity defences suffer from a lack of expertise and insufficient funding. There is a particular need for support from international partners to modernise the cyber infrastructure and pay for regular software upgrades and licence extensions.
5. Gagauzia
Russia is actively trying to exert control over Gagauzia in southern Moldova through Shor-style proxy political parties. Russia is using its playbook of fostering secessionism and territorial disputes inside its neighbours as a means of control and leverage, as has been done in Georgia and Ukraine.
Shor’s party has partially managed to take power in Gagauzia by securing the position of governor of the region and buying votes for and bribing the leadership of the people’s assembly. The party is now trying to unite local communities by creating local resentment against Chișinău, among other things by accusing the government of imposing high gas prices on the region. This effort has not been successful, however, as there is local opposition to Shor.
The prospects of Russia succeeding with its plans in Gagauzia are limited, according to a Moldovan official,[23] as there are no logistics supply lines for Russia to provide support to a violent secessionist movement. There is also growing opposition to Shor in the people’s assembly, among mayors and from local businesses. A move to declare independence would trigger a strong response from Chișinău. However, Russia could use Gagauzia to create a nuisance for Chișinău and as part of an information operation to create fear of inter-ethnic discord in society ahead of the referendum. Gagauzia remains a threat to stability in Moldova but the situation appears to be under control.
6.Sabotage and hooliganism
Sabotage and hooliganism are tactics used as part of Russia’s hybrid warfare against Moldova, often as part of disinformation operations intended to spread fear and anxiety across society. What appear to be simple cases of hooliganism are often part of hybrid attacks. These constitute threats to national security rather than “normal police matters”.
Fake bomb threats against public buildings such as schools and Chișinău’s airport have often originated from Russia. These have been highly disruptive for the public and drained resources from law enforcement. The Moldovan Police have developed new protocols to minimise the nuisance caused by the fake bomb threats, thereby undermining their effectiveness.
In late September, Moldovan law enforcement agencies arrested two people who had vandalised state institutions in the capital by throwing paint on their facades. These individuals were among 20 young people who had been flown to Moscow to receive training in how to provoke the police during protests and other forms of destabilisation activity, according to the Moldovan police. They were each paid €5000 to vandalise government buildings.[24]
In April, days before Easter, two Bulgarian nationals sabotaged a number of ATMs in Chișinău overnight.[25] Social media channels linked to the fugitive oligarch Shor then spread the narrative that Moldovan banks had run out of money. This was an attempt to undermine confidence in the banking system and cause panic ahead of Easter. The ATMs were quickly repaired and the government moved fast to counter the disinformation.
Russia’s use of sabotage against Moldova also includes operations in the EU. In May, Russia-linked Moldovans from Transnistria were arrested in Paris for painting the Star of David on buildings where Jews lived and red hands on the Holocaust Memorial.[26] These operations, which are believed to have been orchestrated by Russian intelligence services, were intended to undermine relations between Moldova and France.[27]
Three Moldovans with links to Russia and Transnistria were arrested in France in June 2024 for painting red coffins on buildings in central Paris.[28] The operation was organised by a Shor proxy party operative who was also responsible for organising and taking part in violent protests in Moldova and part of an effort to vandalise the Moldavian Prosecutor General’s house in 2022, according to officials in Chișinău.
Conclusions
Moldova is defending itself against an intense barrage of Russian hybrid attacks. It has managed to hold the line and prevent Russia from undermining its western trajectory. It has also managed to move ahead with reform. However, this progress is neither inevitable nor irreversible. If Russia were to succeed in its hybrid war, this would undermine and roll back progress and have highly negative consequences for Europe and European security. It would entail an antagonistic neighbour that could provide a launchpad for Russian hybrid attacks against the EU and Ukraine.
The West has an interest in supporting Moldova to build its capacity to carry out countermeasures and strengthen its resilience against Russian interference. This is not a one-way relationship, however, as the West also has a great deal to learn from Moldova’s experience, tactics and countermeasures. While Moldova is on the frontline of these hybrid attacks, Russia is using similar tactics to varying degrees all over Europe and in the United States. Moreover, Russia’s attacks on Moldova directly affect the EU, as has been seen in the hybrid operations in Paris.
The European Council’s decision to grant Moldova and Ukraine candidate status and to open accession talks signifies a major geopolitical commitment to the security of Moldova and Ukraine. Although candidate countries do not enjoy binding security guarantees from the EU, the EU has still made a political commitment to these countries. The EU needs to match the commitment inherent in its offer with a robust security commitment and support for Moldova’s fight against Russia’s hybrid war.
Policy recommendations
The EU should:
Political
- Set up a dedicated campaign fund to promote the EU and counter disinformation campaigns over the long-term, beyond the referendum. The EU must take a fast, flexible and innovative approach to dealing with the barrage of disinformation, which should include the use of online influencers and content creation.
- Impose further sanctions on malign actors seeking to destabilise and undermine Moldova’s democracy. This should include judges and prosecutors involved in corruption and attempts to block justice reform.
- Broaden and extend the mandate of European Union Partnership Mission (EUPM) by increasing the size of the mission in terms of both the number of experts and the project’s budget. The EUPM should be allowed to use emergency procurement procedures to accelerate donations of equipment.
Money
- Provide operational expertise to help Moldova’s law enforcement agencies counter illicit money flows.
- Deepen the sharing of financial intelligence and cyber intelligence with key partners. This should include on the increasing use of cryptocurrencies to fund destabilisation.
Disinformation and cyber
- Increase political and institutional support from the EU institutions in Brussels with dealing with disinformation on social media platforms. This should include the EU using its leverage with the larger social media platforms to comply with requests from Chișinău to close down disinformation accounts.
- Provide more funding for the National Cybersecurity Agency, the Centre for Strategic Communication, and for information campaigns, including for content creation and IT specialists.
- Support the establishment of a disinformation debunking NGO specifically for Moldova.
- Fund sociological surveys and provide expertise on crafting and interpreting survey data.
- Fund support for media development, especially among independent media outlets.
Sabotage and hooliganism
- Support the police by providing multiannual licences for analytical, transcription and facial recognition software, as well as non-lethal crowd control equipment and jamming equipment; and strengthen open source intelligence capabilities within the police and other agencies.
References
[1] www.ft.com/content/1e317be3-1837-45da-beef-be0347937fd9
[2] www.theguardian.com/world/2023/feb/13/moldova-president-maia-sandu-accuses-russia-of-plotting-to-oust-pro-eu-government
[3] www.iri.org/wp-content/uploads/2024/07/NationalSurveyMoldova2024_May.pdf
[4] www.ft.com/content/e696f2db-7f7f-484a-b985-a4d299cccc7f
[5] https://newsmaker.md/ro/o-companie-japoneza-pleaca-din-moldova-asambla-cablaje-auto-pentru-grupul-volkswagen-din-germania/
[6] Interview with Moldovan official in July 2024
[7] https://kyivindependent.com/moldovas-security-chief-says-russia-spent-55-million-on-destabilization-campaign/
[8] www.reuters.com/world/europe/moldova-alleges-pro-russian-vote-buying-scheme-ahead-key-vote-2024-10-03/
[9] www.svoboda.org/a/utechka-chvk-vagner-uchastvovala-v-podgotovke-besporyadkov-v-moldove/32380441.html
[10] Interview with Moldovan official in July 2024
[11] www.rferl.org/a/moldova-ilan-shor-tv-stations-licenses-suspended-russia-war/32180842.html
[12] Interview in Chișinău September 2024
[13] Interview with an official, Chișinău, July 2024
[14] Interview in Chișinău September 2024
[15] Interview in Chișinău July 2024
[16] Interview in Chișinău July 2024
[17] Interview in Chișinău July 2024
[18] www.euractiv.com/section/enlargement/news/moldovan-minister-exposes-vote-buying-in-eu-referendum
[19] Interview in Chișinău July 2024
[20] Interview in Chișinău July 2024
[21] www.politico.eu/article/moldova-fights-free-from-russia-ai-power-disinformation-machine-maia-sandu/
[22] https://newsukraine.rbc.ua/news/moldova-faces-hacker-attack-during-elections-1699289886.html
[23] Interview in Chișinău July 2024
[24] www.zdg.md/stiri/stiri-justitie/video-cladirea-guvernului-si-a-unui-minister-vandalizate-in-timpul-noptii-de-doi-tineri-care-ar-fi-fost-instruiti-la-moscova-pentru-a-crea-proteste-in-r-moldova/
[25] www.ziarulnational.md/sabotaj-doi-tineri-straini-platiti-sa-vina-in-r-moldova-sa-distruga-mai-multe-bancomate-misiunea-secreta-pe-care-o-aveau-de-indeplinit-la-Chișinău-si-contul-de-facebook-care-a-dat-de-gol-operatiunea/
[26] www.theguardian.com/world/article/2024/may/22/france-russia-paris-holocaust-memorial-graffiti-red-hand
[27] www.bbc.com/news/world-europe-67360768
[28] www.lemonde.fr/en/france/article/2024/06/22/france-two-moldovans-charged-over-coffin-graffiti-in-paris_6675480_7.html
