Moldova’s Election Storm: The Info War Playbook

For nearly three years LetsData has monitored InfoOps in Moldova, documenting how external actors test vulnerabilities, influence discourse, and prepare conditions for interference. In the past year alone, our analysts identified more than 700 distinct InfoOps incidents across the information space.

This article is an opinion piece: it brings these tactics, techniques, and procedures (TTPs) into one picture in order to understand the larger play of Russian and Russia-aligned threat actors ahead of Moldova’s parliamentary elections on September 28. It does not attempt to predict outcomes, but rather to outline how these operations fit into a broader strategy aimed at shaping Moldova’s security environment and political trajectory.

Limitations: the focus of this article is on activities observable within the monitored information space: web media, Facebook, Telegram, TikTok, and Instagram. We do not cover offline practices like voter bribery or busing. We also do not cover technical attacks such as DDos.

What Threat Actors Aim to Achieve in Moldova’s Elections

Based on the TTPs we have tracked, a clear pattern emerges: Russian and Russia-aligned threat actors are preparing Moldova’s information space for two possible post-election outcomes. Their main objective remains the victory of political parties openly sympathetic to Moscow, a goal they have repeatedly signaled support for going as far as hosting in Moscow the launch of an opposition alliance or scaring the Moldovan electorate with a NATO invasion. But with parliamentary elections expected to be close and polling suggesting a near tie, threat actors are also preparing alternatives. This means that the wave of InfoOps is likely to intensify immediately after election day, when results become clear and vulnerabilities in the political process are most exposed.

1. The Delegitimization Play. If pro-European or neutral forces secure enough seats to block a Russia-aligned majority, pre-positioned narratives of fraud, repression, and state capture will be activated. The aim is to discredit the results, contest the legitimacy of the process, and weaken trust in Moldova’s electoral institutions. These operations are designed to mobilize street pressure, create openings for prolonged instability, and delay the consolidation of any government viewed as unfriendly.
   
   

2. The Coalition Pressure Play. If no side wins outright, a highly likely outcome in such a close contest, information operations will pivot toward fragmenting blocs and shaping coalition talks. Threat actors will amplify intimidation campaigns against “swing” parties and their leaders, frame potential alliances as betrayals, and seed narratives that deter cross-bloc cooperation. The aim is to tilt negotiations toward Russia-aligned actors, or at minimum to produce a deadlock that keeps Moldova politically weak and vulnerable to external leverage.

Voters, journalists, and civil society need to read the space clearly. Below are tactics most likely to appear in the coming week. Tracking them is the first step to countering via digital channels.

How Threat Actors Prepare the Plays

Russian and Russia-aligned threat actors are certain to contest (preemptively and in the event of an unfavourable result, the  outcome of Moldova’s parliamentary elections. We have seen this in the past presidential elections of 2024 and the ground has been layed thick to do it tjis time around also.

The Weaponization of Victimization

One of the most potent tools in the disinformation arsenal involves crafting narratives of victimization. These serve a dual purpose: 

1. mobilize supporters to vote; 

2. lay groundwork to delegitimize unfavorable election results, particularly those favoring European integration.

Look closely for several key signs of the given tactic.

State Capture Claims

Messages have emerged and may continue after elections, saying the government  is a dictatorship “controls everything” through chronic omnipresent corruption. These narratives have been seeded way before the election and serves as a background for more specific attacks. The dictatorship angle was pushed through a particularly intense attack on Sep 12th, with thousands of comments in a single day.

Authoritarian Claims

Standard law enforcement activities, will be framed as repression. Managing protests and/or arresting suspects will be reframed as having a “political” connotation. 

Electoral Fraud Claims

Actors will allege manipulation, suppression, or abuse of local and diaspora voting. They will target process details such as vote counting, registration, and administration.  Some messages stack control in a ladder: George Soros controls Emmanuel Macron. Macron controls President Maia Sandu. Sandu controls the state and the election (get a deep dive in this LetsData article).

Exploiting Fear and Uncertainty

Here, the strategy is on pathos, or emotion. Logic is optional. Narratives shift to whatever scares people most. Usually, it is all about economy and security. We have been observing for weeks how military and economic narratives become more and more apocalyptic.

Economic Fear

Messages will say the EU makes people poor. “Energy would be cheaper from Russia,” or “Partnerships with the EU harm the economy.” prevail. 

Security Fear

Other narratives will claim “militarization.” Expect screaming titles suggesting Moldova will “attack Russia,” “arm Ukraine,” or “lose Transnistria.” In such a context, InfoOps is all about spreading fear and irrationality.

Cultural Identity as a Battleground

The tactic focuses on pushing the ideas that the West is alien and hostile to Moldovan identity. This is a quasi-permanent “identitity war” that only gest intensified during crises. Look for the signs like these:

Tradition Under Threat

NATO, the EU, and “the West” are cast as enemies of Christian morals. The narratives portray pro-Western ideas as harmful societal changes. 

Historical Spin

Manipulators use faux anti-Nazi rhetoric. The main claim: West supports fascism because it does not glorify Soviet victory in the way they (pro-Russian actors) demand.

Regional Identity Plays

Messages target Găgăuzia and Transnistria. They claim Western ties will erase Soviet-era traditions.

Sovereignty Under Attack

With this tactic, the frame is dependency and loss of control (in terms of power rather then identity) l. Usually, the narratives will be framed in such a manner: 

Moldova-as-a-Colony

The general messaging will revolve around the idea that the West “imposes poverty,” "protects corrupt elites,” and “pulls strings.” Moldova will be presented as a pawn in the game of foreign forces. 

EU-Specific Hits

More targeted messaging claims that European integration harms Moldova. Messages will say the EU is weak and unfair. Aid “creates debt and dependency.” In such a case, Romania and France often appear as stand-ins.

Anti-Integration without Anti-EU

A parallel narrative suggests pro-EU governments are too weak, incompetent, or corrupt to actually advance European integration. Even when the EU brings loans and grants. 

Expanding Reach and Building False Legitimacy

Operators grow their audience and cloak lies in borrowed authority. They spin up fresh accounts, mimic pro-EU voices, cite shaky “experts,” and hit when defenses sleep. Look for these signs:

Audience Expansion

New accounts will appear. More posts will use Romanian to reach wider groups. Some accounts will pose as pro-European. Later they will pivot.

False Authority

Operators will cite “experts,” foreign media, or EU/NATO sources out of context. Some articles will be fabricated.

Strategic Timing

Attacks will be timed for maximum impact and minimum response capability. These are often launched outside regular business hours or during weekends when counter-responses are slower.

Suppressing Counter-Narratives

Finally, these operations actively work to prevent effective responses by intimidating and discrediting those who might challenge false narratives.

Targeting Credible Sources

Independent media outlets and anti-disinformation efforts, both Moldovan and European, may face systematic discrediting campaigns.

Intimidation 

Messages will threaten consequences for those who push back. Police handling protests are common targets. Journalists can be next.

Privacy Violations

Operations may utilize private channels and illegally gathered voter data to enhance targeting and personalization of disinformation. 

Cross-Tactic Blends

These tools mix and overlap. Messaging is opportunistic and often contradictory.

The state is “tyrannical” in one post and “weak” in the next. The West is “pro-Nazi” and “far-Left” at the same time. During the energy crisis, Russia was both “savior with cheap gas for all” and “unable to help Transnistria” because of transit limits. Consistency is not the goal. Impact is.

What to Do Now

Knowing the patterns is step one. 

• For voters, recognizing these patterns can help distinguish between legitimate political discourse and manufactured outrage. 

• For media and civil society, these points provide a foundation for developing effective counter-narratives that address emotional concerns while providing factual information.

• For security professionals inside Moldova, these scenarios highlight where pressure points will emerge: election administration processes, coalition negotiations, and early post-election protests. Professionals should prioritize monitoring spikes in fraud narratives, intimidation of political actors, and coordinated attempts to disrupt coalition formation. Rapid detection of these moves will help reduce windows of vulnerability.

• For security professionals outside Moldova, the Moldovan elections serve as a case study of how Russian and Russia-aligned actors adapt TTPs to fragile democratic environments. Monitoring these signals provides early-warning indicators of tactics that may be repurposed elsewhere in Europe. Paying attention now helps identify cross-border narratives, shared assets (such as Telegram networks), and transferable playbooks before they are deployed in other countries.

The 2024 presidential race offers a guide. If pro-European forces win, expect heavy self-victimization. Expect claims of miscounts, voter restrictions, or illegal government formation. This can last at least two weeks. It may last longer. After that, expect a short pause. Then, as temperatures drop, expect attacks on the energy plan. The line will say “Russia saves you” and “the EU leaves you cold.”

This will be harder to sell now. Moldova’s energy security is stronger than last year. That said, you should always watch for the unknown.

…the X factor

Almost every tract above has already appeared in 2024 or this year. Pro-Russian actors know that we know this. As a result, they will improvise, and they will test new ideas. The rule of thumb dictates: Stay alert for novel plays and hybrids.

Method note: This assessment covers online narratives and social media infrastructure we monitor. It does not include offline operations or cyberattacks outside the information space.