Hybrid Threats to Democratic Processes in the EU’s Eastern Neighborhood, Moldova’s 2025 Elections

Introduction

Hybrid threats increasingly exploit financial channels to influence political competition without overt military or diplomatic coercion. Foreign funding in elections is not a new phenomenon, yet in hybrid threat environments, it becomes a central instrument of influence. The literature often regards such funding as an external supplement to domestic political resources. However, Moldova’s 2024 and 2025 elections suggest a shift: external money can replace domestic financing altogether, reshaping incentives, allegiances, and the structure of competition. Illicit financial flows are used to buy influence, mobilize voters, and manipulate narratives, turning elections into instruments of geopolitical leverage. 

In 2024, external actors exerted disproportionate influence over Moldova’s presidential election and EU-referendum cycle through a combination of offshore companies, cash distributions, proxy organizations, and media capture. These tactics pushed results to razor-thin margins and created a widespread perception that the electoral process lacked full legitimacy. By 2025, these networks sought to upgrade their approach. According to President Maia Sandu and Moldovan authorities, plans existed to inject as much as €100 million into the electoral environment, through deepfakes, paid protests, and Kremlin-affiliated clergy to manipulate public opinion. This funding included cryptocurrencies, public campaigns, paid protests, and other destabilizing activities. As confirmed by the OSCE mission in its post-elections statement: “These elections took place against the backdrop of unprecedented hybrid attacks, including illegal funding and disinformation and cyberattacks amid deep political polarization over the country’s geopolitical orientation.”

The mechanics of these operations combined both visible and shadow elements. Large sums were transformed into public campaigning with banners, concerts, and organized events, but a more dangerous fraction circulated below regulatory oversight. Suitcases of cash moved across borders, app-based payments were used to bypass reporting thresholds, and cryptocurrency transactions routed through foreign platforms allowed funds to flow with minimal traceability. Investigators and international observers documented complex mixes of cash distributions and electronic transfers that compensated local operatives and purchased loyalty at the local level. Expert assessments identified illicit financing, cyber-attacks, and disinformation as central challenges to electoral integrity.

At the center of several public allegations is the fugitive oligarch Ilan Shor. Convicted in connection with the 2014 banking fraud and sentenced in absentia, Shor has been repeatedly identified in investigative reporting as a key organizer of parallel funding networks associated with pro-Russian political projects. From abroad, networks linked to him coordinate proxies, local organizers, and logistical chains that translate central financing into local mobilization and vote-buying tactics. Reports have described these operations as functioning with the organizational rigor of a corporate structure, with trusted political operatives, coordinators in Moscow managing call centers, and local activists implementing precise mobilization strategies.

2024: Illicit Financing as a Vector of Hybrid Interference

In 2024, Moldova experienced a dramatic convergence of a presidential election and a referendum on EU accession. Observers and prosecutors reported large-scale vote-buying, opaque transfers from offshore entities, and a surge in pro-Kremlin disinformation. Investigations linked substantial transfers and operational support to networks connected to fugitive oligarchs (e.g, Ilan Shor and Veaceslav Platon), whose resources were funneled into local brokers, prepaid cards, and sympathetic media platforms. These interventions had three strategic effects. First, they directly affected voter incentives via cash and in-kind payments in targeted localities, widening the short-term constituency for pro-Russian political forces. Second, they subsidized media outlets and online channels that amplified polarizing narratives and undermined trust in institutions. Third, the presence of large external resources altered the balance of political competition by reducing parties’ reliance on domestic fundraising and voter-based accountability.

The 2024 model relied heavily on opacity: shell companies, middlemen, and informal cash networks created deniability and friction for investigators. In a small political market, these methods were efficient: relatively small sums could have disproportionate effects at the local level, as seen also in the Moldova local elections in 2023 (Balti, Orhei) and 2023 Bashkan (governor) elections in Găgăuzia. The narrow outcome of the EU referendum (passed with 50,35%) and the widespread reports of illicit flows made 2024 a warning case for the region: when financial instruments are weaponized, elections can be converted into instruments of geopolitical leverage rather than mechanisms of domestic representation.

2025: An Upgraded Playbook

Ahead of the 2025 parliamentary election, interference networks sought to replicate and scale the 2024 model while reducing exposure. The upgrades included: 

1. Diversification of financial channels through the encrypted TAITO app, used to mobilize Shor-affiliated activists. Tens of thousands reportedly installed the app, which hides user identities and transactions. Activists were paid via a layered process: funds sent in rubles through Promsvyazbank were converted into crypto A7A5 (used for Russian sanctions evasion), then foreign currency, and finally Moldovan lei. 
2. Construction of bespoke mobilization bots and coordinated messaging on platforms such as Telegram and WhatsApp. 
3. Expanded cyber operations through website disruptions, DDoS attacks, and targeted leaks, seeding doubts about the electoral process, and hackers hijacking Wi-Fi routers to attempt to overload the servers of Moldova’s Central Electoral Commission. 
4. Renewed efforts to manipulate diaspora voting included spreading confusion, paying unauthorized election observers, and issuing bomb threats at polling stations in Western Europe to cause disruption. 
5. Covert operations led by the Moscow-based organization ANO Evrazia, which transferred funds to Moldova under the guise of “humanitarian assistance,” financed propaganda and fake opinion polls, and organized training trips for Moldovan clerics aimed at amplifying pro-Russian narratives.
6. Preparations for violent street protests by pro-Russian groups contesting the results of the elections were preempted and thwarted by the security services, and three people from Transnistria were arrested.

Technically, crypto promised faster, cross-border transfers, and app-based infrastructures offered a way to automate and coordinate payments to local activists. These tools were complemented by traditional methods to create redundancy and make interdiction harder. However, the shift also introduced new dependencies: digital infrastructure leaves forensic traces, and scaling operations required more intermediaries, each a potential point of failure.

Why the 2025 Playbook Failed to Replicate 2024’s Impact

Although the 2025 toolkit appeared stronger, a combination of legal, operational, technical, diplomatic, and civic factors undermined its effectiveness. Four interacting mechanisms explain the failure to reproduce 2024’s disruptive impact:

1. Legal tightening and institutional readiness. After the 2024 cycle, Moldova enacted and operationalized stronger campaign-finance safeguards and clarified rules around foreign-linked donations. Following vulnerabilities exposed in 2024, Laws No. 130/2025 and No. 100/2025 strengthened political and campaign finance rules by expanding eligible donors, tightening contribution limits, and increasing transparency. The amendments also prohibited pre-campaigning, paid participation, unauthorized transport to rallies, illegal signature collection, and the political use of charity organizations. The Central Electoral Commission and courts were more willing to act on suspicious registrations and to disqualify entities that failed to meet new transparency thresholds. International investment in critical state institutions, such as the Center for Strategic Communication and Countering Disinformation and the National Agency for Cybersecurity, has borne fruit.

2. Proactive enforcement. Authorities significantly strengthened pre-emptive measures to counter illicit electoral financing. Fines for vote-buying (reaching 1,900 EUR) applied to more than 30,000 citizens, which is substantial compared to the median wage of 650 EUR. At the same time, exposure and dismantling of clandestine networks limited the effectiveness of these operations. Law enforcement moved from post-factum investigations to pre-emptive disruption. High-profile raids on cash distribution networks, targeted arrests, and the freezing of suspect accounts signaled that intermediaries would face immediate consequences. The publicity around enforcement deterred some would-be facilitators and made long-term operational planning more brittle. Because the Russia-backed individuals and entities were placed under international and EU sanctions for undermining Moldova’s democracy, the authorities were able to freeze their bank accounts and launch criminal investigations (eg, Irina Vlah and Victoria Furtună).

Law enforcement also demonstrated increased vigilance. For example, in the final week of the electoral campaign alone, the National Anticorruption Center conducted 150 searches and seized over 20 million lei (1 million EUR) in electoral corruption cases, while the police carried out 250 searches in a criminal investigation concerning the preparation of unrest and destabilization efforts supported by Russia.

3. Civic mobilization and reputational backlash. Exposure campaigns by independent media, NGOs, and fact-checkers reframed attempted manipulation as a threat to national sovereignty. Where vote-buying had previously been effective because of transactional voter expectations, in 2025, offers of cash were often rejected, reported, or met with public outrage, particularly among diaspora and urban voters. Ziarul de Gardă revealed that hundreds of accounts with fake identities, operated by real activists of the “Victorie” Bloc, controlled by Ilan Shor from Moscow, were created to spread Russian propaganda on TikTok and Facebook. 

4. Diminishing marginal returns and operational friction. Scaling the 2024 model required more transactions, more intermediaries, and more digital infrastructure, all of which increased traceability and cost. The marginal political gain from additional spending decreased notably as voters became more suspicious and as the network’s capacity to deliver reliably was degraded by enforcement and exposure. In parallel, the authorities launched a nationwide awareness campaign “Nu te juca cu votul că vei pierde totul” (“Don’t play with your vote, or you’ll lose everything,”) which was highly visible on television and aimed at discouraging electoral bribery and manipulation, reinforcing citizens’ trust in the integrity of the electoral process.

In short, the synergy of legal reform, enforcement, and civic resistance raised the cost and risk of interference above its expected benefit. This dynamic transformed interference from a low-risk, high-return tactic in 2024 into a high-risk, low-return proposition in 2025.

Recommendations for Strengthening Institutional Resilience 

Moldova’s experience offers transferable lessons for other countries facing similar hybrid threats. First, transparency is both a preventive and punitive tool: real-time reporting, beneficial-ownership registries, and transparent campaign finance reduce the operating space for covert external financing. Second, the value of an integrated, multi-agency approach cannot be overstated: when prosecutors, financial crime units, and election administrators share intelligence and act together, they create institutional memory and rapid-response capability. Third, civil society and media are force multipliers: investigative journalism and public awareness campaigns convert covert manipulation into observable, politically costly behavior for perpetrators. These lessons inform the following set of recommendations:

1. Enhance interagency coordination through Stratcom. Moldova’s 2025 experience underscores the need to consolidate and better resource existing coordination mechanisms rather than create new ones. The Center for Strategic Communication and Countering Disinformation (Stratcom), in cooperation with the Crisis Management Center, should be further empowered to act as the hub for hybrid threat response. Strengthening Stratcom’s mandate, staffing, and analytical capacities, including in areas such as financial interference tracking, election-related information operations, and rapid interagency communication, would ensure more effective and sustainable coordination across law enforcement, regulatory, and electoral institutions beyond electoral cycles.

2. Expand societal trust-building and digital literacy initiatives. Resilience against hybrid threats depends not only on state institutions but also on citizens’ capacity to detect manipulation. Expanding nationwide programs on media literacy, critical thinking, and responsible online engagement can reduce the impact of disinformation. 

3. Secure sustainable, multi-year donor support for civil society and media. Short-term project funding limits the ability of watchdog organizations to build expertise and respond consistently to evolving threats. International donors and EU instruments should prioritize multi-year financing frameworks for investigative journalism, civic monitoring, and cybersecurity. This stability would allow independent actors to maintain vigilance during non-electoral periods and to innovate in data analysis and outreach.

4. Strengthen cooperation with social media platforms to counter online manipulation. Given the growing influence of platforms like TikTok, Facebook, and Telegram, authorities should establish structured partnerships for rapid reporting of election-related disinformation and greater transparency in political advertising. TikTok’s removal of hundreds of thousands of fake accounts and millions of artificial likes during Moldova’s elections was a start, but ongoing cooperation is essential.

5. Ensure continued oversight of diaspora engagement and financial flows. Given the growing role of the Moldovan diaspora in both legitimate political participation and as a target for illicit mobilization, oversight mechanisms should be strengthened.

6. Mainstream hybrid threat resilience into EU–Moldova cooperation frameworks. This would allow for joint training, technology transfers, and shared analytical capacity between Moldovan and EU institutions. Establishing a regional center of excellence in Chișinău could also serve as a platform for knowledge transfer to other EU countries.

Conclusion

The contrast between Moldova’s 2024 and 2025 elections demonstrates that while illicit external financing is a potent tool of hybrid interference, it is not invulnerable. Legal reforms, proactive enforcement, and civic mobilization collectively shifted the risk calculus for would-be perpetrators. Moldova’s experience demonstrates that democracies can adapt to the financial dimension of hybrid threats, provided that adaptation is sustained and coordinated. The policy package outlined above provides a roadmap for turning tactical successes into enduring institutional resilience across the EU and its Eastern Neighborhood.

By 2025, Moldova’s security and governance institutions had absorbed key lessons. Enforcement bodies collaborated with financial intelligence units to trace and freeze illicit funds, while electoral authorities deployed advanced digital tools for transparency. Civil society built partnerships with international fact-checking networks, which swiftly countered disinformation. Importantly, the political culture began to change: public rejection of cash-based vote-buying signaled a maturation of civic consciousness. Consequently, Russia’s strategy shifted from financial infiltration to narrative control, but even here, effectiveness waned as citizens developed stronger resistance to propaganda narratives.

Moldova’s experience demonstrates that resilience against hybrid threats requires an integrated strategy combining legal, institutional, technological, and societal dimensions. Strengthened oversight mechanisms can deter illicit financing, but sustainability depends on civic engagement and international solidarity. For the EU and its partners, Moldova’s trajectory provides a replicable model for building hybrid resilience in other Eastern Partnership states.

This paper was first published as a chapter in Countering Hybrid Threats: Lessons from Eastern Europe, a DGAP Report edited by Anastasia Pociumban and Ricarda Nierhaus (German Council on Foreign Relations, February 2026). It was part of the colloquium on hybrid threats organized by the German Council on Foreign Relations (DGAP) and the Institute for European Policies and Reforms (IPRE) in Chișinău, Moldova, from November 5 to 7, 2025.

The views expressed herein are those solely of the author(s). GMF as an institution does not take positions.