Weekly Roundup: 3 Undercover Investigations and Leaked Documents Expose Kremlin Planning

ZdG, the BBC, Bloomberg and NordNews all gained insights into the Shor network

3 Undercover Investigations

The last few days have seen the release of multiple investigations with undercover journalists infiltrating the Shor network - often for months at a time. The undercover journalists infiltrated different parts of the network, but sometimes overlapped and even published discussions with the same Shor operatives. We’ll go through some of the main discoveries, but each investigation is worth reading in full:

• ZdG - The Kremlin's Digital Army (II) (English)

• BBC - How Russian-funded fake news network aims to disrupt election in Europe (English)

• NordNews - Five months undercover // Moscow's network, conspiratorial actions, money, propaganda and electoral manipulation (Romanian)

ZdG - The Kremlin's Digital Army (II)

In early September we wrote about ZdG’s first investigation detailing their infiltration of The Kremlin’s Digital Army. This first article detailed journalist Natalia Zaharescu’s undercover investigation through March 2025, when Shor’s coordinators realized that the fake identity was previously part of a different investigation. ZdG journalist Măriuța Nistor then picked up and with a new identity entered the network as “Ludmila.” Here are some key details:

• “Ludmila” entered the digital army, aka “InfoLider” (InfoLeader) program. She was put in a group called “Training of Communication Activists 4” which had 260 members.

• Their pay schedule was explained to work on a sliding scale. If they were tasked with making 100 social media posts in a month, then full salary (3000 lei) would be provided for 81-100 posts. The salary decreased as fewer posts were made down to a minimum of 600 lei for 30%. Bonuses would be available based on various criteria.

• All the work was remote - no meetings in person were ever organized.

• When pay time came, “Ludmila” was first offered payment via the PSB Bank app, but when she said that she could no longer access her account there she was offered other options:

"I can send you euros directly to a Moldovan card, they will automatically convert to lei. If anything, I already send to many and it seems there are no problems. I simply send, as a rule, from Germany, France, Great Britain, but there are no traces at all. But if you prefer cryptocurrency and that’s more convenient for you, you’ll need to decide quickly"

• She opted for crypto and was ultimately paid $130 for her work in USDT

• Week by week they would be sent messaging priorities. It started with posts claiming that the language is “Moldovan” not Romanian, followed by narratives glorifying the USSR in WW2 and degrading Romania. In April posts shifted to how the United States had abandoned Moldova. Later they shifted to supporting the MEGA conference in Chisinau and attacking Emmanuel Macron and other EU leaders. All the time posts attacked PAS and Maia Sandu.

• Something broke in late August - When Shor’s street occupying “permanent protest” failed something in the network broke. Curators explained that this failure was critical and that “most likely, nothing will remain of the "Victory" [Pobeda] bloc. That is why everyone was so confused and panicked.” Payments stopped and while curators encourage people to keep working, a mini-strike began by September 1st with no sign of payment. Initially they explained that "there's a lot of pressure on accounting" right now, sharing that their accountant is the same as the one for the Pobeda bloc (Shor network). For 10 days the network went silent until, on September 10th, curator Mikhail Alexandrovich returned and explained that there had been a power struggle within their leadership. Someone else had tried to take credit for their work and cut off the actual financial flows - but this person was eventually defeated. He explained that payments were on the way, work would resume and they would now be focused on supporting Victoria Furtuna and the Moldova Mare party in the elections.

ZdG additionally reported that the Digital Army was restructured over the summer into North, Central and Southern commands. Each had independent curators and networks, and at least one network was tasked with supporting George Simion after he lost the Romanian elections. This meant creating posts claiming that the election was rigged against him and that Moldova was planning the same thing, etc.

BBC - How Russian-funded fake news network aims to disrupt election in Europe

The BBC’s investigation involved an undercover reporter they called “Ana” who infiltrated online and offline Shor network meetings. Their article is interesting and worth a read, but much vaguer than local press - likely because British libel laws make news outlets very reticent to name individuals or even organizations. They did however note that “Ana” was approached by Shor network coordinator Alina Juk and recruited into various offline trainings and events. It’s very possible that she was in the same room as “Olga” an undercover journalist for NordNews who reported on the same story - but far more extensively… and in a way that eventually landed Alina Juk in jail.

NordNews - Five months undercover // Moscow's network, conspiratorial actions, money, propaganda and electoral manipulation

NordNews’ infiltration of the Shor network began offline but later merged into the “InfoLider” program that ZdG had also infiltrated. For 5 months “Olga” attended trainings sessions on propaganda, political persuasion and political indoctrination. She was tasked with online and offline projects and paid for her work - ultimately garnering 50,000 lei and becoming a sort of network leader. NordNews later transferred this, and other funds received to the Anti-Corruption Police (CNA) and provided evidence that helped wrap up elements of this network and led to some arrests.

Here are some key takeaways:

• Shor’s “Eurazia” NGO was the organizer of this effort which they called the “Electoral Technologies Hackathon.” It involved a long list of Russian figures who are experts in key programing areas - electoral manipulation, propaganda, public relations, etc.

• Participants like “Olga” were put through a highly structured set of online and offline trainings with instructions on offline messaging such as:

"If you have noticed that the most active voters in your constituency are young mothers and grandmothers with two or three grandchildren, this does not mean that you have to tell them that every mother will receive a new stroller, and every grandmother will have her pension increased. They will not believe you. But you can talk about the importance of family values, about the fact that grandmothers do very important work, and that it would be good to increase the pension a little. This, in fact, is the art of a political consultant," Russian political technologist, Piotr Korolev

• Following months of online trainings and provided offline reading materials, they were transferred to activist roles. Coordinator and message curator Alina Juk organized offline “push polls” whereby network operators would ask questions of random people on the street. The questions were themselves misleading and designed to deliver a political message, but Alina Juk also said that the results would be delivered to interested parties in the Patriotic Bloc and Alternative Bloc. Victor Pruteanu of Alternative denied any knowledge of the organization “For Fair Elections" - Shor’s front group.

• Additional offline meetings / trainings were held in Balti and Chisinau with speakers including Patriotic Bloc MP Bogdan Țîrdea.

• “Olga” was transferred to a post with Victoria Furtuna’s Moldova Mare party where she was told to sign up as a volunteer. She was also later selected for the InfoLider program for online disinformation.

• In parallel, Moldova Mare approached NordNews with a proposal to run paid articles on the site in exchange for a fee. Editors agreed in order to track the financial transaction and found that no matter how they asked, Moldova Mare would only pay in cash without documents.

“Olga” ultimately ended her investigation with NordNews providing all the gathered payments to the CNA and evidence on safe houses and other network locations. They ended their article with a call to action writing:

"On September 28th, the power returns to the citizens. Go vote, get informed from credible sources, reject money, fear and lies. A ballot stamped with knowledge weighs more than any shadow network."

Bloomberg and Leaked Documents

Also in the investigation game is Bloomberg news who published an article this morning. Journalist Alberto Nardelli reports on a set of leaked documents outlining the Kremlin’s plan to overturn democracy in Moldova. The plan was coordinated and approved directly by the Kremlin in the spring and targets a loss for PAS in the elections and then the removal of President Maia Sandu from power.

Bloomberg did not publish the documents or detail explicitly what they entailed. In their short summary they included the following tactics:

• Recruiting Moldovans in Russia to vote at polling stations in the EU

• Widespread online disinformation campaigns and offline disruptive protests

• Blackmail against public officials in Moldova to disrupt elements of the electoral process

In addition, Bloomberg reports that in a separate set of documents that they obtained they have evidence of Igor Dodon’s use of the security and intelligence services to spy on his political enemies when he was president. They involved hundreds of text messages between Dodon and a member of the Moldovan intelligence services who he tasked with obtaining information - from flight manifests, to border crossings, or infiltrating meetings. Some targets included foreign embassies. In at least one case he was having one of his own officials monitored, stating that this person was imposed on him by the country’s “eastern partners” and that he wanted them watched.

Igor Dodon responded before the piece was published with an open letter to Bloomberg editor John Micklethwait. In it, he does not address any specifics, but blames PAS for (all kinds of stuff) and accuses Bloomberg of being part of a conspiracy to create an “artificial scandal.”

Other Shor / Hybrid War Updates

It seems today’s newsletter is pretty much all about Russian hybrid attacks. Here are some other important updates:

• Socialists run illegal election call center from Romania - The Romanian press reported that 13 Moldovans took rooms in a hotel in Iasi booked through September 26th. They also booked a conference room and set up a call center there with computers and headsets. Police were tipped on September 15th as to a suspicious action and discovered an operation calling Moldovan voters and trying to convince them to vote to Igor Dodon’s Socialists and their Patriotic Bloc. This isn’t against Romanian law, so the police left. Immediately all 13 Moldovans checked out, paying for the entire unused stay, and departed the country. The Socialist party denied affiliation with the group calling the story “a cheap invention." Why Romania? Check the footnote¹.

• The Romanian Citizenship Authority is reportedly considering stripping Victoriei Furtună of her citizenship. She claims to have no information about this reporting and did not answer questions. Under Romanian law, citizenship can be revoked under these circumstances:

"Romanian citizenship may be withdrawn from a person who is known to have links with terrorist entities or has supported them, in any form, or is involved, in any way, in the preparation or commission of an act of terrorism or has prepared or committed any other acts that, according to the law, constitute threats to the national security of Romania."

• New coordinated information campaigns target the police and carabinieri. These campaigns call on the security services to “be on the side of the people” and to stand with the supposed “people” against the government. Experts told ZdG that the purpose isn’t really to encourage defections, but to delegitimize the police by insinuating that they are a political arm of the PAS party. They note that similar campaigns have been seen, or are currently under way, in Serbia, Georgia and other countries in the Balkans. This a is a regional effort by the Kremlin. Chief of the National Police Viorel Cernăuțeanu responded by expressing firm confidence in the professionalism of his officers saying:

"The team that stands to my right, to my left, behind me, I am confident that they are reasonable people, they are prepared people and they, in fact, distinguish good from evil and understand very well what is the role of a democracy in the Republic of Moldova"

• Today, September 22nd, law enforcement conducted more than 250 searches in localities - and in prisons - across the country. Officials say that the raids, which involved police, Fulger police special forces, the Security and Intelligence Service (SIS) and others, were targeting suspects alleged to be preparing mass disorder and destabilization operations orchestrated by Russia. Igor Dodon later stated that the Socialist Party offices in 2 northern raions (counties) were raided. He accused President Sandu of laying the groundwork to cancel the elections.

• The Ministry of Justice is suing to limit the activity of Irina Vlah’s Heart of Moldova Party. This follows a referral last week from the Central Election Commission (CEC) to the ministry. This follows recent law enforcement searches that Irina Vlah announced targeted her party. Police did not comment on that statement, but 2 smaller parties in the elections, PNM and ALDE took the press clippings to the CEC and asked for an investigation. CEC then sent it to the Ministry of Justice (where it started) and then they sued stating that they had reasonable suspicion of illicit party financing. This roundabout process is now in court, and has raised questions about what would happen if Heart of Moldova were to be removed from the elections - they are part of the Patriotic Bloc alongside Igor Dodon’s Socialists.

Election News

Here’s a roundup of the other top election stories of the week:

• The Alternative Bloc promises not to steal more than usual. Ion Bulgac, candidate #31 on the Alternative list and a member of the MAN party answered an interviewer’s question as follows:

"The Alternative bloc, being a healthy centrist political force, brings together people with different views who are capable of finding compromise. […] You will see people there who are capable of managing public affairs without stealing more than all their predecessors,"

• Igor Dodon is calling on Transnistian residents to move to polling places 3 days before the elections. He cited recent bridge repairs and suggested that the authorities may try and close the bridges down on election day. He called on voters in the region to go and stay with relatives on the right bank for a few days so that they can’t be blocked from the voting booth on Sunday.

International Affairs

Here are the top international affairs stories (also mostly election related) of the week:

• The US Government announced it was resuming funding for the Straseni-Gutinas high-voltage power line. The grant of $130 million dollars, which was previously managed through USAID, will continue under the State Department’s new international aid mechanism. The 190 km high voltage line will be the 3rd major connection to the Romanian, and therefore EU, energy grid. The first connection, the Chisinau-Vulcănești line, is scheduled to be completed this year while a second is in a planning stage. The announcement from the US Embassy called the news a great opportunity for American companies, implying that construction of the project will be reserved for US companies. Thus the US has restarted some aid to Moldova, but it is couched in “America first” framing.

• 8 Former US Ambassadors sign an open letter warning of a victory of pro-Russian parties in the elections. Ambassadors Kent D. Logsdon, James D. Pettit, Adrian Zuckerman, Mark Gitenstein, Kathleen Kavalec, and Jim Rosapepe, signed the letter warning that a victory for pro-Russian parties would “Shatter regional security; Threaten NATO’s eastern flank; and Hand the Kremlin another launchpad for further aggression against Romania and Ukraine.” They called for people to stand with Moldova writing “There is no middle ground between freedom and tyranny — Moldova’s choice is the world’s choice: freedom.”

• Ukraine sanctions 11 Moldovan politicians. Ukraine’s action seizes their assets held in Ukraine, blocks travel, strips business rights and more. The measures target Victoria Furtună, Evghenia Gutsul, Bogdan Țîrdea, Constantin Starîș, Vasile Bolea, Igor Șornikov, Iurie Ciofu, Victor Petrov, Nataliia Paraska, Ion Mahu and Dmitrii Konstantinov. The sanctions apply for 10 years.

Plahotniuc Updates

On September 17th reports came that Greece was no longer planning to extradite Plahotniuc on September 25th. Prime Minister Recean speculated that Plaha may be trying to delay his arrival in the hope of meeting a friendly pro-Russian government, and noted that the Moldovan government was seeking his immediate extradition. 24 hours later Greece reported that they were reversing course and that the September 25th date was still valid. It is not clear what happened in this time.

Meanwhile, in Moldova, Plahotniuc’s lawyers were set to appear in court to oppose a prosecutorial motion to separate him from the larger bank fraud case. The hearing was delayed as Plaha’s lawyer was taken by ambulance to the hospital 10 minutes before the hearing was scheduled to start².

Also this week, prosecutors succeeded in issuing an arrest warrant for Plahotniuc’s bodyguard and lieutenant Constantin Țuțu. When he was arrested in Athens alongside Plaha he was not wanted in Moldova in spite of multiple criminal cases progressing (slowly) through the courts. Prosecutors argued that new evidence and circumstances made him a flight risk and asked for preventative detention. Various rumors in recent weeks have claimed that Țuțu is in Transnistria, while his lawyers claim he is still in Greece. His actual whereabouts are unknown following his release from Greek custody last month.

1. Running a get-out-the-vote call center is not illegal at all - but it is electoral activity and therefore has to be done with official party funds. Parking a call center and campaign team outside the country would be done to evade party financing regulations and hide the source of the funds.

2. I hope very much that he or she is alright. But if one were to consider the number of hospital visits, car breakdowns, car accidents and other mishaps that happen to Plaha / Shor / Plahon / Gustul / Tauber / etc’s lawyers in the 1 hour before court, one would find a pattern.