#A frontline stress test for Europe

The story of Moldova’s recent parliamentary elections is both a success and a warning.

Its 2025 elections took place against the backdrop of Russia’s full–scale invasion of Ukraine and an ongoing hybrid war against Europe. On the European Union (EU) border, a vulnerable democracy was hit by a barrage of disinformation, illicit funding and cyberattacks aimed directly at its electoral process.

Only a rapid, coordinated response that brought together institutions, civil society and international partners enabled Moldova to protect the integrity of the vote.

This collective effort now stands as a model of democratic resilience in the face of Foreign Information Manipulation and Interference (FIMI) and other hybrid threats. It also offers a broader warning. The methods tested against Moldova will be used elsewhere, and they will return in future elections, often in more sophisticated forms.

Above all, it shows how the ‘new generation triad’ of hybrid threats – disinformation, illicit funding and cyberattacks – has become the main battleground for electoral integrity. Resilience today depends less on what happens on election day and more on coordinated, real–time responses across sectors.

This has unfolded just as the European Union has been developing the European Democracy Shield, a blueprint to protect the very foundations that Moldova had to defend in real time: genuine and democratic elections, independent media, vibrant civil society and resilient institutions.

#Inside Russia’s hybrid interference playbook

Russia’s interference in Moldova operates through a broad and well–resourced FIMI ecosystem designed to derail the country’s path towards European Union accession.

It combines AI-generated disinformation, coordinated bot networks, crypto–based illicit financing schemes, cyberattacks on state institutions and proxy mobilisation through oligarchic structures linked to Ilan Șor and Vlad Plahotniuc – Moldova’s infamous oligarchs with ties to Russia. The objective is to destabilise politics and erode trust in institutions.

This toolkit is not new. It was developed in previous elections, most notably during the 2024 presidential election and the referendum on European Union accession, to suppress turnout, weaken pro-European candidates and deepen societal divides.

In 2025, the same machinery evolved. Earlier elections had relied more heavily on traditional cash–based strategies.

As the Moldovan authorities tightened legislation and improved coordination between oversight bodies in early 2025, some of these channels became harder to exploit. The response from Moscow and its proxies was to adapt.

They leaned on cryptocurrency schemes, embedding flows intoinfluence channels on Telegram, such as ‘Taito’, linked closely to criminal and oligarchic structures. This revamped financing fed directly into extensive vote-buying and disinformation campaigns, particularly on Russian–language media and across Telegram. Cyber operations managed from outside the country completed the triangle.

In the run-up to election day, these elements increasingly operated as a single hybrid campaign. Disinformation narratives warning that the government would drag Moldova into war spread widely on Telegram, Russian-language outlets and via emerging AI-generated content, deepening fear and mistrust.

In parallel, illicit financing networks linked to Șor and Plahotniuc channelled cash, cryptocurrency and parallel campaign structures designed to distort voter behaviour. Investigations later showed how hundreds of Telegram groups functioned as command–and–control hubs to activate supporters and shape turnout.

Cyberattacks on state institutions and the Central Election Commission (CEC), including distributed denial-of-service (DDoS) attacks and fake lookalike sites, were then amplified by disinformation casting doubt on the authorities’ ability to administer the vote securely.

Taken together, these actions formed a unified pressure operation. They were intended to weaken pro-European forces, fracture social cohesion and create an atmosphere in which the legitimacy of the election could be questioned even before polls opened.

#The unique case of Moldova

Moldova has become one of Russia’s key testing grounds for this full hybrid playbook, where disinformation, illicit financing and cyber operations are deployed and refined in increasingly sophisticated ways.

Illicit financing in Moldova electionsImage generated by the authors

Unlike in countries where responses have been slower or more fragmented, Moldova entered the 2025 race with the hard-won experience of its turbulent 2024 elections and with closer coordination with international partners.

This allowed Moldovan institutions and civil society to confront these converging threats more directly and, in doing so, to reveal more clearly than elsewhere how Russia’s hybrid toolkit operates in practice.

Elections are increasingly being used as laboratories for hybrid interference. International observers have begun to adapt. The EU, the Organisation for Security and Cooperation in Europe’s Office for Democratic Institutions and Human Rights (OSCE/ODIHR) and others now track disinformation and cyberthreats more systematically and are strengthening their methodologies to deal with these hybrid threats.

Yet they can still see only the tip of the iceberg, identifying broad narratives and patterns rather than conducting deep investigations. Much of the detailed evidence comes from national actors, citizen observer groups, media watchdogs and investigative journalists. This is particularly visible in the online environment, where new threats emerge faster than methodologies can adjust.

Moldova illustrates this dynamic clearly. The convergence of FIMI vectors was documented in unusual depth because national actors were able to track platforms and behaviours over time, and because Moldovan institutions chose to cooperate with them, sharing information and reacting to alerts in real time – a unique case study in its own right.

#Dark money 2.0: illicit funding in the Crypto Era

Money has always been one of the most powerful ways to manipulate elections.

For years, international organisations such as OSCE/ODIHR, the International Foundation for Electoral Systems (IFES) and the International IDEA have warned that opaque campaign finance can distort competition, buy influence and hollow out democratic safeguards.

Their methodologies have increasingly incorporated political finance, but they still tend to focus on domestic compliance rather than the hybrid warfare dimension: early, hidden, foreign-directed financing flows designed to tilt the playing field long before votes are cast.

Moldova’s 2025 elections showed how fast this threat is evolving. Traditional tools such as suitcases of cash, offshore channels and hidden donations are now being fused with new, technology-driven channels.

Cryptocurrency-based schemes, shadowy intermediaries and cross-border criminal networks are being used to move money from banned or politically toxic sources into local campaigns.

#Three lessons for Europe

The set of whole-of-society activities taken in Moldova can be grouped into what Moldovan officials describe as a ‘resilience triangle’: coordinated institutions, well–informed citizens and credible partnerships, both domestic and international.

This triangle enabled Moldova to detect threats faster, communicate more clearly and respond more consistently than many larger democracies under similar pressure.

The European Democracy Shield’s planned European Centre for Democratic Resilience and its Stakeholder Platform for civil society, academia and media reflect the Moldovan model closely. Moldova shows what such a ‘resilience community’ looks like when it is already functioning in practice.

Moldova elections – resilience triadImage prepared by the authors

#One. Cooperation is the key antidote

New legal provisions in Moldova introduced stricter campaign finance reporting, giving the CEC more timely data than many Western counterparts enjoy.

The CEC received weekly reports, reviewed them and applied sanctions where appropriate. The Anti-corruption Prosecutor’s Office and the Financial Intelligence Unit worked in tandem to trace suspicious flows, expose vote buying schemes and pursue criminal investigations.

Many of these cases are still working their way through the courts, but the combined institutional response made it much harder for illicit money to operate in the shadows.

Civil society played an important role. Organisations such as Promo-LEX brought years of experience in documenting vote buying and political finance abuse, as well as strong public credibility.

Their long-term monitoring helped to flag patterns early, while their public communication gave citizens a clearer sense of what was at stake.

A whole-of-society approach began to emerge. Authorities, observers and media each contributed to a common goal of transparency, even if they did not always agree on every step.

Public information campaigns from the police, other state bodies and leading non-governmental organisations created multiple layers of messaging that reinforced one another and helped build trust.

The main lesson is clear. Moldova’s progress rested on enforcing transparency before, not after, the vote and on explaining to the public why this mattered.

It also showed why illicit finance can no longer be treated as a narrow compliance issue. It has become one of the central pillars of hybrid warfare and a core element of electoral security.

Elsewhere in Europe, within the European Democracy Shield, the European Commission’s plans to strengthen the European Cooperation Network on Elections and issue guidance on the responsible use of AI in electoral processes speak directly to these challenges.

Moldova’s experience with opaque online spending and cross–border money flows shows why such European Union–level coordination and guidance are urgently needed.

#Two. Democracy has to be guarded in the digital space

Cyberattacks formed the third pillar of the hybrid campaign against Moldova and one of the most consequential.

Formal attribution is always complex, but the direction, timing and coordination of attacks offered a clear indication of who stood to benefit.

In the weeks before the vote, Moldova faced an escalation in digital assaults: DDoS attacks on government and CEC sites, fake websites mimicking official portals and attempts to breach critical systems.

These incidents were often paired with disinformation narratives designed to amplify panic, question system integrity and erode trust. Even minor breaches became fuel for online claims that the authorities were unable to safeguard voter data.

What made Moldova different was the speed of its response. New structures such as the Agency for Cyber Security (ACS) worked closely with the Information Technology and Cyber Security Service (STISC), national security bodies and international partners, including European Union and NATO–linked cybersecurity teams, to detect and neutralise threats.

Pre–election tabletop exercises and cyberhygiene training helped institutions prepare for real–time incidents. They gave administrators clearer protocols, better communication channels and faster decision–making processes.

This proactive stance contrasted sharply with the delayed or fragmented responses seen in other countries facing similar threats. Moldova recognised early that cybersecurity is no longer a technical back–office function but a frontline defence of democracy itself.

Protecting voter data, results management systems and official communication channels is now integral to electoral integrity, whether a country uses electronic voting or not.

Three. Resource allocation and partnerships need to be centralised and future-proof

Cyber incidents increasingly overlap with disinformation campaigns, where each reinforces the other. International election bodies are also adjusting. OSCE/ODIHR updated its information and communications technology observation handbook in 2024, and the European Union is revising its methodology in this area.

However, capacity gaps remain, especially among civil society groups now operating with fewer resources after the withdrawal of major donors such as the United States Agency for International Development (USAID). Strengthening the ability of citizen observers to understand and document cyberattacks is essential.

The European Democracy Shield places cybersecurity alongside FIMI as a core pillar of democratic resilience. Its planned European Centre for Democratic Resilience mirrors the model Moldova piloted under pressure: multi–agency coordination supported by trusted international partners.

Moldova’s experience now offers a practical blueprint for how this centre could function in both European Union Member States and neighbouring countries.

#Beyond defence: when resilience becomes reform

Moldova’s 2025 elections show what determined defence can achieve, but defence alone is not enough. Moldova, like many democracies under pressure, now needs to turn its ad hoc resilience into long–term reform.

Several areas are ripe for strengthening. Investigations into illicit financing must lead to real accountability, with sanctions that deter future violations.

Disinformation monitoring and strategic communication require stable funding and clear institutional mandates. Full transparency of online political advertising is essential, especially as AI-generated content becomes more sophisticated.

Cybersecurity must be understood as democratic defence, a political priority rather than a technical afterthought. Moldova’s progress here should continue, in line with emerging European Union frameworks.

States should also update their methodologies in tackling illicit finance, disinformation and cyber threats to reflect the hybrid nature of modern election interference.

Next steps should include codifying cooperation between institutions, expanding civic–tech initiatives and embedding FIMI countermeasures into law and practice.

Moldova is well placed to become a model for structured European Union support: integrated FIMI frameworks, capacity–building in cyber defence and cross–border investigative collaboration. In this context, the Democracy Shield offers concrete pathways to transform crisis responses into long–term democratic infrastructure.

The European Union Strategy for Civil Society, particularly its Civil Society Platform and Knowledge Hub, aligns with Moldova’s need for predictable support for the organisations that provided the country’s early–warning system.

#Democracy’s frontline holds, for now

Moldova’s recent elections show that democratic resilience is not accidental; it is the result of deliberate choices. It reveals that when institutions, civil society and international partners act together, the ‘Goliath’ of hybrid interference starts to look less invincible.

It also shows that the lessons learned in one country can help strengthen others, if they are shared quickly and honestly.

The European Democracy Shield and the European Union Strategy for Civil Society are attempts to codify at the European Union level what Moldova improvised under fire: a whole–of–society defence of democratic institutions.

If they are implemented with real ambition, Moldova’s story will not remain an exception but become a benchmark.

The stakes could not be higher. The next wave of interference is already in motion elsewhere.

The question is whether democracies are willing to invest in the kind of resilience that Moldova has begun to build and whether they can turn scattered successes into a broader shield for Europe as a whole.

The article was published by Visegrad Insight on 5 December 2025

Sănătăuca village, the situation at the bridge on election day, 28 September 2025

The road to Rezina, eastern Moldova.