Cross-Platform Infrastructure: Facebook & TikTok in Moldovan Elections

Authors: Sorin Ioniță, Voinea Mădălina

Credits: WatchDog.MD analysis THE RUSSIAN DISINFORMATION NETWORK IN MOLDOVA: ANATOMY OF A SOCIAL MEDIA OPERATION

Key insights:

• We’ve found significant traces of identical profiles with the inauthentic accounts on TikTok we already published
• 100 inauthentic accounts on Facebook
• 1008 posts analyzed in the interval 1-17 September
• More than 30 of these accounts were already active in August and documented by WatchDog.MD in their report on Russian disinformation networks
• What do they do? Functions: sharing in groups, interacting with content, following other CIB accounts
• Persistent pattern – infecting the feeds with either fearmongering content, AI generated disinformation
• A part of the accounts are organised with similar hashtags on Facebook such as: #Sandu #glasulpoporului #josPAS #alegeri2025
• The pages strategically combined crisis messaging with metaphors for national humiliation, economic grievances, external control narratives and emotional camouflage through apolitical “everyday joy” content to mask the coordinated nature of propaganda content.

Introduction 

This report’s monitoring exercise confirms and deepens findings from earlier Expert Forum monitoring for  FACT-HUB.EU, which have documented coordinated disinformation operations in Moldova. Among our recent conclusions: (i) that pro-Russian narratives are being spread through both overt channels (e.g. political actors, media outlets) and covert ones (fake or anonymous social media accounts), (ii) that online narratives frequently exploit economic hardship, historical grievances, and identity politics, and (iii) that the methods include mirrored dissemination across platforms, repetition of themes with slight variations, and use of inauthentic profiles to simulate grassroots support. These prior findings provide a foundation for the current monitoring, which reveals even more complex networks and more aggressive behaviour, particularly on Facebook and TikTok.

The central findings of this new monitoring are striking. First, there is evidence of fake accounts and networks of CIB that are mirrored across platforms: identical or very similar profiles operating on multiple platforms (in our case, TikTok and Facebook) sometimes under the same names. These networks amplify common pro-Russian narratives, often with identical content or visuals. Second, the themes repeatedly deployed are consistent: attacks on pro-European leadership, claims of corruption and incompetence, distrust of foreign influence (especially from the EU or NATO) and appeals to nostalgia for Soviet or Russian-aligned pasts. Third, these operations are technically coordinated: similar timing of posts, reuse of hashtags, repetition of visuals, and cross-platform amplification suggest not random actors but orchestrated campaigns.

In the wider political context, such interference is part of Moscow’s broader strategy to maintain leverage over Moldova, especially in moments of transition or electoral vulnerability. Under the EU Partnership Mission in Moldova (EUPM), among other international efforts, the Moldovan authorities have increasingly recognized FIMI as an increased threat. From the Moldovan case, several concrete tactics of Russian FIMI emerge that can be framed as lessons for other European elections. Here are the key ones:

1. Mirroring and cross-platform cloning

The Moldovan monitoring shows how fake accounts are not confined to a single platform. Instead, identical or nearly identical profiles appear on both Facebook and TikTok, sometimes even reusing the same names. This duplication allows propagandists to reinforce narratives, evade takedowns on one platform, and simulate broader consensus. Lesson: European election monitors should track patterns across platforms, not in silos, since malign actors now design campaigns that exploit the weakest regulatory environment.

2. Hybrid messaging: political propaganda camouflaged by lifestyle content

Propaganda pages do not broadcast disinformation nonstop. Instead, they strategically mix crisis narratives (national humiliation, economic grievances, corruption claims) with seemingly apolitical content: “everyday joy” posts, family photos, or humorous memes. This camouflage helps inauthentic networks avoid detection, build trust with followers, and make the propaganda appear more organic. Lesson: Monitoring should not ignore “soft” content; it can serve as a Trojan horse for political manipulation.

3. Reuse of hashtags and linguistic markers

In Moldova, networks aligned their activity through consistent hashtags (#Sandu, #josPAS, #alegeri2025) and stylised slogans, which served both to synchronise content and to signal ideological alignment. Lesson: Hashtag clustering and textual analysis are valuable early-warning tools in detecting coordinated inauthentic behaviour.

4. Exploiting emotional vulnerabilities and identity politics

The narratives most frequently deployed revolve around economic hardship (energy costs, housing), corruption allegations, cultural identity (language, Gagauzia, Transnistria), and foreign domination. These are emotionally charged issues with deep social resonance. Lesson: Foreign manipulators will always anchor propaganda in domestic pain points, not abstract geopolitics. Future European election monitoring should map out which local vulnerabilities are most likely to be exploited.

5. Timing disinformation to electoral milestones

Posts in Moldova clustered around key electoral deadlines: polling countdowns, campaign scandals, and the approach of election day itself. The aim is to erode trust in institutions exactly when voters are making decisions. Lesson: Monitoring should be time-sensitive, intensifying in the weeks before election day, and anticipating spikes around debates, polls, or crises.

Together, these tactics illustrate how FIMI is no longer about crude disinformation “from outside”; it is about embedding manipulation inside domestic digital ecosystems in ways that blur the line between authentic and inauthentic voices. Moldova’s experience shows how sophisticated these operations have become and why Europe must anticipate similar methods in its own electoral contests.

One of the starkest lessons from the Moldovan case is the opacity of platform data. Without greater transparency on who is paying for what in terms of political advertising, and without systematic researcher access to datasets on suspicious accounts, coordinated manipulation remains difficult to counter. The key is not policing content, which risks veering into censorship, but addressing coordinated inauthentic behaviour (CIB), which the platforms already define and prohibit in their internal rules. Lesson: For Europe, this means pressing VLOPs to enforce their own standards consistently, and to provide structured, timely data access to independent monitors and electoral bodies. Otherwise, malign actors will continue exploiting the asymmetry between their agility and society’s limited visibility.