In early Q3 of this year, a coordinated inauthentic behavior (CIB) network targeting Moldova was disrupted. This operation, primarily originating from the Transnistria region, focused on misleading Russian-speaking audiences in Moldova through fake accounts and fictitious news brands.

The campaign involved seven Facebook accounts, 23 Pages, one Group, and 20 Instagram accounts that were removed for violating policies against CIB. These entities posed as independent news outlets across various platforms including Telegram, OK (Odnoklassniki), and TikTok. Brands such as Tresh Kich, Moldovan Mole, Insider Moldova, and Gagauzia on Air were part of this operation.

Fake accounts managed these pages to post content and direct users to off-platform channels like Telegram. Some profiles used photos likely generated by artificial intelligence to disguise their identity. The content included criticism of President Sandu and pro-EU politicians while supporting pro-Russia parties in Moldova.

The network's reach extended beyond Moldova with about 4,200 followers on Facebook Pages and approximately 335,000 on Instagram accounts. Most followers were outside Moldova, indicating the use of inauthentic engagement tactics.

This activity also involved around $4,000 spent on ads paid mostly in US dollars. The investigation revealed links to individuals from Russia and Moldova operating from Transnistria and connections to a fake engagement service offering fake likes and followers across multiple platforms.

These findings are part of an ongoing effort to detect and counter malicious activities online. The threat indicators associated with this network will be added to a public repository on GitHub for further study by the research community.