Kremlin’s Digital Army — An Undercover Investigation. „It’s paid, let me tell you, it’s paid directly from Moscow”

Hundreds of accounts with fake identities, operated by real activists of the “Victorie” Bloc, controlled by Ilan Shor from Moscow, were created to spread Russian propaganda on TikTok and Facebook. All posts were rigorously monitored, and communication was coordinated through secret Telegram groups and channels.

For several months, the so-called “communication activists” of the “Victorie” Bloc were trained online by a team of Russian-speaking curators on how to use social networks and manipulate algorithms to maximize their impact. Later, these activists were armed with anti-European propaganda texts aligned with Russian narratives and began flooding the online space daily, acting as a digital army of the Kremlin against Moldova, with the parliamentary elections of September 28, 2025, as a key target.

Although payment was not initially discussed, the most diligent activists of the Shor network were eventually selected to form a detachment of directly paid operatives from Moscow.

After Russia, via the network coordinated by Ilan Shor, attempted to influence tens of thousands of voters in the 2024 presidential elections and referendum, the group continued its activity. Preparations for the 2025 parliamentary elections began immediately after the second round of the presidential election.

Ziarul de Gardă has once again conducted an undercover investigation into the network, this time online. This report shows step by step how a real troll farm, coordinated directly from Moscow, was formed, expanded, and strengthened, what narratives it spreads, who it promotes, and who it attacks.

“Free training on social networks”

Activist Irina Zahar, actually journalist Natalia Zaharescu from Ziarul de Garda, who infiltrated Ilan Shor’s network in 2024, was publicly exposed through the investigation “In Moscow’s Service.” However, her contact information was never removed from the network’s database. On November 7, 2024 – just four days after the second round of the presidential election and one week after the publication of the investigation’s second part – she received a call from the central office of the “Victorie” Bloc. It was the same phone number that had previously contacted the ZdG journalist during her infiltration, even instructing her on who to vote for in the second round of the 2024 presidential election.

The caller, speaking Russian, thanked “activist Irina” for remaining part of the team and invited her to take part in a “free training on social networks,” so that she could serve as a “communication coordinator activist” within the “Victorie” Bloc: “You must write to a Telegram number, and they will send you an inquiry. The curator there is Eva Sergeevna.”

The Telegram account was linked to a Russian phone number. The name Eva Sergeevna had also appeared in the first part of the “In Moscow’s Service” investigation, as the coordinator of the group of communication activists that included Ana Nastas – another identity used by ZdG undercover journalist Mariuta Nistor.

“I am happy to greet you in our video chat”

From that moment on, most of the communication moved to the Telegram app. Eva Sergeevna sent a link to a group titled “Обучение Активистов по Коммуникации” (Training of Communication Activists). That same evening, a call was held in the chat, which already counted 55 members.

The group operated in a set rhythm: during the day, video tutorials on how to use social networks were shared in the chat, while in the evenings, usually around 8 p.m., audio calls were held on Telegram.

The instructor was a Russian-speaking woman who introduced herself as Asea Albertovna. “I am happy to greet you in our video chat. I am grateful that you have decided to participate in our training—it is very valuable to us. This is a great opportunity to achieve our goals and to finally get to where we have long aspired,” she told the activists in her opening remarks.

A new level of information warfare

Her role was to train them on the basic functions of the Telegram app. She explained that activists would start receiving assignments: “One task every three days. The tasks will not be complicated. (…) The first assignment will be posted here in our closed chat. Don’t worry—this chat is not public. Everything is done to promote and build a new community. Because today the fight is an informational one, and the old methods no longer work, we need to move to a new level. And the new level is, no matter how frightening it may sound, the system of information warfare. Our collective, which has gathered here today, is the pilot launch of a large project that will spread throughout the country.”

In the following months, activists of the “Victorie” Bloc, including the undercover ZdG journalist, fell into a routine of near-daily trainings and calls. The initial strategy was to create Telegram groups for each district, where communication activists would post entertainment or cultural content, alternating it with political messaging. Assignments were distributed in the training group, and completing them served as proof that activists could put into practice what they had learned.

They were also instructed on how to use VPNs, anonymize their data on Telegram, hide their phone numbers, and avoid using their real names.

Supporting the candidate from Căușeni

One of the first tasks to be carried out outside the secret group on Telegram was to support through posts, comments, likes and shares on Facebook the candidate for mayor of Causeni, Ion Galusca, submitted by the “Party Alternative and Rescue Force of Moldova”, member of the “Victorie” bloc, controlled by Ilan Shor. On November 17, 2024, new local elections were held in Căușeni, which Shor’s candidate lost. 

In this context, it became clear that the communication activists’ chat included members of the network from two localities: Căușeni and Chișinău, more specifically, from the Botanica sector of the capital.

On November 17, Asea Albertovna told activists that their efforts had been noticed and praised, without specifying by whom.

“There are now 65 people in the group. Soon, this will spread throughout Chișinău, and then it will spread across all of Moldova. That means we’ll be many more here. (…) Yes, Botanica and Căușeni were pilot projects of the training platform for this communication scheme. The way we communicate has never been done before by anyone. And we have already shown great results. Even in the Căușeni elections, we managed to make significant progress, because we did it together. And this gives us hope that our interaction will take root and give us the chance to grow further. Because, as practice shows, word-of-mouth (from person to person) is much more effective than all the paperwork,” the Russian-speaking curator said during another training session.

“We are completing the team”

On December 2, 2024, a new curator was introduced in the chat, who presented himself as Adam. The activists were told that he would call them directly. That same day, he also called the undercover ZdG journalist, asking her for the section number and number of her primary organization.

In the Telegram group, Asea Albertovna began training the activists on how to use another social network – TikTok. She asked them to share their accounts on this platform and to support each other.

In the following days, Asea Albertovna hinted that new communication activists were being recruited. “Now we are conducting a massive selection of those to be trained. We are completing the team. You are like students from higher grades, if we can put it that way. You are ahead, you benefit from the most up-to-date training, while the others are just beginning.”

From her, it also became clear that the discussions in the group were monitored by someone higher up the hierarchy. “Now we are without foreign «ears». When someone from the leadership connects, you will understand from the way I speak, because we will communicate very formally”, she said one evening, asking the activists for feedback on her training. 

At the same time, Asea Albertovna explained that all the activists involved in this training will have to publish political information: „Even if we will post about politics, especially if we will post political information, we must be very cautious, not too direct. If we will present a topic too abruptly one on which everyone already has an opinion, for example, some taboo themes that are used to public discussion – politics, religion, family matters – we must present it so carefully that people have the impression it was not you who told them, but that they thought of it themselves. This will be our biggest difficulty and our main task.” 

”We play on people’s fears”

Curator Asea Albertovna stressed that the target audience for our political messages should be the elderly, since they are the most active voters. And the most effective tactic to use on them is … fear.

“The audience’s attention can be captured in two ways. The first is money, the second is fear. We play on people’s fears. And we can use that in our training and in our promotion on social networks to capture this audience. ‘Capture’ is not the nicest word, but to win them over. This audience is the most interested in our content precisely through this tactic. That is, to manipulate them, again, not the nicest word, but to show them what their worries are and bring them into important discussions,” she explained.

A change of strategy. From Telegram to Tik Tok

In mid-December, the daily calls stopped for a while, with no explanation given to the activists. During this break, the strategy shifted: the focus was now on TikTok, not Telegram.

On December 23, 2024, we were told about a new call, which took place in another Telegram group. Initially, it had around 400 participants, later growing to 500. It was called “Обучение АПК/2” (Training of Communication Activists 2). New moderators appeared there: Mihail Alexandrovich and Adam, the same person who had previously spoken by phone with the undercover ZdG reporter.

Adam explained to the activists that a TikTok flash mob would be organized for the New Year holiday, with the goal of expanding the reach of the accounts they controlled.

”If all of us, this many people, will subscribe to each other, we will give likes and if 300–400 people post an identical video with the same message, a part of the organic audience, that is, people who have no connection with us, will see it anyway. This is the big goal and it will be a great victory for us. As I said, what we are doing now is the first of its kind. Nobody before us has ever used this many people, never has such a large number gathered in the virtual space, and what we will demonstrate will be a pilot project. We will be the first,” Adam stressed.

The process of approving the content and format of this flash mob took several days, and activists were told to take the exercise very seriously.

“Please do not think of this as light entertainment or something pointless. It is not. We are not gathering here out of our own personal initiative. We have concrete tasks and goals, with expected results, which we must demonstrate so that our top leadership understands whether your presence in the bloc makes sense or not,” Adam scolded the activists.

A contest with prizes for flashmob participation

On December 25, Christmas Day, curator Mihail Alexandrovich posted in the group a short video that was to serve as the basis for the much-awaited flashmob, called “Dansuri care ne încălzesc” (Dances that warm us).

In the clip appeared one of the activists, who introduced herself as Inga, the “patient zero” of the flashmob. She filmed herself dancing next to a Christmas tree, using a melody similar to a folk tune. On the screen appeared four messages to be promoted through the flashmob: “gas for one leu,” “LGBT ban,” “fair elections,” and “pension supplements for retirees.” The activists’ task was to film similar clips and post them on TikTok, strictly following the same melody line and hashtags.

To boost participation, a contest was announced, with iPhone models offered as prizes for the first ten activists who gathered the most TikTok views.

“Now, our work aims to create the foundation on which we will build for the parliamentary elections. That is why we publish these videos not as a joke, not for fun. This is real work, which we encourage. That is why we hold the smartphone contest – to motivate you,” said curator Mihail Alexandrovich.

He instructed the activists not to mention any politician or party in their posts. “We should not start with aggressive rhetoric, but with something softer, maybe vague, so that at the initial stage people don’t even realize it,” he added, noting that the flashmob slogans “had previously been declared by Ilan Mironovich and announced by our bloc.”

On December 28, Adam told the group that the preliminary flashmob results, 64,000 views so far, had pleased the top leadership:

“We have already shown results. This flashmob is organized to demonstrate the digital potential of our team. Accordingly, the future format of the activists’ work in their primary organizations will depend on the digital capacities and coverage we demonstrate. All activists participating in this flashmob will be specially noticed. If we reach 250,000 views by January 5, we will be the biggest digital event; in fact, the biggest flashmob ever held in Moldova,” Adam declared.

Trainings continue in 2025. ”We have big plans”

In 2025, the training sessions and tasks for communication activists intensified. The first call of the new year took place on January 3. Curator Asea Albertovna praised the flashmob results: “We have very big goals: to reach one million views by January 12. And this is possible,” she said optimistically.

Mihail Alexandrovich continued instructing activists on how to write Facebook posts that attract attention while avoiding account bans. Activists were encouraged to create “work accounts” on social media using pseudonyms, not their real identities, but also to post personal content to inspire sympathy and create the impression of authentic accounts.

Adam added that leadership “considered the flashmob to have been successful.”

“Now you are on the list of communication activists who stood out during the flashmob and the training. The lists have been sent for approval. Gentlemen, please take seriously the tasks given to you by Asea Albertovna, because we will need them. My advice is that by February 1 you have three social media accounts each, accounts you don’t care about losing. That is, don’t be afraid to publish certain content there,” Adam said, boasting that he himself maintained multiple Facebook, TikTok, and Instagram accounts, posting daily to make them look like “living accounts.”

The “Anna Mihalachi test”

On the morning of January 14, 2025, without prior notice, activists were instructed in the group chat to share on Facebook and TikTok Ilan Shor’s message of support for Anna Mihalachi, a woman sued by President Maia Sandu for allegedly defaming her grandfather’s memory. The exact text for Facebook posts, hashtags, and a link to Ilan Shor’s Telegram channel “Запрещенный Канал” (The Forbidden Channel), along with a video for TikTok with the required hashtags, were provided.

Later, curator Adam explained that the assignment to support Anna Mihalachi was a test to measure how quickly the network of trained activists could react: “Neither I nor Asea Albertovna knew about this. We were informed in the morning that we had to support Anna Mihalachi. The purpose of this assignment was to check how fast and operational we, as a team, can react to such cases that need to be made public,” he said. A check of the hashtags shows that on January 14, dozens of Facebook and TikTok posts appeared with similar or identical messages in support of Anna Mihalachi.

On January 16, the results of the contest for the ten iPhones offered in the holiday flashmob were finally announced. The winners’ names and the primary and territorial organizations they belonged to were published. The top winner had managed to gather 43,000 views by that date.

“It’s time to get active! We need to spread the information quickly”

On January 22, Asea Albertovna announced that new activists were being recruited for training and that the network was expanding. “Those who haven’t yet invited their friends, and this is very necessary and important, this is your last chance. Starting tomorrow, we begin with the newcomers, those who are only just starting to learn about the media space and social networks.”

On January 23, activists received a new assignment with the following message: “It’s time to get active! We need to spread the information quickly.” Shortly afterwards, links to Facebook and TikTok accounts were shared, with examples of posts that needed to be slightly modified and published as quickly as possible on the activists’ accounts. The message targeted the mayor of Chișinău, Ion Ceban, under the title “Chișinăul este în pragul falimentului” (Chișinău is on the brink of bankruptcy). Activists were instructed to add the hashtags #Cebaneunratat, #Chișinăufalimentat și #Primarullademisie.

The assignment sparked discontent among the activists, which was quickly quashed by their coordinator, Adam, who told them clearly that tasks had to be carried out regardless of their personal opinions.

“Colleagues, we are not an enthusiasts’ club here, just playing around on the internet. We have a clear mission and we must fulfill these assignments. If someone doesn’t like what we are doing, you shouldn’t be part of this training, it’s not for you. Ceban is the one who withdrew his candidacy from the elections so that Maia Sandu could win. If he had participated, considering the gap between the first and second candidates, you understand that he would have drawn a huge number of votes away from Sandu. And you understand what that would have meant: there would have been a different president. But that didn’t happen. So don’t defend him, and don’t forget which party you are working for and with whom.”

Later, during the undercover documentation of this network’s activities, the subject of Ion Ceban no longer appeared in discussions or assignments.

“Everything is coordinated and we are moving to another level. We are taking the next step”

At the end of January, Asea Albertovna made an announcement whose importance would only become clear later: the launch of a new project for the most active executors of the tasks assigned within the network.

“Everything is coordinated and we are moving to another level. We are taking the next step. The project will be based on the knowledge and skills you have acquired. Not everyone will be accepted, only those who have carried out the practical tasks honestly and with quality, those who have maintained contact with us, those who reacted quickly to assignments and requests, and those who helped other activists during our training. I will get in touch with you, Eva Sergeevna and Adam, in private messages. (…) The coordination process is very complex. Each of you goes through checks and documentation reports”, the coordinator announced.

The “InfoLider” Project: “For completing all the tasks in the project, you will receive apples and candies”

On February 5, the ZdG reporter who had infiltrated the group of trained activists received a call from the network’s phone number and was invited to join a new project called “InfoLider.”

A woman who introduced herself as Nelly explained to the undercover journalist that the goal of InfoLider was “to spread current political information from Moldova on the internet. We will publish posts on Facebook and TikTok every day.”

The contact person for the “InfoLider” project was the same Eva Sergeevna. Nelly instructed the ZdG journalist to write her a single word on Telegram – one that was specific to and frequently used within the Shor network: яблоко (apple).

On February 6, Eva Sergeevna followed up with a standard Telegram message in Russian containing details about the InfoLider project. It specified that the project’s goal was “the dissemination of current political news on social networks,” and listed the participant’s tasks as follows:

• Publishing original content on Facebook and TikTok at least three times a week on a designated topic;
• Creating original posts about personal hobbies, at least once a week, on Facebook and TikTok;
• Sharing original posts on an indicated political topic, at least once or twice a week, on Facebook and TikTok.

Registration for the “InfoLeader” project was also carried out via a Telegram chatbot, which again required personal data: full name and patronymic, phone number, and links to Facebook and TikTok accounts. “An Instagram account is a plus,” the message also noted. It further stated that “the work plan for two weeks will be sent by the curator in the chat after registering in the chatbot! For completing all the tasks in the project, you will receive apples and candies.” The last two words were replaced with emojis.

Humor, folk songs, and ChatGPT: “We will coordinate the payments”

On February 8, 2025, the first audio call took place in the InfoLider chat, with curator Asea Albertovna. She recommended that project participants use humor, folk songs, and artificial intelligence tools, particularly ChatGPT, to rephrase texts so that they would not be identical and would give the impression of personalized messages.

During the second call of the InfoLider project, curator Adam also joined. He assigned each participant the task of gathering at least 300 friends on Facebook and spoke about payments and money.

“We will coordinate the payments. Therefore, continue to complete the tasks we post, without fail, because payments will be made based on that. And if there are colleagues from Chișinău who could join the project, whom you can recommend, who are activists or sympathizers of the bloc, send me the person’s details in a private message. Write me a short note about them so I can contact and invite them to the project,” Adam told the participants.

The Russian center for culture and science and “The soul of Moldova”

Among the tasks assigned in the early stages of the project was one that required activists to write about the closure of the Russian Center for Culture and Science, following the announcement made by Moldova’s Ministry of Foreign Affairs after fragments of Russian drones landed on Moldovan territory, in the Gagauz region.

Activists were also instructed to report how many followers they had managed to attract. To this end, in the second half of February, generic messages were created in the form of coordinated campaigns that activists had to post daily, such as “Eu iubesc Moldova noastră” (I love our Moldova) and “Sufletul Moldovei” (The soul of Moldova). These came with specific hashtags such as #SufletulMoldovenesc, #душаМолдовы, and #faptebune. The hashtags were used both to expand the audience of these fake accounts and to allow curators to track their impact.

“An internet bot farm”

Curator Adam explained that the goal of the network was to operate like a bot farm, but a personalized one that would not reveal coordinated activity. According to him, such groups of “InfoLiders” were formed for Moldova’s southern, central, and northern regions. He also suggested that in order to secure further funding, the project had to show results at each stage, working month by month to prove it was worth the money.

“I believe many of you understand that our project, at some point, has to turn into an internet bot farm. ‘Bot farm’ sounds crude, but formally, it will be an entity – we will be given the task to promote a news story, and we will promote that news story. Not like bots, but as a personalized, conscious team, yet not in a way that would let anyone say we are a team, but rather as if several different people are spreading various news items. I want to congratulate you on the fact that the project has definitely been approved for March,” Adam told the activists.

He also said that the project could now attract not only activists of the “Victorie” Bloc, but also people outside the bloc, and he asked activists for recommendations: “The person doesn’t have to be from the bloc, or even an activist or sympathizer. We’ll sort out the payments. If there are many people from outside the bloc, we can make the payments in cryptocurrency.”

As for the activists themselves, Adam said they were to be paid through their accounts at the Russian bank Promsvyazbank, not from the “Victorie” Bloc, but directly from Moscow. He did not specify the amounts that were to be paid.

“It’s paid, let me tell you, it’s paid directly from Moscow”

“I also want to tell you that on February 23 I will send the first payment lists. Therefore, those of you who have PSB [Promsvyazbank] accounts but haven’t logged into your personal cabinets, please do so. And especially those who haven’t completed certain tasks, finish them, so that I can vouch for you, to say that in the first month we are still learning, but in March we will work much more responsibly and with a serious attitude. You must understand, we are no longer in training, we are at work, and work is paid. It’s paid, let me tell you, it’s paid directly from Moscow. It is not paid by the Bloc, it is paid from Moscow,” Adam stressed.

The curator added another important point, that the “InfoLeader” project was distancing itself from the “Victorie” Bloc.

“We must take seriously the possibility of spies”

“At first, we went with the narrative that we were training the communication activists of the ‘Victory’ Bloc. And that’s true. But at the same time, we are an independent team that was hired by the Bloc to train their communication activists. And in turn, from among those communication activists, we select people for our own media projects. So, it is a mutually beneficial collaboration, and at this point we have such an understanding between us. That is why it was allowed for us to bring in people not only from the Bloc, but also ‘from the street,’ to put it directly. But of course, these people will go through an additional filter. As always, we must seriously take into account that spies may exist, and there are limits we cannot cross. I believe that if a person is ready to work for the cause, then they deserve some additional incentives,” he said.

“None of you were told that during the training you would receive ‘candies.’ But for your initiative, those who take part in this call and carry out the tasks given will receive ‘candies.’ Those who only came for the ‘candies’ – they didn’t have the patience, they didn’t have the wisdom to understand the bigger picture. If we increase the number of people and the number of assignments, the number of ‘candies’ will also increase. That’s why, I tell you, it’s mutually beneficial. And later, we’ll see. Maybe the project will be closed if it doesn’t meet expectations, or on the contrary, maybe we’ll grow and meet up in Istanbul, in Serbia. I don’t know, we’ll see,” Adam further revealed about the “InfoLider” project.

Assignments for the “InfoLiders”: USAID, the soviet army, and Călin Georgescu

New assignments soon followed. One required participants to spread the message that after Donald Trump’s return to power, the “Sandu regime” must go. In this context, anti-EU and anti-USAID narratives, already circulating at the time among several pro-Russian politicians in Moldova, were heavily used.

Ahead of February 23, celebrated in Russia as “Defender of the Fatherland Day,” a tribute to the Soviet army, the “InfoLiders” were instructed to spread claims that the government in Chișinău wanted to “erase the memory” of those who fought in World War II.

On February 26, the curators resurfaced the news of Romanian President Klaus Iohannis’s resignation (which had actually taken place on February 10) and ordered the network to demand Maia Sandu’s resignation, arguing that she should “leave after Iohannis.”

The “InfoLider” project was also mobilized in support of Călin Georgescu, former Romanian presidential candidate, a sovereigntist leader under criminal investigation for establishing or supporting groups of a fascist, racist, xenophobic, or antisemitic nature. When Georgescu was detained by Romanian authorities, members of the network were instructed to post messages backing him. Posts carried hashtags such as #NuRomânia, #NuEU, #NuGlobaliștilor, #CrizăDemocrației. Every post had to be submitted to the InfoLider chatbot – for monitoring and counting purposes.

Curator Adam further revealed that one of the main purposes of creating the “InfoLider” network was to discredit those he called “globalists” and to promote Donald Trump’s ideas. Supporting his statement, participants received tasks praising Trump, Elon Musk, and J.D. Vance, using hashtags like #TrumpîmpotrivaGlobaliștilor, #MuskVaFaceOrdine, #ONouăEră.

“I don’t know if you follow the news, but right now there is a tough confrontation between the globalists and the representatives of ‘realpolitik.’ Trump, who has now returned to power, represents ‘realpolitik.’ Meanwhile, Sandu, Zelensky, and the others represent the Democrats, the globalists, the ones who carried out so-called democratization projects that were merely money-laundering schemes. We are living through very interesting times, times of restructuring. We are promoting the agenda of ‘realpolitik,’ while the globalists, subordinated to USAID, are opposing us. Therefore, we will try to fight back,” Adam instructed the group, echoing well-known Russian propaganda narratives.

One incident heavily exploited by the propaganda network was the “Katyusha” scandal: the Soviet military song performed by artists from Israel during the “Mărțișor” festival in Chișinău. Afterward, the National Philharmonic apologized, explaining that the piece had not been part of the official program. The “InfoLiders” were ordered to share the song on their accounts with the claim that the “Sandu regime” was imposing censorship.

Throughout March, activists in the “InfoLider” project were also engaged in a campaign to flood social media with posts against censorship. The promoted narrative was that censorship exists in Moldova and must be stopped.

ZdG journalist removed from Telegram group before being paid

After one month of activity in the “InfoLider” project, the ZdG journalist was asked to provide her personal identification data and her account number at the Russian bank PSB. To receive payment and with it, proof that the activities of so-called communication, which were in fact Russian propaganda on social networks, were remunerated, the ZdG reporter submitted the data she had used to register in 2024, when she infiltrated the Shor network under the fabricated identity Irina Zahar.

A few days later, on March 13, the ZdG journalist was removed from the Telegram group for the so-called “InfoLiders,” and curators Eva Sergeevna, Adam, and Asea Albertovna deleted all Telegram conversations with her. When contacted afterward for comment, none of them responded to calls or messages.

The digital troops continue their activity

The internet “army” continued operating at full capacity, even with one “soldier” less, constantly publishing messages aligned with Russian narratives aimed at discrediting the European Union and Moldova’s European integration path. All posts featured similar texts, identical hashtags, and images, evidence that they were coordinated from the same control point.

In the coming weeks, we will publish updated information about the Kremlin’s digital army, aimed with propagandistic artillery at Moldova.

When approached by ZdG, Marina Tauber, representative of the “Victory” Bloc, currently in Russia, promised to respond but did not follow up. Other representatives of the Bloc avoided answering and simultaneously propagated narratives similar to those promoted by the network.