Okay, I had some difficulties posting the entire material using my...
Gavril Ducu 🇷🇴🇩🇪🇺🇲🇳🇱🇪🇺@🇺🇦@DucuGavril
12 views
Sep 06, 2025
~8 min read
Advertisement
1
Okay, I had some difficulties posting the entire material using my publish app so I decided to put it all together into a mega-thread, showing both sides of the operation, including Romania (at the receiving end) and not only Moldova.
This shows the entire eco-system at once.
This shows the entire eco-system at once.
2
1/ People ask: “Why doesn’t the EU counter Kremlin propaganda with the same weapons?”
Because EU institutions don’t run covert paid sock-puppet farms on their own citizens.
They lean on transparency laws, monitoring, fact-checking, and civic defenses.
Because EU institutions don’t run covert paid sock-puppet farms on their own citizens.
They lean on transparency laws, monitoring, fact-checking, and civic defenses.
3
2/ That gap matters.
Moscow runs industrialized online ops—paid networks, centralized tasking, algorithm gaming—across every language they can touch.
Most people only see the downstream waves, not the upstream machine.
Moscow runs industrialized online ops—paid networks, centralized tasking, algorithm gaming—across every language they can touch.
Most people only see the downstream waves, not the upstream machine.
4
3/ This mega-thread shows both ends:
• Upstream: an undercover look at a Kremlin-aligned network building “infolideri” for TikTok/Facebook in Moldova (ZdG).
• Downstream: Romanian OSINT mapping bot swarms on X and TikTok recommendation funneling to RoExit frames.
• Upstream: an undercover look at a Kremlin-aligned network building “infolideri” for TikTok/Facebook in Moldova (ZdG).
• Downstream: Romanian OSINT mapping bot swarms on X and TikTok recommendation funneling to RoExit frames.
5
4/ SOURCE 1 (Moldova, ZdG): “Armata digitală a Kremlinului… ‘Se plătește direct de la Moscova’”
zdg.md/investigatii/a…
5/ SOURCE 2 (Romania, Substack): “Boții pro-ruși ajută neofasciști pe X, iar algoritmul TikTok e manipulat în favoarea RoExit”
drepturisistrambe.substack.com/p/botii-pro-ru…
zdg.md/investigatii/a…
5/ SOURCE 2 (Romania, Substack): “Boții pro-ruși ajută neofasciști pe X, iar algoritmul TikTok e manipulat în favoarea RoExit”
drepturisistrambe.substack.com/p/botii-pro-ru…
6
SECTION A — ZdG (UNDERCOVER): EXPLAINER
6/ What ZdG did:
- infiltrated a closed training program for “communication activists” in the Șor-controlled “Victory Bloc,” coordinated from Moscow.
They captured calls, scripts, and tasking through secret Telegram groups.
6/ What ZdG did:
- infiltrated a closed training program for “communication activists” in the Șor-controlled “Victory Bloc,” coordinated from Moscow.
They captured calls, scripts, and tasking through secret Telegram groups.
7
7/ The play:
- train real people to run fake-but-human social accounts, seed lifestyle content, then pivot to synchronized political messaging.
Track everything; reward top performers; promote a paid tier.
- train real people to run fake-but-human social accounts, seed lifestyle content, then pivot to synchronized political messaging.
Track everything; reward top performers; promote a paid tier.
8
8/ Target audience: older voters.
Tactic: fear.
Quote: “We play on people’s fears.”
Messaging is “soft” at first so viewers think they reached the conclusion themselves.
Tactic: fear.
Quote: “We play on people’s fears.”
Messaging is “soft” at first so viewers think they reached the conclusion themselves.
9
9/ Platform pivot:
- by late December they move the center of gravity to TikTok.
Launch a New Year flashmob:
- same audio, same hashtags, same dance—hundreds post at once to force “organic” reach.
- by late December they move the center of gravity to TikTok.
Launch a New Year flashmob:
- same audio, same hashtags, same dance—hundreds post at once to force “organic” reach.
10
10/ Four flashmob talking points:
- “gas for one leu,” LGBT ban, “fair elections,” pension top-ups.
Prizes (iPhones) for most views.
No party names early—keep it vague.
- “gas for one leu,” LGBT ban, “fair elections,” pension top-ups.
Prizes (iPhones) for most views.
No party names early—keep it vague.
11
11/ Professionalization:
- February launch of “InfoLider.”
Daily/weekly quotas, a Telegram chatbot to register output, and explicit guidance to use ChatGPT to rephrase talking points for “personalization.”
- February launch of “InfoLider.”
Daily/weekly quotas, a Telegram chatbot to register output, and explicit guidance to use ChatGPT to rephrase talking points for “personalization.”
12
12/ Money line:
- organizers tell recruits that “work is paid… directly from Moscow.”
Payments via Promsvyazbank (PSB) for insiders; crypto for outsiders.
Lists prepared around 23 Feb.
- organizers tell recruits that “work is paid… directly from Moscow.”
Payments via Promsvyazbank (PSB) for insiders; crypto for outsiders.
Lists prepared around 23 Feb.
13
13/ When ZdG’s undercover identity submitted PSB details for payment, she was purged on 13 Mar and all Telegram chats were wiped.
The network continued posting at full tilt with the same hashtags/templates.
Next: SECTION B — ZdG: MEANS & METHODS (HOW IT WORKS)
The network continued posting at full tilt with the same hashtags/templates.
Next: SECTION B — ZdG: MEANS & METHODS (HOW IT WORKS)
14
14/ Recruit quietly, train centrally:
- closed Telegram groups, daytime video tips, nightly 20:00 audio calls.
Curators: Asea Albertovna (trainer), Adam (tasking/discipline/pay), Eva Sergheevna (coordination), Mihail Alexandrovici (format), Nelly (onboarding).
- closed Telegram groups, daytime video tips, nightly 20:00 audio calls.
Curators: Asea Albertovna (trainer), Adam (tasking/discipline/pay), Eva Sergheevna (coordination), Mihail Alexandrovici (format), Nelly (onboarding).
15
15/ OPSEC 101:
- VPNs, hide phone/name, pseudonyms.
- Build “work accounts,” but mix in personal posts to look human.
Goal by 1 Feb: three accounts per operator; grow 300+ FB friends.
- VPNs, hide phone/name, pseudonyms.
- Build “work accounts,” but mix in personal posts to look human.
Goal by 1 Feb: three accounts per operator; grow 300+ FB friends.
16
16/ Algorithm push via synchronization:
- 300–400 people post an identical TikTok with the same audio and hashtags at once.
Everyone follows/likes each other in bursts to juice the algorithm.
- 300–400 people post an identical TikTok with the same audio and hashtags at once.
Everyone follows/likes each other in bursts to juice the algorithm.
17
17/ Centralized scripts:
- exact texts, hashtag bundles, sample posts.
Daily tasks logged to a Telegram chatbot that tallies links and reach by participant.
- exact texts, hashtag bundles, sample posts.
Daily tasks logged to a Telegram chatbot that tallies links and reach by participant.
18
18/ Directed campaigns (Jan–Mar):
- rapid-reaction test for Anna Mihalachi; anti-Ceban push; “Sandu must go (after Iohannis)”;
- anti-EU/anti-USAID; WWII “memory” angles; “Katyusha” framed as “censorship”;
- praise for Trump/Musk/J.D. Vance; support for Călin Georgescu.
- rapid-reaction test for Anna Mihalachi; anti-Ceban push; “Sandu must go (after Iohannis)”;
- anti-EU/anti-USAID; WWII “memory” angles; “Katyusha” framed as “censorship”;
- praise for Trump/Musk/J.D. Vance; support for Călin Georgescu.
19
19/ Narrative laundering:
- pride/feel-good series (“Eu iubesc Moldova,” “Sufletul Moldovei”) broaden reach and trust; political cues slide in later.
- pride/feel-good series (“Eu iubesc Moldova,” “Sufletul Moldovei”) broaden reach and trust; political cues slide in later.
20
20/ Metrics → rewards → budget:
- public view targets (250k by 5 Jan; 1M by 12 Jan).
Prizes; “lists sent for approval.”
Monthly funding contingent on results.
- public view targets (250k by 5 Jan; 1M by 12 Jan).
Prizes; “lists sent for approval.”
Monthly funding contingent on results.
21
21/ Deniability & counter-intel:
- the handlers claim they’re an “independent team” hired by the Bloc; warn about “spies”; purge chats; eject suspected infiltrators.
- the handlers claim they’re an “independent team” hired by the Bloc; warn about “spies”; purge chats; eject suspected infiltrators.
22
22/ One-screen summary (Moldova):
- Train real people → build fake-looking-real accounts → seed lifestyle → inject politics softly → synchronized flashmobs → log and pay → purge leaks → repeat.
Next: SECTION C — ROMANIA (OSINT): EXPLAINER
- Train real people → build fake-looking-real accounts → seed lifestyle → inject politics softly → synchronized flashmobs → log and pay → purge leaks → repeat.
Next: SECTION C — ROMANIA (OSINT): EXPLAINER
23
23/ What the reporters did:
- scraped X at scale (Octoparse, ExportComments) around a neo-fascist, pro-Kremlin account (@Daily_Romania) and Călin Georgescu;
- used CheckFirst’s “Crossover” black box to log what TikTok recommends on divisive topics.
- scraped X at scale (Octoparse, ExportComments) around a neo-fascist, pro-Kremlin account (@Daily_Romania) and Călin Georgescu;
- used CheckFirst’s “Crossover” black box to log what TikTok recommends on divisive topics.
24
@daily_romania 24/ What they found on X:
- bot swarms and hollow follower graphs that inflate visibility for @Daily_Romania and Georgescu.
Think lots of thin accounts created in bursts, instant replies, repetitive emoji/image spam.
- bot swarms and hollow follower graphs that inflate visibility for @Daily_Romania and Georgescu.
Think lots of thin accounts created in bursts, instant replies, repetitive emoji/image spam.
25
@daily_romania 25/ What they found on TikTok:
- different searches (“RoExit,” “Imigrare,” “USAID,” “UE”) led to the same political accounts being suggested—especially Anton Pisaroglu—creating a cross-topic funnel toward the same lane.
- different searches (“RoExit,” “Imigrare,” “USAID,” “UE”) led to the same political accounts being suggested—especially Anton Pisaroglu—creating a cross-topic funnel toward the same lane.
26
@daily_romania 26/ Why it matters:
- X manufactures the illusion of consensus; TikTok steers via recommendations.
Together, they push anti-EU/USAID/Ukraine, homophobia, and election-delegitimizing frames into wider feeds.
- X manufactures the illusion of consensus; TikTok steers via recommendations.
Together, they push anti-EU/USAID/Ukraine, homophobia, and election-delegitimizing frames into wider feeds.
27
@daily_romania SECTION D — ROMANIA: MEANS & METHODS (WHAT THE DATA SHOWED)
27/ X dataset:
- 8,370 @Daily_Romania posts (Jan 1, 2024–Jun 29, 2025) scraped; 138,065 sampled comments; 45,901 interacting accounts mapped.
27/ X dataset:
- 8,370 @Daily_Romania posts (Jan 1, 2024–Jun 29, 2025) scraped; 138,065 sampled comments; 45,901 interacting accounts mapped.
28
@daily_romania 28/ Bot signal:
- 34,015 comments came from accounts that matched bot-like patterns (instant reaction windows, random name+digits, heavy repetition on single topics).
- 34,015 comments came from accounts that matched bot-like patterns (instant reaction windows, random name+digits, heavy repetition on single topics).
29
@daily_romania 29/ Follower anomalies (@Daily_Romania, Sep 3, 2025 total 119,861):
- in a 50k sample, 22,436 followers created ≥2023; 17,032 created in 2024; 1,667 created across just 10 days.
- in a 50k sample, 22,436 followers created ≥2023; 17,032 created in 2024; 1,667 created across just 10 days.
30
@daily_romania 30/ Hollow base:
- of the 50k sample, 6,552 followers have 0–1 followers; 10,000 have ≤5; 13,112 have ≤10.
At a glance it looks “popular,” but the network is thin.
- of the 50k sample, 6,552 followers have 0–1 followers; 10,000 have ≤5; 13,112 have ≤10.
At a glance it looks “popular,” but the network is thin.
31
@daily_romania 31/ Examples (as described):
• @KArusich → 185 comments in <5-minute windows
• @bnbn32494573 → 76 identical images in 48h
• @JoaquinMar67151 → “EU coup/tyranny” spam
• @Rodica17957578 → RU flag; anti-EU in Italian/Spanish
• @KArusich → 185 comments in <5-minute windows
• @bnbn32494573 → 76 identical images in 48h
• @JoaquinMar67151 → “EU coup/tyranny” spam
• @Rodica17957578 → RU flag; anti-EU in Italian/Spanish
32
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 32/ Georgescu follower sample (50k):
- 4,365 followers have 0 followers; 20,000 have <10; 942 created on a single day (Mar 9, 2025). Creation bursts are a big red flag.
- 4,365 followers have 0 followers; 20,000 have <10; 942 created on a single day (Mar 9, 2025). Creation bursts are a big red flag.
33
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 33/ Cross-platform seeding:
- authors note content on other platforms was used to drive views back to TikTok—where video carries further.
- authors note content on other platforms was used to drive views back to TikTok—where video carries further.
34
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 34/ TikTok black-box tests (Aug 13–22 and post-Aug 26):
- searches for RoExit/Imigrare/USAID/UE repeatedly surfaced the same cluster; Anton Pisaroglu often top suggestion.
- searches for RoExit/Imigrare/USAID/UE repeatedly surfaced the same cluster; Anton Pisaroglu often top suggestion.
35
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 35/ Lifestyle laundering:
- “MBA Jewelry” posts models with #aur, occasionally reposts AUR/Simion/Georgescu—piggybacking reach from non-political content.
- “MBA Jewelry” posts models with #aur, occasionally reposts AUR/Simion/Georgescu—piggybacking reach from non-political content.
36
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 36/ Enforcement gaps:
- authors note X’s pricey API for researchers and cite a Berlin-court ruling about access; local complaints to police exist, but the target account remains active as of September.
Next: SECTION E — PUTTING BOTH ENDS TOGETHER
- authors note X’s pricey API for researchers and cite a Berlin-court ruling about access; local complaints to police exist, but the target account remains active as of September.
Next: SECTION E — PUTTING BOTH ENDS TOGETHER
37
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 37/ Upstream (Moldova):
- paid, centrally tasked “infolideri” coordinated on Telegram; synchronized flashmobs; quotas; payments “direct from Moscow.”
Downstream (Romania):
- bot swarms on X; TikTok cross-topic recommendation funnels to the same political cluster.
- paid, centrally tasked “infolideri” coordinated on Telegram; synchronized flashmobs; quotas; payments “direct from Moscow.”
Downstream (Romania):
- bot swarms on X; TikTok cross-topic recommendation funnels to the same political cluster.
38
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 38/ Same mechanics, different surfaces:
- mass account creation days, thin follower graphs, synchronized posting windows, templated hashtags, and “soft” on-ramps (pride/lifestyle) that launder the narrative.
- mass account creation days, thin follower graphs, synchronized posting windows, templated hashtags, and “soft” on-ramps (pride/lifestyle) that launder the narrative.
39
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 39/ Why it works on normal people:
- repetition by “many” feels true; identity pride lowers defenses; fear and outrage beat policy talk; recommendation loops push different audiences into one lane.
- repetition by “many” feels true; identity pride lowers defenses; fear and outrage beat policy talk; recommendation loops push different audiences into one lane.
40
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 SECTION F — WHAT TO WATCH (PRACTICAL TELLS)
40/ Bursts of near-identical TikToks: same audio/dance/captions across many “newish” accounts within hours.
That’s manufactured “organic.”
40/ Bursts of near-identical TikToks: same audio/dance/captions across many “newish” accounts within hours.
That’s manufactured “organic.”
41
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 41/ Hashtag bundles that repeat across dozens of profiles in lockstep.
Alternation pattern: generic lifestyle → coordinated politics → back to lifestyle.
Alternation pattern: generic lifestyle → coordinated politics → back to lifestyle.
42
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 42/ On X: same-day follower creation spikes; lots of followers with 0–10 followers; instant replies; emoji/image spam; language-hopping accounts that cheer only one lane.
43
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 43/ On TikTok: different searches (RoExit/Imigrare/USAID/UE) yield the same accounts over the same time window.
That’s a cross-topic funnel.
That’s a cross-topic funnel.
44
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 SECTION G — WHAT TO DO (AWARENESS > APATHY)
44/ Document and report coordinated inauthentic behavior clusters.
Keep examples, timestamps, links.
In RO, complaints to CNA helped remove some extremist TikTok content earlier this year.
44/ Document and report coordinated inauthentic behavior clusters.
Keep examples, timestamps, links.
In RO, complaints to CNA helped remove some extremist TikTok content earlier this year.
45
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 45/ Use civic OSINT where safe: basic scraping or manual logging; look for creation bursts, thin graphs, and synchronized posting.
Share with trustworthy researchers/NGOs.
Share with trustworthy researchers/NGOs.
46
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 46/ Teach the pattern: train people to spot “friendly local content” that morphs into the same political slogans with the same hashtags.
Once you see it, you can’t unsee it.
Once you see it, you can’t unsee it.
47
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 47/ Remember: the EU’s tools are defensive (laws, transparency, monitoring).
They are not mirror images of Moscow’s covert paid networks.
That’s a feature of democratic constraints, not a bug.
They are not mirror images of Moscow’s covert paid networks.
That’s a feature of democratic constraints, not a bug.
48
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 48/ But defensive tools only work if people use them—by reporting CIB, demanding platform transparency, and building media-literacy habits in their communities.
49
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 49/ Read the sources:
Moldova (undercover, ZdG): zdg.md/investigatii/a…
Romania (OSINT, Substack): drepturisistrambe.substack.com/p/botii-pro-ru…
Moldova (undercover, ZdG): zdg.md/investigatii/a…
Romania (OSINT, Substack): drepturisistrambe.substack.com/p/botii-pro-ru…
50
@daily_romania @KArusich @bnbn32494573 @JoaquinMar67151 @Rodica17957578 50/ If your feed suddenly fills with identical clips, the same hashtags, and new accounts shouting the same lines, you’re not witnessing a grassroots moment.
You’re watching a playbook.
Share this so others can spot it.
You’re watching a playbook.
Share this so others can spot it.
