Analysis of coordinated inauthentic behavior in Moldova: 23 days before the elections

August 30 – September 4

The report, based on the analysis of 3,391 videos, 36,338 comments, and 100 identified inauthentic accounts, reveals an alarming reality. From fake accounts generated by artificial intelligence that mimic the character of the “flower lady” to coordinated international networks that create the illusion of organic posting behavior.

Authors: Voinea Mădălina, Sorin Ioniță

Overview of monitored infrastructure

Data monitored:

• 469 hashtags monitored in total
• 87 identified as having political content
• 3,392 videos analyzed in 30 days
• 36,338 comments examined
• 100 inauthentic CIB accounts

Comment analysis:

• 10,196 duplicate comments identified out of a total of 36,338
• Most frequent: emoji spam (860 repetitions)
• Political content: “jos pas” (down with PAS) – 213 repetitions
• Coordinated engagement in 529 videos

The transparency of the origin of the content we see in our feeds is no longer just a technical issue, but a matter of national security. The role of social media platforms in informing the public has become a reality that not only shapes opinions and perceptions about those around us, but can also radically determine the fate of a country.

The case of Romania has shown us the domino effect of digital manipulation during election periods. We are seeing a dramatic increase in “late deciding voters” all over the world – voters who make their decision at the last minute, influenced by what they see on their screens in the final weeks. The battle for people’s attention and the struggle to occupy as much of their screen time as possible is no longer just a political marketing strategy; we are seeing a race for the attention of voters who spend a lot of time online.

Content as a Hybrid Warfare Weapon

In this tense geopolitical context, content circulating a month before the elections becomes an extremely effective tool for persuading and manipulating public perception. Romania’s experience, with the meteoric rise of a supposedly independent far-right candidate through initially inauthentic accounts, i.e., through a digitally orchestrated campaign, shows us that we cannot underestimate the power of these instruments of influence, even if we should not minimize the importance of the socio-economic factors that create fertile ground for these messages.

We decided to analyze the last 30 days of trending content in the Republic of Moldova to understand what the information war looks like in real time. Trending in the definition of this analysis means content in the top 100 on monitored hashtags, generally with over 5,000 views. CIB (Coordinated Inauthentic Behavior) refers to inauthentic content, where coordination can be observed in the topics followed, recycled videos, and distribution patterns, without necessarily being identical in terms of technical details.

Evolution of the threat: From troll farms to AI

What we are seeing today is fundamentally different from classic disinformation campaigns, and we need to change the way we identify these new TTPs (Techniques, Tactics, Procedures). These traditional campaigns are becoming increasingly rare, replaced by something much easier. AI and integrations with various LLM’s have revolutionized the ability to create mass campaigns on social media, automatically diversifying users, profile pictures, and generated content. Technologies such as ChatGPT have dramatically accelerated the pollution of feeds with artificial content that mimics human behavior.

1. Narrative Analysis

Mapping the manipulation ecosystem

CIB accounts have been analyzed over the last 30 days by their relationship to the main hashtags related to #молдова and #Moldova, basically who is trying to occupy space on these mammoth hashtags, used for each country (#Romania, #Poland). As you can imagine, we are talking about a lot of entertainment, social, events, and video content from real accounts that were not taken into account in this analysis. To discover the 100 inauthentic accounts, we analyzed 87 political hashtags associated with #Moldova and #молдова, along with different spelling variations and added emojis.

Of the total 469 hashtags monitored, 87 were identified as having political content. The strongest political correlations were identified in the content of #Moldova(ro/ru) and “новости/news” with 16.2%, followed by “гагаузия/gagauzia” with 10.3%, “протест/protest” with 7.0%, “выборы/elections” with 6.1%, and “политика/politics” with 6.0%.

The analysis revealed a massive focus on regional political terms that directly reflect geopolitical pressures: пмр/transnistria, приднестровье/transnistria, россия/russia, украина/ukraine. A relevant trend is the use of small accounts, with a few hundred followers, which have 1-2 videos with a staggering number of views – 30,000, 100,000 – completely disproportionate to the size of the account and the rest of the interactions. This TikTok viralization mechanism remains unclear to us from a technical point of view.

The Invasion of AI Content: The New Frontier of Disinformation

These artificial accounts are exponentially easier to create than traditional troll farms, requiring minimal investment for huge results. AI can generate complete profiles, realistic photos, credible biographies, and varied content in minutes that would have required weeks of manual work. The danger for social media is that these accounts are becoming increasingly difficult to detect, mimicking human behavior and constantly evolving to avoid automated detection systems. In the context of the Moldovan elections, this technology transforms disinformation from a tactic into a weapon with the potential to destabilize the flow of information, especially as we approachem de ziua votului.

Source: TikTok

The “Lover Boy” tactic, AI Lover Woman variant:

A technique identified in Moldova’s CIB ecosystem is a classic psychological strategy for fake profiles/avatars that exploit visual appeal to increase interest in political messages. These accounts make heavy use of generic (stock) photos or images stolen/recycled from real people, accounts purchased from authentic users, or other digital identity hijacking tactics. The result is an army of accounts with pictures of stereotypically beautiful (according to conventional standards) and attractive women promoting CIB behavior through coordinated political propaganda.

This tactic is not random; it exploits fundamental cognitive biases. In the Moldovan electoral context, this manipulation becomes a weapon of information warfare: propagandists know that an anti-EU or pro-Russian message will be received more favorably if it comes from a “beautiful young Moldovan woman” than from an anonymous or male account.

Amplification Infrastructure

We identified an infrastructure with various types of accounts, each with specific roles in the manipulation ecosystem. Fan accounts (accounts that claim to be real followers and fans of certain topics, the most popular real accounts being those of celebrity fans) exclusively post political propaganda, while other accounts have the sole role of leaving copy-paste or similar comments. This is the pattern discussed about the same empty, probably fake accounts distributed across multiple profiles. Basically, there is a division of digital labor: some accounts serve exclusively as “posters” (content creators), others deal only with comments, views, and artificial engagement, and others function only for following and amplification. Many of these accounts overlap and serve multiple functions simultaneously.

The “Auntie with Flowers” Tactics: Marketing Personas Applied to Information Warfare

Another relevant technique is what we call “your auntie with flowers CIB,” accounts that create personas avatars, just like in commercial marketing where you target your audience by building fictional personas representative of your target audience. Imagine you are selling this product to your aunt; that is exactly how these CIBs work. Their purpose in being diverse is obvious: to make it as easy as possible to empathize with them. Although their behavior is exclusively political propaganda, it adds a touch of authenticity when you post profile pictures with flowers that every Eastern European aunt or mother has had at some point.

Similarly, we have identified accounts that reference celebrity names. It may seem comical that someone would call themselves “Monika Bellucci,” but this technique can create a subconscious familiarity with the terms. In the era of 15-second scrolling and 3-second attention spans, the impact of these subliminal associations is still unclear to us from a sociological perspective.

Not all avatars are intelligent; on the contrary, many rely on volume and feed invasion rather than sophistication. In the creation of fake profiles, we observe a trend in accounts with AI profile pictures. Let’s start with some obvious accounts: content made with AI, pictures generated with programs similar to DALL-E, probably. For example, “Mrs. Frunză” focuses mainly on the alleged censorship of citizens in the Republic of Moldova and conspiracy-type headlines such as “Is the truth becoming dangerous?”

Source TikTok

We continue with the Finland-Romania pair, @iasa554 (Finland) and @iasa813 (Moldova), users who share the same concerns as “Mrs. Frunză,” only from different countries. We are certainly not talking about twins, but about AI-generated accounts, similar to “Mrs. MariFitness” from Switzerland, who exclusively creates anti-Maia Sandu and anti-PAS content.

Source TikTok

(2) Analiza tehnică 

Data source: Expert Forum,Top 20 accounts analyzed

Data source: Expert Forum

Sursa date: Expert Forum

Comment analysis – Comments analyzed from 3,392 videos = 36,338 comments from the last 30 days

Data source: Expert Forum

The visual representation of words in duplicate comments shows a concentration on the terms “pas,” “jos,” “maia,” “sandu,” and “жос” (down). These terms appear frequently in the set of 10,196 duplicate comments identified from the total of 36,338 comments analyzed.

The top copy-paste chart indicates that simple emojis (🥰🥰🥰, 👍👍👍, 😂😂😂) represent the most frequent types of duplicate comments, with 860, 809, and 776 repetitions, respectively. The comment “down with” appears 213 times in the dataset.

The distribution shows that positive emojis (🥰🥰🥰) have the highest repetition frequency (860 repetitions from 340 users on 529 videos), while comments with explicit political content (“down with”) have a lower frequency but are distributed across a significant number of videos (213 repetitions).

Data source: Expert Forum

“🥰🥰🥰…” – 860 repeats from 340 users on 529 videos

“👍👍👍…” – 809 repeats from 392 users on 484 videos

“😂😂😂…” – 776 repeats from 449 users on 438 videos

“🤣🤣🤣…” – 341 repeats from 179 users on 224 videos

“😳😳😳…” – 335 repeats from 166 users on 240 videos

A campaign driven by fear and resentment

Analysis based on video descriptions, audio-video transcription of 400 videos, and hashtags used in 3,392 videos from the last 30 days.

Content Anatomy: From Anti-Sandu to the Meta-Narrative of Fear

Analysis of content categories reveals a three-tiered strategy: Topic: National politicians focuses on demonizing Maia Sandu, promoting politicians like Victoria Furtună, Plahotniuc. Topic: Local politicians exploits ethnic tensions with Gagauzia (mostly about the conviction of Evghenia Guțul), and Topic:News promotes alarmist news about external threats, election interference, the danger of the EU, and NATO’s forced confrontation with Russia. Topic:Political Parties is mainly anti PAS party content. This distribution combines personal attacks with the exploitation of regional tensions and the creation of widespread panic.

Data source: FACT Platform

This analysis is based on a sample of 400 transcribed videos and the analysis of all descriptions and hashtags.

What are the next steps?

Similar to our monitoring in Romania, attention must be focused urgently on accounts with coordinated inauthentic behavior. The reality is that most of these accounts are impossible to defend as authentic, have AI-generated photos, zero personal content, and produce exclusively political propaganda, conspiracies, and disinformation. The paradox we find ourselves in is that platforms invoke the right to free speech to protect bots that attack the democratic system at a crucial moment for a country’s future. However, the paradigm must change radically. The official and real accounts of political actors must be protected, but urgent intervention must target the artificial amplification infrastructure, these networks of inauthentic accounts and viralization “soldiers” who manipulate algorithms. Only by exposing and neutralizing these systems can we preserve platforms as authentic reflections of society (if we are not too far from this ideal world), rather than as instruments of hybrid warfare against democracy.

TikTok accounts monitored in this analysis