Inside Russia’s Hybrid War in Moldova: How Moscow Built a Testing Ground to Subvert Europe

Moscow is no longer treating elections, public opinion, cyber networks and physical infrastructure as separate targets. They are being treated as parts of the same battlefield.

That makes Moldova less a peripheral political contest than a model for how Russia could attempt to undermine European security without launching a conventional attack.

A campaign built around institutions, not just elections

The scale of the operation began to become visible before Moldova’s September 2025 parliamentary election.

A Moscow-based network linked to fugitive Moldovan oligarch Ilan Shor and Kremlin official Sergei Kiriyenko used the Skolkovo Innovation Center and 240 automated Telegram chatbots to recruit more than 150,000 Moldovans. The network included about 35,000 activists and 1,200 local managers. More than $20 million was distributed to 38,000 activists during the four months before Moldova’s 2024 referendum on European Union integration, while overall campaign spending was estimated in the hundreds of millions of dollars.

This was not simply covert political advertising.

The network created a system for distributing money directly to people on the ground, turning political influence into an organised logistical operation. Telegram provided the recruitment infrastructure; financial networks supplied the cash; local managers distributed it.

The Kremlin-linked entity Evrazia added another layer. Hundreds of Moldovan Orthodox priests were taken to Moscow on pilgrimages, where they signed employment contracts with the organisation and received Promsvyazbank debit cards loaded with roughly $1,000 a month. In return, they were expected to promote anti-EU and pro-Russian political messages from the pulpit.

Religion therefore became part of the campaign's operational infrastructure.

The significance is not simply that clergy were allegedly paid to influence voters. It is that a traditionally trusted institution could be incorporated into a wider political network alongside digital platforms, financial intermediaries and Kremlin-linked organisations.

From political influence to organised violence

The military dimension was more direct.

During the summer of 2025, Russia’s military intelligence service, the GRU, established training camps in Serbia, Bosnia and outside Moscow for Moldovan recruits. Participants were reportedly paid up to $400 to learn how to set fires, confront police cordons, use assault weapons, manufacture improvised explosives and operate weaponised drones.

That changed the nature of the threat facing Chisinau.

A campaign designed to influence voters can remain below the threshold of physical confrontation. Training recruits for violent action creates the capacity to turn political tensions into street disorder when circumstances are favourable.

Moldovan authorities confronted that prospect around the September 28 parliamentary election. Russian operatives sought to provoke violence, while state-backed hackers targeted the Central Election Commission and thousands of local routers.

The operation did not succeed.

Moldovan law enforcement, cyber specialists and Western intelligence services worked together to identify the networks and disrupt them through raids, arrests and defensive measures. President Maia Sandu’s Action and Solidarity party ultimately secured more than 50 per cent of the vote, supported strongly by the diaspora.

For Moscow, the failure matters because the campaign had been designed on a scale large enough to do more than distort an election.

It was an attempt to create conditions in which political manipulation, cyber disruption and physical unrest could reinforce one another.

Why Moldova matters to Moscow

Moldova offers an unusually exposed strategic position.

The country of roughly three million people sits between Ukraine and NATO member Romania. To its east lies Transnistria, the pro-Russian separatist territory where roughly 1,500 Russian troops are stationed alongside large ammunition depots at Cobasna.

The geography has long given Moldova significance in Russian military planning. During the early stages of the 2022 invasion, Russian plans envisioned a land corridor across southern Ukraine to Transnistria. That route would have fundamentally altered the strategic balance around Odesa and given Moscow direct military access to Moldova.

The failure to establish such a corridor has not removed the strategic objective. It has changed the means available to pursue it.

Instead of relying on territorial expansion, Moscow can work through Moldova’s political institutions, financial systems and social divisions. The country becomes a place where Russia can test whether a sovereign state can be weakened from within without first being occupied from outside.

That is a more complicated form of conflict - and potentially a more transferable one.

The battlefield moves into the power grid

The escalation became harder to describe as conventional political interference in March 2026.

Russian strikes on Ukrainian energy and water infrastructure caused severe disruption in Moldova, including regional water contamination and electricity shortages. Up to 70 per cent of Moldova’s electricity capacity was cut.

The distinction between an attack on Ukraine and pressure on Moldova consequently became less clear.

Moldova’s dependence on infrastructure connected to its larger neighbour created a vulnerability that could be exploited without a Russian missile striking Moldovan territory directly. Damage inflicted across the border could produce economic and social consequences inside Moldova, adding another pressure point to the political and security campaign.

This is where the different elements of the operation begin to form a coherent picture.

Money can influence voters. Digital networks can mobilise them. Religious institutions can legitimise narratives. Paramilitary training can create the threat of disorder. Cyberattacks can disrupt state institutions. Damage to regional infrastructure can amplify public insecurity.

None of these tools is entirely new.

Their integration is.

A European security problem disguised as a Moldovan one

Moldova’s experience also exposes a difficult question for European governments: where does hybrid warfare actually begin?

A payment to a local activist may look like corruption. A Telegram chatbot may look like ordinary political campaigning. A religious pilgrimage may appear unrelated to national security. A cyberattack on an electoral network belongs to another category altogether. A power shortage caused by damage to infrastructure in a neighbouring country can be treated as a consequence of war rather than an attack on Moldova.

The Russian campaign described in the investigation connects those categories.

That makes conventional security responses less effective when used in isolation. Police can arrest operatives, but cannot dismantle a foreign financial network alone. Cyber specialists can protect election systems, but cannot prevent money from reaching voters. Intelligence services can identify paramilitary recruitment, but political institutions still have to withstand the resulting pressure.

Moldova’s response worked because those functions were brought together.

The country’s security services and Western partners were able to disrupt the electoral operation before it translated into the political outcome Moscow sought. That offers a precedent for other European states facing similar campaigns: the defence of elections is no longer confined to ballot boxes and computer networks. It extends into financial surveillance, intelligence sharing, border security, policing and the protection of trusted institutions.

The irony is that the Kremlin’s failure may make Moldova more valuable as a testing ground.

Russia has not demonstrated that it can easily capture a European-leaning government through covert financing or engineered unrest. It has demonstrated something more consequential: how many parts of a modern state can be targeted simultaneously, and how difficult it can be to separate political interference from security threats once the campaign is under way.

For the European Union, Moldova’s vulnerability is therefore not simply a question of whether the country eventually joins the bloc. The more immediate question is whether European integration itself can provide enough institutional protection before the grey zone between foreign influence and open conflict becomes permanent.