# Russian influence network amplifies anti-government AI content on TikTok in Moldova

Published: 2026-04-03 · Severity: routine · Sectors: government-national
Canonical: https://vorant.io/reports/43ed6e3b-e9ca-5123-9817-040e96eac034/russian-influence-network-amplifies-anti-government-ai-content-on-tiktok-in

> Coordinated TikTok accounts spread AI-generated protest videos to delegitimize Moldova's government and mobilize anti-EU sentiment.

A network of at least 25 TikTok accounts coordinated the dissemination of AI-generated videos targeting Moldova's ruling Party of Action and Solidarity and President Maia Sandu. The accounts displayed coordinated inauthentic behavior, including identical profile pictures bearing Moldovan sovereignty imagery, and operated across three functional tiers: content seeders producing fabricated protest scenes, amplification accounts, and established influencers with significant followings. The campaign promoted narratives of governmental corruption, illegitimacy, and pro-Russian geopolitical alignment while discrediting EU integration. Activity began in late February 2026 and included calls for demonstrations scheduled for March 25, which did not materialize offline despite sustained online mobilization across 158,556 combined followers and over 26.3 million engagements. A parallel Russian-language campaign emerged on March 12 via newly created account @freemoldova0, suggesting either a separate production stream or coordinated expansion targeting Russian-speaking audiences. The network's use of AI-generated content, coordinated amplification strategies, and sustained post-protest activity indicate a longer-term influence operation aligned with documented pro-Russian and anti-EU narratives, assessed by Moldovan law enforcement as a potential destabilization effort.

## Mentioned in this report

- Threat actors: Russia-aligned covert influence operations
- Campaigns: Moldova anti-government protest mobilization campaign March 2026

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://dfrlab.org/2026/04/03/tiktok-accounts-use-ai-generated-videos-to-incite-anti-government-protests-in-moldova

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/43ed6e3b-e9ca-5123-9817-040e96eac034/russian-influence-network-amplifies-anti-government-ai-content-on-tiktok-in.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup