Information manipulation during elections in four post-Soviet states
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Foreign and domestic actors exploit information environments across Georgia, Moldova, Armenia, and Azerbaijan to influence electoral discourse via coordinated narratives and platform manipulation.
This analysis from the DFRLab examines foreign and domestic information manipulation campaigns during recent elections in Georgia, Moldova, Armenia, and Azerbaijan. The report documents how Russian and other foreign influence operations intertwine with domestic actors to shape electoral narratives, exploiting unresolved territorial conflicts, anti-Western messaging, and platform-specific vulnerabilities. The campaigns rely on narrative laundering—foreign entities seed narratives that domestic actors then localize and amplify, creating the appearance of domestic origin and complicating attribution.
The report maps platform-specific influence tactics across the four countries. In Georgia, Facebook served as the primary vector for coordinated inauthentic behavior and advertising; foreign actors exploited Meta's 2025 factchecking policy shift to undermine independent researchers. In Moldova, influence operations extended across TikTok, X, Facebook, and Telegram despite local authority efforts to restrict them. Armenia saw Telegram as the primary platform for targeting Prime Minister Nikol Pashinyan, alongside inauthentic news websites. Azerbaijan used X for state-aligned operations targeting international audiences, with domestic media amplifying those narratives abroad.
The research identifies three key dimensions: anti-Western narrative strategies used to delegitimize opposition and justify restrictions; exploitation of unresolved territorial conflicts (Russian-occupied regions in Georgia, Transnistria and Gagauzia in Moldova, Armenia's loss of Nagorno-Karabakh) as narrative leverage; and the ecosystems of digital platforms that enabled cross-national influence reach. A leaked Russian presidential office document reinforces the strategic intent, detailing long-term influence-building through diaspora engagement, cultural ties, and religious institutions across the region.
Mentioned in this report
Source reporting: https://dfrlab.org/2026/03/31/foreign-and-domestic-information-manipulation-report
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs