Rybar-linked REST outlet targets Moldova via disinformation
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian state-linked Rybar operating REST media outlet spreading disinformation targeting Moldova's pro-EU leadership ahead of elections.
REST, a newly launched online media outlet targeting Moldovan audiences, has been attributed to Rybar, a sanctioned pro-Kremlin Russian military propaganda operation with over 1.3 million Telegram followers. Mikhail Zvinchuk, one of Rybar's creators, is under EU sanctions for coordinating mobilization efforts and spreading pro-war disinformation. REST was registered on June 20, 2025, using privacy services (Njalla/1337 Services LLC) and deployed across multiple platforms including TikTok, X, and Telegram to amplify anti-EU and anti-Sandu messaging ahead of Moldova's September 28 parliamentary elections.
Technical attribution relies on multiple forensic indicators: REST and Rybar share identical VK Cloud hosting infrastructure (IP 217.16.19.189 and 217.16.21.112 respectively), both use the same uncommon aaPanel control panel (evidenced by identical 404 error pages), and both employ identical non-standard FTP configurations (Pure-FTPd with 50-user limit and 15-minute timeout). EXIF metadata from REST images revealed file paths containing explicit "Rybar" directory references (C:\Rybar на С\REST\), with mixed Cyrillic-Latin homoglyphs indicating operators working in a Cyrillic environment. Timestamps on visual branding components are dated April 2025 (GMT+3/Moscow timezone), predating the June launch by two months.
REST's narratives frame Moldova's pro-EU leadership as engaged in Western manipulation, constitutional overreach, and media censorship. Amplification reached 3.11 million views primarily via TikTok (seeded through accounts like H.D. Hartmann with 76,200 followers), with additional reach via Pravda Network, pro-Kremlin Telegram clusters (Bulgaria Z, InfoDefense), and actors like former PM Vlad Filat. The operation demonstrates how sanctioned Russian actors regenerate media assets using layered anonymization to evade detection and sanctions while conducting sustained information warfare against NATO-aligned states.
Mentioned in this report
Detection guidance
2 detections for this report are in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://dfrlab.org/2025/09/23/sanctioned-russian-actor-linked-to-new-media-outlet-targeting-moldova
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs