# Rybar-linked REST outlet targets Moldova via disinformation

Published: 2025-09-23 · Severity: routine · Sectors: government-national, media
Canonical: https://vorant.io/reports/a4412708-e5b9-5c8d-8b52-6c0e769efb12/rybar-linked-rest-outlet-targets-moldova-via-disinformation

> Russian state-linked Rybar operating REST media outlet spreading disinformation targeting Moldova's pro-EU leadership ahead of elections.

REST, a newly launched online media outlet targeting Moldovan audiences, has been attributed to Rybar, a sanctioned pro-Kremlin Russian military propaganda operation with over 1.3 million Telegram followers. Mikhail Zvinchuk, one of Rybar's creators, is under EU sanctions for coordinating mobilization efforts and spreading pro-war disinformation. REST was registered on June 20, 2025, using privacy services (Njalla/1337 Services LLC) and deployed across multiple platforms including TikTok, X, and Telegram to amplify anti-EU and anti-Sandu messaging ahead of Moldova's September 28 parliamentary elections.

Technical attribution relies on multiple forensic indicators: REST and Rybar share identical VK Cloud hosting infrastructure (IP 217.16.19.189 and 217.16.21.112 respectively), both use the same uncommon aaPanel control panel (evidenced by identical 404 error pages), and both employ identical non-standard FTP configurations (Pure-FTPd with 50-user limit and 15-minute timeout). EXIF metadata from REST images revealed file paths containing explicit "Rybar" directory references (C:\Rybar на С\REST\), with mixed Cyrillic-Latin homoglyphs indicating operators working in a Cyrillic environment. Timestamps on visual branding components are dated April 2025 (GMT+3/Moscow timezone), predating the June launch by two months.

REST's narratives frame Moldova's pro-EU leadership as engaged in Western manipulation, constitutional overreach, and media censorship. Amplification reached 3.11 million views primarily via TikTok (seeded through accounts like H.D. Hartmann with 76,200 followers), with additional reach via Pravda Network, pro-Kremlin Telegram clusters (Bulgaria Z, InfoDefense), and actors like former PM Vlad Filat. The operation demonstrates how sanctioned Russian actors regenerate media assets using layered anonymization to evade detection and sanctions while conducting sustained information warfare against NATO-aligned states.

## Mentioned in this report

- Threat actors: Mikhail Zvinchuk, Rybar
- Campaigns: Moldova pre-election information warfare, REST Media disinformation operation

2 detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://dfrlab.org/2025/09/23/sanctioned-russian-actor-linked-to-new-media-outlet-targeting-moldova

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a4412708-e5b9-5c8d-8b52-6c0e769efb12/rybar-linked-rest-outlet-targets-moldova-via-disinformation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup