Russian-Backed Election Destabilization in Moldova – Intelligence Brief

Parliamentary elections in Moldova are expected to be accompanied by a very high level of violence orchestrated by Russian intelligence, using mercenaries trained in Serbia. In light of this, we advise U.S. citizens and nationals of NATO member states to leave Chișinău and avoid large gatherings. The likelihood of terrorist attacks posing grave public danger is high. We are convinced the Kremlin does not expect pro-Russian forces to win and has opted instead for a strategy to derail the vote through violence, with the aim of having the results declared invalid.

Serbian authorities recently arrested two individuals on suspicion of orchestrating paramilitary-style training for Moldovan and Romanian nationals. The training, conducted in western Serbia between July and September 2025, was allegedly intended to prepare participants to violently resist Moldovan police during mass riots on Moldova’s election day. Moldovan police simultaneously detained 74 people in Moldova as part of a Russia-backed plot to incite unrest, seizing passports, cash, weapons, and other materials

. Investigators say the plot was “coordinated from the Russian Federation, through criminal elements”. The evidence points to a cross-border influence operation involving Russian operatives using Serbia as a training base to destabilize Moldova’s September 28 parliamentary elections.

Serbian police identified the arrested organizers by initials L.P. (37) and S.S. (47), now confirmed as Lazar Popović and Savo. Notably, Lazar Popović is a Serbian national who previously served as an advisor to Nenad Popović, a Serbian minister known for pro-Kremlin ties. The second suspect, Savo Stevanović of Loznica, was once a member of Nenad Popović’s party and later joined another nationalist political faction. These affiliations suggest the suspects moved within Serbia’s pro-Russian networks, giving them access to resources and cover.

According to open-source reporting, the training camp in Serbia was staffed by instructors from Russia (and Belarus) at an ethno-tourism complex called Sunčana Reka near Loznica. Moldovan prosecutors released video evidence titled “Military camps in Serbia organized by Russian secret services,” showing internal chat messages, money transfers, uniforms, weapons, and even the involvement of Russian agents. The Russian instructors taught recruits how to break police cordons, resist security forces, and use weapons (e.g. rubber batons, handcuffs, firearms. Some trainees reportedly entered Serbia under the guise of Orthodox pilgrimages, only to be recruited for training in exchange for about €400 per trip. This organized effort implies a direct link to Russian mil intelligence or paramilitary proxies coordinating the operation. In fact, Moldovan security officials explicitly stated that Moldovans were “being trained in Serbia on protest tactics by Russian intelligence operatives”, indicating likely involvement of Russia’s security services (e.g. GRU). One of the Serbian suspects is even accused of funneling roughly €10,000 to the Russian instructors via his companies and payment cards.

Russia’s Influence Operations in Moldova Ahead of the Election

The foiled training camp is part of broader Russian influence operations targeting Moldova in the lead-up to the September 28 elections. Moldovan and Western officials have warned that the Kremlin is pouring considerable resources into undermining Moldova’s pro-Western government. President Maia Sandu cautioned that “the Kremlin is pouring hundreds of millions of euros to buy hundreds of thousands of votes” in Moldova. Tactics attributed to Russia include mass disinformation campaigns, the buying of votes and loyalty, and the orchestration of street protests or riots. Moldovan police raids on September 22 uncovered evidence of a coordinated plot involving paid provocateurs: “Hundreds of individuals are paid to provoke disorder, violence and spread fear”, Sandu noted. Officials reported that between June and September, groups of Moldovan youths (ages 19–45) repeatedly traveled to Serbia for training in destabilization tactics. This pattern echoes earlier incidents – before a 2024 Moldovan vote, over 100 young people were reportedly trained in Russia, Serbia and even Bosnia-Herzegovina with similar aims of sowing chaos. In those cases, authorities identified multiple foreign instructors, highlighting a multi-country network of Russian proxy activities.

Beyond financing and training, Russian influence in Moldova has manifested through political proxies and propaganda. Moscow-linked oligarch Ilan Shor (sanctioned by the U.S. and EU as an alleged Russian agent) openly offered Moldovans the equivalent of $3,000 per month to join anti-government protests ahead of the election. Online networks have flooded Moldovan social media with false narratives attacking the pro-EU government. Even Moldova’s energy supply has been weaponized in the recent past, as Russia cut gas deliveries or hiked prices to stoke public dissatisfaction (context from prior European gas disputes). All these efforts serve to erode public trust in the electoral process and boost pro-Russian factions.

Russia’s strategic objective in these operations is to undermine Moldova’s Western trajectory and maintain it in Moscow’s geopolitical orbit. The violent unrest plot was reportedly designed to be activated in the event of an “unfavorable” election result for pro-Russian forces. By training agitators to confront police and incite chaos, Moscow’s agents sought to disrupt or delegitimize the voting and its outcome if the pro-European Party of Action and Solidarity (PAS) won again. Widespread riots on election day could have forced emergency measures or even an annulment of the vote, creating an opening for pro-Kremlin groups to demand power or a rerun under more chaotic conditions. A senior Moldovan police official noted the plan involved breaking through police lines and causing violence as part of a Kremlin-“coordinated” effort.

Strategically, fomenting instability in Moldova serves multiple Russian interests:

• Derailing EU/NATO Integration: Chaos would cast doubt on Moldova’s governance and make EU leaders hesitant about enlargement. Sandu warned that under a pro-Russian leadership, Moldova could become “a launchpad for hybrid attacks on the European Union”, precisely the kind of buffer state Russia prefers on NATO’s borders.
• Maintaining a Sphere of Influence: Moldova is a former Soviet republic where Moscow seeks to retain influence. Destabilization tactics are meant to keep Moldova within Russia’s sphere by preventing a decisive pro-Western shift. As Sandu put it, the Kremlin’s campaign aims to “see this country going away from the European path or to see the European Union fail”.
• Delegitimizing Democratic Processes: By sparking violence and contesting election legitimacy, Russia undermines the credibility of democratic institutions. This could weaken the Moldovan government’s mandate and bolster narratives that Western-aligned leaders bring turmoil.
• Distracting Western Support: Creating a crisis in Moldova could divert Western attention and resources, at a time when Europe is heavily focused on supporting Ukraine. A destabilized Moldova is a pressure point Russia can exploit to strain EU unity and Eastern European security.

In summary, these tactics are a form of hybrid warfare, combining covert action, political influence, and propaganda to prevent Moldova from firmly aligning with Euro-Atlantic institutions.

Serbia’s Role as a Training Ground

The use of Serbian territory as the training site raises questions about Serbia’s role – whether intentional or inadvertent – in this operation. Serbia has traditionally tried to balance between Russia and the West, and it has not joined EU sanctions against Moscow. This posture, coupled with historical and political ties to Russia, made Serbia a convenient choice for hosting a clandestine camp. Pro-Russian elements operate relatively freely in Serbia, sometimes under the radar of authorities. In this case, Serbian security services did eventually intervene, with the Ministry of Interior and Security Information Agency (BIA) conducting the arrests in coordination with Moldovan intelligence. Serbian officials have since pledged to cooperate via international legal assistance with Moldova’s investigation.

However, the fact that one suspect (Lazar Popović) was a government advisor and allegedly financed the camp suggests collusion by individuals within Serbia’s power structure. Opposition figures in Serbia have voiced concern that the state may have turned a blind eye or even tacitly approved these activities. Marinika Tepić, Vice-President of Serbia’s Freedom and Justice Party, asked publicly whether Serbian authorities were involved, given reports that “the training was organized and financed by Lazar Popović… an advisor to Minister Nenad Popović.” She warned of an “international scandal and embarrassment for Serbia for having pro-Russian paramilitary camps” on its soil aimed at overthrowing other countries’ governments. This implies that at least some level of Serbian officialdom was aware of or complicit in the operation, even if not the Serbian state as a whole.

It is also possible that Serbia was used inadvertently – i.e. Russian operatives and local facilitators conducted the camp under the cover of a private “tourist” retreat, without formal state sanction. The training was held at a private rural complex (marketed as an “ethno-village” resort), perhaps to avoid drawing attention. Instructors rotated in and out of Serbia periodically (reportedly traveling to Montenegro every 30 days to renew visas), indicating an effort to stay below the radar. Still, the large scale of the training (150+ foreigners over multiple sessions) and the political connections of the organizers suggest Serbia’s security apparatus may have overlooked the signs, either willfully or due to Russian influence. It is worth noting that Serbia has been used before as a haven for Russian-affiliated groups – for example, Russian ultra-nationalist biker club “Night Wolves” (FSB-affiliated) and other paramilitary-style organizations have established a presence in Serbia in past years (often under the guise of cultural or humanitarian activities). This environment arguably enabled the Moldova plot until international exposure forced Belgrade to act. Going forward, Serbian authorities will likely face increased scrutiny to ensure its territory is not exploited for such proxy operations again.

Involved Moldovan and Romanian Actors

Multiple Moldovan political and paramilitary actors have been implicated or affected by this plot and Russia’s broader interference campaign:

• Ilan Shor and His Network: Ilan Shor is a fugitive Moldovan oligarch and leader of the now-banned Shor Party, notorious for financing anti-government protests. The U.S. and EU have sanctioned Shor as a Russian agent for funneling Kremlin money into Moldova’s politics. From exile, Shor brazenly offered Moldovans cash payments to protest against the government, effectively trying to buy unrest. His networks have likely recruited some of the foot soldiers for demonstrations and could overlap with those detained in the recent raids.
• Igor Dodon and the Patriotic Bloc: Igor Dodon, former Moldovan president, co-leads the Patriotic Electoral Bloc – a coalition of pro-Russian parties (Socialists, Communists, and others). Dodon’s bloc is the main opposition challenging the pro-EU government. Some of those arrested in the September 22 raids were members of Dodon’s camp, according to Dodon himself. He complained that the “criminal PAS regime” (the ruling party) targeted his supporters to “intimidate us… and silence us”. While Dodon denies wrongdoing, the security services’ statement did not name parties, and the evidence suggests elements within the Patriotic Bloc were involved in the planned unrest. The Patriotic Bloc’s ranks also include figures like Irina Vlah (leader of the “Heart of Moldova” party and ex-Gagauzia governor) who was banned from entering Poland, Canada, and Lithuania for “assisting the Russian Federation in interfering” with Moldova’s elections. Such measures underscore that key members of this alliance are suspected of coordinating with Moscow’s agenda.
• Gagauzia and Other Local Proxies: Moldova’s Gagauzia region, an autonomous area with a largely pro-Russian populace, has been a hotspot for Kremlin influence. Recent investigations revealed illegal funding of Gagauz politicians (like Vlah’s party) tied to Russian sources. Some of the arrested Moldovan plotters may hail from Gagauzia or other Russian-leaning areas, where recruitment for such operations is easier. Organized crime groups also play a role as “criminal elements” facilitating Russian plans – for instance, smugglers or mafia figures can help move money and people under the radar.
• Romanian Far-Right Elements: The inclusion of Romanian nationals among the trainees hints at involvement of fringe actors from Romania sympathetic to Russia or simply mercenary. One high-profile example of Russian meddling in Romania’s politics was Călin Georgescu, a far-right, anti-NATO politician. In 2024, Georgescu’s surprise frontrunner performance in Romania’s presidential race was nullified by Romania’s Constitutional Court due to evidence of Russian interference in his favor. He was subsequently barred from the re-run election. Georgescu’s case (and the violent protests by his supporters after the annulment) shows Russia’s playbook extends to destabilizing EU/NATO countries via sympathetic extremist figures. While it’s unclear if any Romanian trainees in Serbia were directly tied to organized groups, this context illustrates the regional scope of Russia’s proxy network. Romania’s far-right and ultranationalist circles have small but notable pro-Moscow currents that Russian operatives could exploit.

In summary, the Moldovan individuals detained appear to be largely from pro-Russian political circles or financially motivated recruits, orchestrated by Kremlin-linked agents. Their Romanian counterparts in the training were likely a mix of ideologically aligned extremists and opportunists. All were to serve as on-the-ground provocateurs to challenge the Moldovan police and state on election day.

Implications for Moldova’s Stability and Western Interests

The uncovered plot has significant implications for Moldova’s internal stability and the interests of the EU and NATO in the region. First, the swift action by Moldovan and Serbian authorities has averted an immediate security crisis on election day. By detaining dozens of operatives and their trainers, Moldova likely prevented violent riots that could have spiraled into bloodshed or a political meltdown. This demonstrates a growing resilience in Moldovan state institutions – as noted by an EU official, Chişinău has “proven to be resilient and capable of fighting back” such forces. Nonetheless, the fact that this conspiracy advanced so far underscores a persistent vulnerability. Moldova will need continued vigilance and possibly security assistance (such as the EU’s new hybrid rapid-response team deployed to aid Moldova) to counter ongoing subversion efforts.

For Moldova’s democracy, the incident is a double-edged sword. On one hand, the public exposure of Russian interference could galvanize pro-European voters and justify firm action against subversive elements. On the other hand, opposition figures like Dodon claim the raids are political persecution, which may deepen polarization. If not managed carefully, the narrative of “state repression” could be used by Kremlin propaganda to fuel further discontent. In the longer term, Moldova faces the challenge of reforming its security and judicial sectors to root out any infiltrators or corrupt actors that enabled foreign meddling.

From a European security perspective, this case is a stark reminder of Russia’s willingness to destabilize a sovereign European state to block EU/NATO expansion. Moldova’s election has been described as “the most consequential in the country’s history” precisely because it may determine whether Moldova firmly aligns with Europe. A successful Russian-orchestrated disruption would have set a dangerous precedent, essentially allowing Moscow to veto the democratic choices of a European nation through hybrid warfare. The EU and NATO therefore have a vested interest in Moldova’s stability and security. Western agencies will likely increase intelligence-sharing and capacity-building with Moldova to prevent future plots. There are also diplomatic implications for Serbia’s EU candidacy – Serbia may face pressure to crack down on pro-Russian paramilitary activities and demonstrate it won’t be a staging ground for Kremlin operations against neighbors. The European Commission has already inquired “how it was possible” for dozens of Moldovans to be trained in Serbia without detection, signaling that Belgrade’s actions will be under scrutiny.

Finally, this episode highlights the broader NATO concern over instability on its eastern flank. Although Moldova is neutral and not seeking NATO membership, unrest there could spill over into Romania (a NATO member) or create a new conflict zone adjacent to Ukraine. Russia’s covert efforts in Moldova, if they succeeded, might have led to a security vacuum or even a plea for “peacekeepers”, which Russia could exploit to justify a more overt presence (for instance, citing protection of the Russophone population or securing Transnistria). Such outcomes would directly clash with Western interests in containing Russian aggression.

In conclusion, the thwarting of the Russian-tied plot in Serbia and Moldova is a positive development for regional stability. It exposes the extent of Moscow’s hybrid tactics and allows Moldova and its partners to harden defenses against them. However, the strategic contest for Moldova’s future is far from over. Russia’s influence networks – from paid protest organizers to sympathetic politicians – will likely regroup and adapt. Continued vigilance, support for democratic institutions, and international cooperation are essential to ensure that Moldova can pursue its chosen European path free from coercive foreign interference.

Sources: Open-source press reports and official statements (Serbian Ministry of Interior, Moldovan Prosecutor’s Office) have been used to compile this assessment. Key information and quotes are cited in-text from those sources.