On 15 September 2024, Prime Minister Dorin Recean travelled to Taraclia, Moldova, in SE Moldova, with his Bulgarian counterpart to open a local branch of a university. Taraclia is one of the centers of Bulgarians in Moldova. Outside the House of Culture, the PM was greeted by a crowd of locals waving brooms.1 Police blocked most press from getting close, with the exception of a film crew from Ilan Șor-owned Canal 5 being allowed.23 We were meant to believe, at the time, that this was spontaneous local anger (or a flashmob to date myself quite specifically to a cultural phenomenon) and proof of the pro-Russia climate of the average Moldovan.
Interestingly, thanks to the some of A7 code repositories I’ve discussed, here and elsewhere, at-length, the internal discussions and GPS logs from that day tell a bit more of this story.
There were 613 check-ins tied to “sympathizers” & “activists” (A7’s words, not mine) at the coordinates of the Taraclia House of Culture on that afternoon the Prime Minister was standing there.4 For 15 September 2024, 63% of check-ins recorded in Moldova were in Taraclia, recorded on a tool’s database connected to a payment system that instructs people where to go and “check-in” for payment into their Russian bank account.
Based on the slightly awkward performative demeanor of the protestors, it should have been obvious this was not an organic protest.
Subsequent leaks, which I will get to later, completes the story. Șor’s Evrazia, using the same core network as A7, signed a cooperation agreement with the local authorities of Taraclia, with a monthly budget for the town alongside a payment schedules for local leaders.5 The crowd was bussed in and paid to stand around. Ironically, the building they stood in front of looks like it was also paid for.
A few months back, I came into possession of a 790Mb database backup of the operational backend of the Telegram-based Russian influence platform that Ilan Șor’s A7 developers purpose built for Moldova’s October 2024 presidential election and EU accession referendum vote. This backup contains the details of every enrolled person, misinformation bot credentials, and content to be shared on social media.6 After rebuilding that backup, we have a clearer picture of how the network operated. Șor’s network enrolled more than 153,000 individuals, collected their passports, selfie video, both sides of their national ID during registration, contact information, and logged their GPS coordinates every time they opened the custom application to check in to get paid.7 The database schema also tracks referrals as recruits were credited for bringing in other recruits.8 The operation is part of Ilan Șor’s larger A7 Network, organizationally slotted under the entity named “Evrazia”, with ultimately the exact same team of developers working on this application as produced the A7 Network’s cross-border payment infrastructure.9 Notionally, Evrazia was meant to operate as a cultural-NGO-project but for all intents and purposes it is just A7 doin’ A7-things with currency not crypto.10
Ilan Șor, the Moldovan-Israeli oligarch, convicted of fraud, was already banned from the 2024 Moldovan elections due to prior hi-jinx and large-scale theft. Instead Șor ran a proxy-campaign of sorts from abroad. This piece is about what the location data in that database actually proves and is a part of a series of stories from this database.
As always, I am happy to share the dataset to better understand how Russia attempted to swing this election as I suspect it will be used again, or has. This information is our most powerful way to combat Russian malign influence operations. Additionally, the custom tool that I built for tracking the protests using the check-ins, that formed my analysis is available in the Subscriber Perks. I made an interactive map of the gps coordinates because staring at Excel sheets is not as exciting for everyone, understandably.
MDDbProd Mechanism
The name of this file is a backup of, MDDbProd; part of the A7-built protestor mobilization app that doubles as a payment ledger with a GPS tracking bolted on.
A Moldovan citizen was able to enroll through one of the 240-plus Telegram bots listed. The interested person then hands over a passport scan, a selfie, and their national ID number, and gets sorting-hat’d into one of roughly 120 territories across Moldova. For the protestor to get paid, they had to open the app at the right place and submit their coordinates. That check-in would unlock a transfer, disbursed through PromsvyazBank (PSB), now known as Russia’s designated military bank but once just another failing commercial bank. The payment is issued through the MIR card network.11 MIR, or Мир, is Russia’s domestic payment card payment system and operates as a kind-of worse version of VISA/Mastercard. The name means “the world” or “peace”, which is very ironic given that Russia was forced to create it in response to sanctions for continued aggression. Anyways, MIR doesn’t legally operate in Moldova, A7/EVRAZIA relied on a workaround of sorts.
Through the old and new leaked A7 datasets, the payment side of this network’s operation can be paired to the protestor side. Like so many things, the devil is in the details and probably different than the adage goes, the details are the bank account numbers at PSB. The documents detail around 33,000 bank accounts in the payment ledgers that begin with the numbers 40820 and include currency code 810. For those who don’t spend their weekend mornings looking at Russian financial data, 40820 is the Russian account class for a non-resident individual and 810 denotes the account is in rubles.12
Put a bit more accessibly, this means thirty-three thousand Moldovans were issued bank accounts at Russia’s military bank and paid into them monthly, accessible by a debit card.
Protest attendance paid out 400 to 600 lei per event, which is like $100. A monthly pension top-up was 1,000 to 2,000 lei.13 In one region’s payment ledger, every payment is exactly 10,000 rubles. 10,000 RUB is about 1,850 MDL, or rounded for simplicity, about $100.14
Protests viewed through check-in data
This event in Taraclia is just one of the verifiable instances of where people were paid to show up and protest at.
25 August 2024 was the biggest active day in the database. There were 8,995 check-ins nationally, with 2,929 of them landing within 100 meters of central Comrat, Gagauzia’s capital.15 Pro-Russian recruited persons from four territories converged on the same coordinates at once, likely for coordination but possibly connected to protests and gathers at the opening of another of Șor’s themeparks, GagauziyaLand.
21 September 2024, a smaller crowd checked in near Comrat again, but each person checked in an average of 2-3 times over a ten-hour window, across two coordinates only 600 meters apart.16 The group appeared to be most active between the Comrat customs house and the aforementioned GagauziyaLand.
29 September 2024, Șor publicly launched a chatbot called STOP UE (“Stop EU Moldova”). The database’s Facebook-monitoring schema stores a reference image, stop_eu2.png, that was used to validate whether activists had shared the requested image, validated using a frontier LLM AI model with a visual mode.17 Of note, this is not this developers first time making use of US-based frontier LLMs for Șor’s benefit.These AI prompts allowed Șor’s Network to determine of the recruited users would be paid for their posted material, which is another pretty concerning adversarial use of Western-AI for anti-Western objects. In the below image are four examples of prompts used to vet the protestor content.
27-28 September 2024, while the check-in network kept running its normal payment cycle, Chisinau saw a wave of anti-EU graffiti on government buildings. Moldovan police reporting ties it to a separate tier of recruits paid roughly 500 euros a month.18 These protestors can be tracked by their movements in this timeframe.
& only ten days after that, on 30 October 2024, a tranche of fake Ukrainian social media accounts appeared in the database, all created in the same second.19 The Moldovan operation was already being repurposed before their original goal had failed.
The network defrauded itself, too
If you, like me, are forever a pessimist and the numbers above start to feel too clean, there is some hope. Buried in the check-in data is an example of a single account that logged over 2,000 check-ins from the exact same coordinates, over and over. Without knowing the details of that person’s circumstances it is hard to say for certain what that is, VPN-issues, gamification, feverish mashing of a check-in application? But, it could be, padding the payment-verification system with fabricated participation.
When I started this draft a few weeks ago, somewhere here I admitted that I didn’t know how much of the network was actually real. While, I know that I know nothing, more recently I know something.
Further analysis of leaked data contains an export of this same database, and it separates the enrolled participants from those that were validated. 153,214 people enrolled. But, just over 91,000 actually completed validation. That’s like two in every five registrations that never bothered to finish the verification process? As someone who despises signing up for new accounts and applications, I can understand that an application that was not allowed on any app store might have been a pain to sign up for, even with the financial incentive offered.
The validated accounts rose through July and August before reaching a peak in September. By October, enrollment started to slow. October is pretty important as that was the month of the referendum. The fact that validated users had only reached 16% of September’s volume shows that this network didn’t quite grow as intent.
A network that was built to verify real Moldovans showing up to real protests, could not stop people from gaming it and could not consistently get its own recruits to finish enrolling. Whatever the check-in activity in this database adds up to, the number of real, physically present, paid Moldovans is smaller than what Șor, and likely the Kremlin had hoped(paid) for.20
The numbers that actually matter
153,214 people enrolled in this system. Moldova’s EU accession referendum squeaked by with roughly 11,600 votes.21
Russia managed to enroll more than 13 times the margin that decided the Moldova’s constitutional future. The referendum managed to hold with Moldova still headed toward Europe. But the network employed to stop that didn’t likely shut-down when the influence operation failed. In June 2025, nearly 8 months after the vote, the same network processed over 30,000 wire-transfers in a single day. So, whilst the network failed to meet their goal for blocking Moldova’s EU accession, like everything that A7 touches, I believe this architecture has been recycled for other jurisdictions and is probably currently active.
The backup of this operational server could help identify Russian malign-influence campaigns in other European jurisdictions. If you need this data, please reach out. I am happy to make it available, but given the amount of PII in the dataset, I will not be making the entirety of it available.
I am, however, making available a derivative tool of the data in my Subscriber Perks that can be used to review the check-in points of protestors, tied to specific events in Moldova.
A disclaimer on this piece.22 & appreciations.23 24
Probably not for a Stanley Cup sweep as the NHL season had not yet started.
“Recean’s visit to Taraclia: Residents with brooms, detentions and protests” YouTube - Canal5 Moldova
‘checkin’ data table from ‘MDDbProd’. 613 of 982 of check-ins at 45.902°N, 28.687°E at time of protest. Full Tool available in Subscriber Perks
Data seen by author
I am happy to share this with relevant authorities, but given the PII must gate this slightly.
“Russia allegedly spent $39mn to buy votes in Moldova” - INTELLINEWS // corroborated by BankAcceptanceState fields in TelegramData
We love a pyramid scheme
Șor listened to advice and found himself someone who can do both
A point I will continue making until I stop seeing AI-blogs publishing false information about cryptocurrency reliance.
“MOLDOVA OBLIGES INTERNET PROVIDERS TO BLOCK ACCESS TO PROMSVYAZBANK WEBSITE (RUSSIA)” - INFOTAG.md, corroborated by BankAcceptanceState fields in TelegramData
Data seen by author
Data seen by author
CheckinData, Aug 25 2024, cluster at 46.323°N, 28.658°E.
CheckinData, Sep 21 2024, two clusters 46.3065°N/28.6563°E and 46.3008°N/28.6542°E.
NewsLinkPrompt
newslink.NewsLinkAccount, 49 accounts created 2024-10-30 13:59:06
Kremmy-P
This piece draws on a leaked server backup and public reporting all attempts have been made to independently authenticate this data, when possible. All statements of fact, opinion, and analysis are strictly the author’s own and do not constitute a legal or regulatory finding or an allegation of criminal conduct against any named individual. No personal data belonging to enrolled citizens, including passport scans, biometric material, national ID numbers, or individual GPS records, has been extracted, reproduced, or transmitted. Named public officials are described solely in their public capacity. Named entities are welcome to get in touch if I’ve gotten it wrong.
Thank you to my partner for having the keenest editing eye in the land and being the the champion of the pun. You’re a master of karate and friendship for everyone.
& thank you to my friend and colleague Andrew Akhlaghi for his expertise on data and the many early morning calls processing this data.
