Silent Push Analyzes New Disinformation Campaign Targeting 2025 Moldovan Elections Connected to Legacy Moscow Influence Campaign
Key Findings
- A new disinformation campaign, initially reported by RecordedFuture, appears to be seeking to influence Moldova’s upcoming elections on September 28, 2025. Our analysts linked the campaign to a separate, earlier Russian influence campaign and disinformation effort from 2022 through a unique technical fingerprint, along with other details.
- The 2025 Moldovan disinformation websites have no clear ownership or declared authors, indicating the operators are trying to hide their involvement and possible ties to the campaign.
- Our team identified a technical fingerprint found on many of the 2025 Moldovan disinformation websites which connects to absatz[.]media, which is a Russian media and propaganda effort launched in 2022. The editor-in-chief of Absatz is listed on their website as “Shakhnazarov M. S.,” which likely refers to Mikhail Sergeyevich Shakhnazarov, an individual who has been sanctioned in Ukraine for supporting Russian propaganda.
- The technical fingerprint connecting the two propaganda campaigns is likely due to a shared developer working on both projects. Some other potential scenarios will also be discussed, but the combined details provide strong indications that Absatz is connected to this ongoing disinformation campaign aimed at the Moldovan elections.
Executive Summary
On September 28, 2025, Moldova (the former Soviet republic country landlocked between Romania and Ukraine) will hold nationwide elections. These elections are reportedly being targeted by Russian disinformation efforts attempting to dissuade Moldova from continuing its alignment toward Europe and away from Russia. The effort is classified as part of multi-year Russian disinformation campaigns by threat actors known as “Matryoshka” or “Storm-1679.”
Our analysts have identified a unique technical fingerprint through the analysis of Moldovan disinformation websites active in 2025, which helped us discover two new domains hosted on a unique IP address. The new hosts are linked to separate Russian disinformation efforts that have been active since 2022.
Unlike the current Moldovan campaign, the older Russian disinformation effort was first seen in 2022 and is associated with an organization known as “Absatz.” Registration details list a Moscow address under an editor-in-chief named “Shakhnazarov M. S.” Our team finds it likely this refers to an individual with the name “Mikhail Sergeyevich Shakhnazarov,” based in Russia, who was sanctioned in Ukraine for supporting disinformation efforts. Based on the registered organization name, tax numbers, and editor’s name, the editor-in-chief of Absatz certainly appears to be the same currently sanctioned Russian disinformation actor, (https://zachestnyibiznes.ru/company/ul/1217700292325_9706016908).
Table of contents
- Key Findings
- Executive Summary
- Interested in Updates on this Emerging Threat?
- Background
- Initial Intelligence: Finding Commonalities
- Connections Between the 2025 Campaign and Russian Disinformation Efforts in 2022
- Absatz – Legacy Russian Disinformation
- Suspect Social Media Accounts Sharing Absatz’s Content
- New Storm-1679 Connections
- Continuing to Track Storm-1679 / Matryoshka
Interested in Updates on this Emerging Threat?
Follow the Silent Push threat intelligence team on LinkedIn and X/Twitter for our latest research findings.
Background
Researchers have been monitoring a recent Moldovan disinformation campaign that has been active since at least April 2025. As referenced above, this campaign is classified as part of multi-year Russian disinformation campaigns by threat actors known as “Storm-1679” or “Matryoshka” (a descriptive term associated with Russian nesting dolls). This same Russian threat group has targeted other elections and global events, including the 2024 Paris Olympics.
While reviewing indicators from a recent report about the Russia-linked influence campaign targeting Moldova, our team identified technical fingerprints linking the efforts to Absatz. Absatz is a Russian news site run by an editor-in-chief, “Mikhail Sergeyevich Shakhnazarov,” who is likely the same individual previously sanctioned in Ukraine for supporting Russian propaganda.
Absatz was registered on March 31, 2022, with the Russian media regulator Roskomnadzor. Also known as the Federal Service for Supervision of Communications, Information Technology, and Mass Media, Roskomnadzor is the Russian government’s primary regulator for media and the internet. The regulator has been previously criticized for censoring independent media and enforcing state control.
Based on the discoveries our team has made connecting a 2022 disinformation effort with this 2025 campaign, one of three conclusions appears likely:
- The recent Moldovan disinformation campaign’s developers used Absatz as a template, but for some reason, they only reused a small amount of the code, and that’s the only connection.
- The Absatz news and disinformation effort, as well as the 2025 Moldovan disinformation campaign, shared a developer who reused specific code across both projects.
- The Absatz website and 2025 disinformation campaign are both run by Absatz.
Initial Intelligence: Finding Commonalities
We quickly identified several fingerprints to track the domains associated with the 2025 disinformation campaign targeting Moldova, which are based on multiple code commonalities shared across them, as well as the use of dedicated IP addresses.
The results revealed domains mapped to one of two dedicated IP addresses, further proving infrastructure reuse and common ownership across this campaign:
- 95.181.226[.]135
- 91.218.228[.]51
Connections Between the 2025 Campaign and Russian Disinformation Efforts in 2022
Our team observed heavily reused code across this infrastructure. This allowed us to develop a unique fingerprint connecting many of the 2025 websites, as well as two domains hosted on the same IP address, that have been used for Russian disinformation efforts since 2022.
The technical fingerprints were only found on the 2022 and 2025 Russian disinformation websites, and nowhere else on the internet, strongly indicating there are developer ties between the two efforts.
For operational security reasons, we cannot publicly reveal these fingerprints at this time. Our enterprise customers have access to a detailed report on this topic with no omissions, as well as all associated campaign infrastructure. Please reach out to our sales team (link at the bottom of this post) if this data is of interest to you or your organization.
The new domains and IP addresses returned from our technical fingerprints, which aren’t associated with the 2025 disinformation campaign, are:
- absatz[.]media (Total View)
- abzac[.]media (redirects to absatz[.]media) (Total View)
- 5.188.179[.]181 (Total View)
Absatz – Legacy Russian Disinformation
- Absatz[.]media is the primary domain used by Absatz and was registered on July 12, 2021.
- Three months later, the first A record IP address mapped to this domain was seen on October 24, 2021, from ASN 197695 (AS-REG, RU).
- The first versions of this website were captured in the Wayback Machine in May 2022.
- Since 2023, there haven’t been any substantial changes to the site’s code or hosting. The domain has been hosted for more than two years on ASN 210756 (EDGECENTERLLC, RU).
The Absatz website also contains a footer which openly includes details about its ownership and editor-in-chief, which have been machine translated into English below:
“The online publication Absatz is registered by Roskomnadzor, registered entry dated March 31, 2022, EL № FS77 – 82992. Founder and editorial board – LLC «Intaria». Editor-in-Chief Shakhnazarov M. S. Editorial address: 127055, Russian Federation, Moscow, st. Butyrsky Val, 68/70s1. Mail: info@absatz[.]media All rights to materials located on the website absatz[.]media are protected in accordance with the legislation of the Russian Federation, including copyright and related rights. For any use of site materials, a link to absatz[.]media is required. The editors are not responsible for information and opinions expressed in reader comments and news materials compiled on the basis of reader messages.
They are used on the information resource recommender technologies (information technologies for providing information based on the collection, systematization, and analysis of information related to the preferences of internet users located on the territory of the Russian Federation).“
The key takeaways from this disclaimer are:
- Absatz is registered with Roskomnadzor, the Russian agency responsible for mass media regulations and censorship.
- Absatz was registered with Russian authorities on March 31, 2022, eight months after the website was first registered online.
- The Absatz “Editor-in-Chief” is listed as Shakhnazarov M. S.
- “Shakhnazarov Mikhail Sergeyevich” is the name of a propagandist based in Russia who has been and is sanctioned based on their activities supporting the Russian invasion of Ukraine. Based on the shared name, industry, business association, and tax ID, our team finds it likely that the Absatz editor-in-chief is the same sanctioned individual.
- Absatz’s editorial address is listed as “127055, Russian Federation, Moscow, st. Butyrsky Val, 68/70s1”
- This address appears to be the same large building where the “AEB Association of European Businesses” – an influential Russian business organization – is headquartered. (aebrus[.]ru/en/our-contacts/)
- Additionally, an obscure reference to “Founder and editorial board – LLC «Intaria»” appears to reference a separate Russian LLC, also controlled by Mikhail Shakhnazarov and registered in June 2021, as seen within this Russian business database: (zachestnyibiznes[.]ru/company/ul/1217700292325_9706016908).
Looking Beyond Technical Connections
Beyond the technical connections shared between this historically Russian propaganda-focused website and the 2025 Moldovan disinformation websites, there is also a substantial amount of content on Absatz’s own website that raises both red flags and speaks to its support for similar disinformation campaigns.
When searching for the Russian word for Moldova (“Молдова”) on Absatz (absatz[.]media/search), there are dozens of clear disinformation articles. Some of the content includes headlines, machine translated to English below, which clearly show bias against the current leadership and the pro-EU faction within Moldova:
- “Police forcibly dispersed a peaceful protest in Chisinau”
- “I asked the collapse: how far Sandu is ready to go in political lawlessness”
- “Maya on the defensive: why Sanda was dubbed in Italy” «a petty dictator»
- “Moldovan oligarch Plahotniuc was detained in Greece”
- “A Moldovan was detained in Ryazan for transmitting data about the Russian Armed Forces to Kyiv”
- “Ozerov: History textbooks in Moldova are being rewritten to justify confrontation with Russia”
- “The Central Election Commission of Moldova did not allow the bloc «Victory» to participate in the parliamentary elections”
- “Hello, bust: why a monument to the Moldovan ruler is being erected in Crimea
- Two Moldovan intelligence agents were detained in Moscow”
- “A new Moldovan textbook called Moscow and Chisinau parties to the conflict in Transnistria”
- “Former Prime Minister of Moldova Tarlev: Chisinau violated the rights of believers and insulted the church”
- «Purposeful mockery»: “The Russian Orthodox Church condemned Moldova for disrupting the delivery of the Holy Fire”
- “A citizen of Moldova who fought for the Armed Forces of Ukraine was detained for preparing terrorist attacks in the Russian Federation”
- “The Ambassador of Moldova was summoned to the Russian Foreign Ministry due to a violation of the Vienna Convention”
- “The political scientist explained why Sandu will not be able to fabricate a criminal case against the head of Gagauzia”
- “In Transnistria, the West was accused of preparing Moldova for a conflict with Russia”
- “The ex-president of Moldova called on the opposition to unite and not recognize the election results”
- “Kobakhidze: Moldova did not pass the democracy test”
- …And dozens more
Other Articles Following the Disinformation Pattern
A large number of other articles across Absatz’s website follow this disinformation pattern. They can be found by searching for other commonly included keywords for these types of campaigns in Russian:
- Ukraine – Украина
- absatz[.]media/search?q=%D0%A3%D0%BA%D1%80%D0%B0%D0%B8%D0%BD%D0%B0
- NATO – HATO
- absatz[.]media/search?q=НАТО
- Germany – Германия
- absatz[.]media/search?q=%D0%93%D0%B5%D1%80%D0%BC%D0%B0%D0%BD%D0%B8%D1%8F
- United States – Соединенные Штаты
- absatz[.]media/search?q=%D0%A1%D0%BE%D0%B5%D0%B4%D0%B8%D0%BD%D0%B5%D0%
BD%D0%BD%D1%8B%D0%B5+%D0%A8%D1%82%D0%B0%D1%82%D1%8B
- absatz[.]media/search?q=%D0%A1%D0%BE%D0%B5%D0%B4%D0%B8%D0%BD%D0%B5%D0%
Suspect Social Media Accounts Sharing Absatz’s Content
Many low-quality accounts (low-quality in terms of appearance as a genuine user) that share links to Absatz can be found across most major social networks, discoverable via simple searches on those platforms or by checking Absatz’s own account. It is important to note that this is a common tactic in disinformation campaigns:
- Twitter: https://x.com/search?q=absatz.media&src=typed_query&f=live
- Facebook: https://www.facebook.com/search/top/?q=absatz.media
- TikTok: https://www.tiktok.com/@absatzmedia2.0
New Storm-1679 Connections
Below are the two new domains and an IP address used by Absatz associated with the 2025 disinformation campaign:
- absatz[.]media
- abzac[.]media (redirects to absatz[.]media)
- 5.188.179[.]181
Our enterprise customers have access to the complete list of disinformation infrastructure associated with this campaign. If you would like to learn more about our capabilities for tracking disinformation campaigns—or how you can hunt for them yourself on our platform—we encourage you/your organization to reach out to our team for a demonstration.
Connect with our platform experts for an overview of the Enterprise Edition platform. We can provide a tailored walkthrough for your specific use case, along with insights into integrations and API capabilities.
Continuing to Track Storm-1679 / Matryoshka
Our team will continue to investigate and track Storm-1679 as the campaign evolves and in concert with ongoing research into the infrastructure behind other disinformation campaigns. If you or your organization has details you wish to share with our threat team, we would love to hear from you.
