More than 150,000 Moldovans is the kind of figure that can distort a story as easily as it clarifies one. It suggests a hidden army of trained agents waiting for orders. The records described by The New York Times on 14 August point to something messier. Many of the people involved appear to have been paid voters, activists or casual recruits who were given a limited job and sometimes asked to bring in somebody else. The network was financed by fugitive oligarch Ilan Shor and, Western intelligence officials told the Times, answered to Sergei Kiriyenko, a senior Kremlin official. For the people at the bottom, however, a payment and an instruction were often enough.
Leaked court records reviewed by the Times show nearly $20 million reaching 38,000 activists in the four months before Moldova’s 2024 referendum, which placed the goal of EU membership in the constitution. Much of the operation was aimed at influencing the vote. A smaller number of recruits received training in protest tactics or in the use of drones and incendiary materials. Money tied these activities together. The organisers could pay thousands of people to shape an election, then draw on a much smaller circle if they wanted disorder in the streets.
What happened next is the reason this cannot be left as another alarming story about Moldova. The Times found that the recruitment approach was later adapted for France and Germany. An EU sanctions decision from December 2024 had already referred to a Moldovan businessman involved in sending Moldovan citizens to France for a destabilisation operation. It also named people in Germany who had cooperated with Russian intelligence. This does not prove that Shor’s organisation was copied in full. It suggests that it never needed to be. A local intermediary can find recruits, money can be moved to them and instructions can come from somewhere else.
The warnings to Poland and the Baltic states belong beside that evidence. Reuters reported on 10 August that regional and allied intelligence had warned of possible Russian sabotage or a false-flag attack involving Ukrainian-made drones. Governments tightened security around critical infrastructure. Three days later, the Associated Press reported that Poland had detained a Russian citizen accused of helping Russian intelligence prepare the killing of a US citizen of Ukrainian origin in Warsaw. There is no public evidence tying either case to Shor, and claiming such a link would go beyond the facts. They matter here because both show how little manpower a serious operation may require once somebody has found a willing recruit.
Stay ahead of the geopolitical week.
MD Briefing delivers expert analysis across five global fronts — the Indo-Pacific, energy, geoeconomics, European security, and the Middle East — every Monday morning. Free.
Interfering in a referendum takes numbers. Photographing an energy site, delivering an incendiary parcel or helping to locate a target may take one or two people. Russia does not need to reproduce Moldova’s 150,000-person network inside France, Germany or Poland. It can reduce the network to whatever a particular job demands. A smaller operation inside an EU member state may therefore carry more immediate danger than the much larger one exposed in Moldova.
Europe has hardly been passive. In June, the Council of the European Union added six people to its Moldova sanctions programme, taking the total to 29 individuals and five entities. A separate EU regime covers Russian destabilisation activities. Eurojust also said in March that an investigation into self-igniting parcels had identified 22 suspects believed to be working for Russian military intelligence. These efforts matter, but they travel along different tracks. One file is handled by officials concerned with Moldovan elections and EU enlargement. Another sits with police and prosecutors. Warnings about energy systems or drones go to infrastructure agencies and NATO planners. Each response may make sense on its own while the connections between them remain easy to miss.
Moldova should not be treated as a miniature version of every European country. Its lower incomes, oligarchic politics, Russian media presence and unresolved territorial divisions gave Moscow opportunities it may not find elsewhere. The 150,000 figure also says little about loyalty. Many people may have taken money without knowingly signing up to serve Russian intelligence. Governments should be equally careful about attribution. Moscow denies conducting hybrid attacks, and calling every unexplained fire or drone sighting a Russian operation would blur the line between evidence and suspicion. Where the same recruiters, payments or instructions appear across borders, however, that evidence needs to be compared rather than left inside separate national cases.
For Brussels, the practical lesson begins with the people and financial routes that can be used again. Arresting the person who carries a parcel or surveys a site may prevent one attack, but a replacement can be found if the recruiter and the payment system remain untouched. The EU’s hybrid-threat sanctions regime already allows asset freezes against people and entities involved in destabilisation. It should be used earlier against those intermediaries, while investigators share financial and recruitment evidence before an operation is over. The aim is straightforward: make it harder to rebuild the network after the most visible participant has been caught.
The Moldova files have not uncovered a single army of 150,000 operatives spread across Europe. They have uncovered a working method that can be expanded for an election and cut down for sabotage. That is enough to change how the campaign should be understood. By 30 September 2026, the Council should have named at least one organiser, payment vehicle or entity newly exposed by the investigation under the EU’s Russia-wide hybrid-threat sanctions regime, through a new listing or a cross-listing. A listing would be evidence that Brussels had begun treating the Moldova case as a European security problem. If nothing follows, the response will remain divided even after the method connecting these threats has been exposed.
