UK-based Refute has published a new report examining foreign interference in recent European elections, drawing on data from Romania, Moldova, and other active theatres of influence operations.
Refute CTO Vlad Galu, will speak at our Warsaw Resilience Conference to present findings from the report.
The report argues that election interference is no longer limited to isolated incidents or last-minute manipulation. Instead, it is “a deliberate, coordinated instrument of interference” embedded across the full electoral cycle, often months before votes are cast.
The goal? To split the electorate and to convince the country’s diaspora that their country is going down the tubes.
“If you’re a politician running to be elected, mathematically speaking, the best strategy is to divide the electorate and then only appeal to part of it,” said Galu. “That’s a much easier way to get into office than to try to speak to everyone.”
In Romania’s 2025 presidential election, Refute identified approximately 32,500 TikTok videos promoting populist candidates. Many showed signs of coordinated activity, including duplication across accounts and the use of AI-generated content. Engagement patterns also pointed to external targeting. While roughly 24% of Romanian nationals live abroad, 48% of engagement with these videos originated outside the country, suggesting systematic targeting of the diaspora.
The Moldovan elections showed a broader, more resource-intensive campaign. According to the report, Russia deployed a mix of vote-buying networks, online disinformation, and embassy-linked personnel. Refute detected more than 16,000 accounts displaying bot-like behavior during the election period. Estimates from intelligence sources cited in the report place spending on the operation at roughly $150 million.
Across both cases, the report describes a shift toward layered operations. These combine automated account networks, influencer amplification, and AI-generated media. Content is distributed across platforms including TikTok, Telegram, and Facebook, often blending organic and inauthentic engagement to make attribution difficult.
Galu notes that information warfare is tricky — and expensive.
“We have to think about this information warfare as pretty much the same thing as conventional warfare. We are in a war situation, it’s just fought with different means on different grounds. What we see from our perspective is the cost imbalance of fighting the fight. So imagine this, you create this information and there’s no expectation from the people creating this information of providing high-quality disinformation,” he said. “So it’s a very low-effort, very high-yield activity. Whereas for us and others like us in this space, the bar of admission is much, much higher because we want certainty, we want clarity, and to achieve that, the cost of the compute and the data is huge.”
The report also highlights how these campaigns exploit existing political narratives. Common themes include framing defense spending as a trade-off against domestic welfare, promoting dialogue with Russia as a path to stability, and preemptively casting doubt on election legitimacy.
In Hungary, similar tactics are already visible ahead of the April 2026 parliamentary elections. European security sources cited in the report point to an interference campaign that “follows the same blueprint” previously observed in Moldova.
“Monday, April 12, is going to be a very interesting day to wake up to,” said Gula, referring to the date of the Hungarian elections.
Refute’s central conclusion is that the primary vulnerability is no longer the mechanics of voting, but the information environment leading up to it. Coordinated amplification, dormant account activation, and targeted narratives can shape voter perception well before authorities have grounds to intervene.
“Once disinformation campaigns begin, it is extremely hard to rein it back in again. Prevention is far more cost-effective than damage control,” the report states.
Galu calls for a shift toward continuous monitoring and automated analysis of online activity, arguing that existing institutional responses remain largely reactive and insufficient at current scale.
