Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova
Executive Summary
In June 2024, researchers revealed that REST Media, an online outlet targeting Moldova’s elections, is actually a front for the Russian disinformation group Rybar. Rybar, already sanctioned by the EU and wanted by the U.S., used REST Media to amplify anti-EU narratives and undermine the Party of Action and Solidarity, leveraging platforms like TikTok, Telegram, and X to achieve millions of views. Technical forensics linked REST Media’s online infrastructure and production workflows directly to Rybar, demonstrating operational overlap and deliberate efforts at obfuscation. The campaign exploited Moldova's fragmented media regulations, using cloaked registration accounts, privacy services, and anonymized hosting, making attribution complex while rapidly expanding its influence ahead of key elections.
This incident exemplifies the growing sophistication of state-sponsored information operations, exploiting both technology and weak local controls. As hybrid threats, including coordinated disinformation and cyberattacks, continue to undermine democratic processes across Eastern Europe, organizations and governments face mounting regulatory, reputational, and operational risks from similar campaigns.
Why This Matters Now
Election-related information operations are intensifying globally, with Russian actors adapting their tactics for greater reach and plausible deniability. As Moldova approaches critical elections, the use of anonymized infrastructure and influencer platforms like TikTok makes disinformation harder to detect, magnifying the risk to electoral integrity and international democratic stability.
Attack Path Analysis
The adversary established initial cloud infrastructure for influence operations by registering infrastructure using layered anonymization and privacy-protecting services, likely exploiting cloud service setup missteps. Privilege escalation likely involved manipulating access controls or reusing configurations from prior Rybar operations. Lateral movement occurred as Rybar replicated workflows, assets, and configurations across domains, clusters, and regions, facilitating dissemination and redundancy. Establishing command & control, the adversary managed the infrastructure to control content pipelines and distribution, employing cloud-based communication channels and VPNs. Data, including propaganda content and sensitive leaked materials, was exfiltrated through cloud and CDN services using encrypted or anonymized tunnels. The overall impact was a successful, resilient influence campaign using persistent cloud infrastructure to amplify disinformation targeted at Moldovan elections.
Kill Chain Progression
Initial Compromise
Description
Rybar-linked operators provisioned REST Media infrastructure using domain and hosting services with privacy-enhancing and anonymization tools, obscuring ownership and bypassing initial detection or domain restrictions.
MITRE ATT&CK® Techniques
Spearphishing via Social Media
Establish Accounts: Social Media Accounts
Compromise Infrastructure: Domain Registration
Develop Capabilities: Digital Media
Obtain Capabilities: VPNs
Exfiltration Over Web Service: Social Media
User Execution
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIS2 Directive – Risk analysis and information system security policies
Control ID: Article 21(2)(a)
CISA Zero Trust Maturity Model 2.0 – User and Entity Behavior Analytics (UEBA)
Control ID: Identity Pillar – Continuous Monitoring and Threat Detection
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Article 5(1)
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: Section 500.03
PCI DSS v4.0 – Security Incident Response Plan
Control ID: Requirement 12.10
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Moldovan election targeting demonstrates vulnerability to Russian information operations threatening democratic processes, requiring enhanced egress security and threat detection capabilities.
Broadcast Media
REST Media's disinformation campaign exploiting social platforms highlights media sector's exposure to foreign influence operations and need for content authenticity verification.
Information Technology/IT
Shared server configurations and technical infrastructure overlap reveal IT sector vulnerabilities to obfuscated foreign operations requiring enhanced multicloud visibility and control.
Telecommunications
Social media platform exploitation for disinformation spread exposes telecom infrastructure risks from encrypted traffic manipulation and requires comprehensive zero trust segmentation.
Sources
- Researchers say media outlet targeting Moldova is a Russian cutouthttps://cyberscoop.com/researchers-say-media-outlet-targeting-moldova-is-russian-cutout/Verified
- Sanctioned Russian actor linked to new media outlet targeting Moldovahttps://dfrlab.org/2025/09/23/sanctioned-russian-actor-linked-to-new-media-outlet-targeting-moldova/Verified
- Inside Russia’s AI-driven disinformation machine shaping Moldova’s electionhttps://www.euronews.com/next/2025/09/23/inside-russias-ai-driven-disinformation-machine-shaping-moldovas-electionVerified
- Moldova detains 74 people over an alleged Russia-backed unrest plot around key electionhttps://apnews.com/article/293ee902e878ce1efcca339759eb06d0Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust network segmentation, egress policy enforcement, threat detection, and east-west traffic controls would have greatly constrained adversary movement, infrastructure reuse, and covert communication—even when attackers employed anonymization techniques or reused trusted configurations.
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility would rapidly uncover anomalous domain provisioning or rogue asset deployments.
Control: Zero Trust Segmentation
Mitigation: Strict least-privilege segmentation would restrict privilege escalating pivots across assets.
Control: East-West Traffic Security
Mitigation: Lateral duplication and internal propagation would be contained or denied at the service level.
Control: Threat Detection & Anomaly Response
Mitigation: Covert command channels and VPN-based C2 would generate alerts for anomalous patterns or unauthorized management.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound exfiltration attempts to social platforms or dropzones would be restricted or logged.
Real-time policy enforcement and distributed inspection reduce attacker dwell-time and campaign resiliency.
Impact at a Glance
Affected Business Functions
- Media and Communications
- Government Operations
- Public Trust
Estimated downtime: 90 days
Estimated loss: $5,000,000
The disinformation campaigns led to widespread public misinformation, undermining trust in government institutions and media outlets. While no direct data breaches were reported, the manipulation of public opinion and potential voter suppression had significant societal impacts.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce zero trust segmentation and microsegmentation to strictly limit asset-to-asset and region-to-region access for cloud and distributed workloads.
- • Deploy centralized multicloud visibility tools to surface rogue or anomalous cloud asset instantiation, domain provisioning, and cross-environment workflow reuse.
- • Enable east-west traffic inspection and lateral movement controls to prevent infrastructure mirroring and restrict internal propagation of attacker workflows.
- • Implement strong egress enforcement, including FQDN filtering and outbound policy, to detect and stop unauthorized data transfers and covert exfiltration paths.
- • Integrate anomaly detection and incident response automation within your cloud-native security fabric to accelerate detection and disruption of malicious orchestration or persistence attempts.
