The DFRLab article titled “Moldovan ‘traitors’ portal linked to Russian cybercrime group” documents an online intimidation and doxing campaign in Moldova tied to Russian-linked cybercrime infrastructure. The portal, branded in Romanian as “Trădătorii Patriei” (“Traitors of the Fatherland”), publishes personal data and photos of Moldovan citizens labeled as “traitors” for supporting pro‑European, pro‑Ukrainian, or anti‑Kremlin positions. The site mirrors the style and function of the Russian extremist “Mirotvorets” (“Peacemaker”) database, known for listing perceived enemies of Russia and Ukraine and exposing them to harassment or worse. DFRLab’s technical analysis shows the Moldovan portal was hosted on infrastructure overlapping with a known Russian cybercrime group’s environment, including shared IP ranges, domain registration patterns, and hosting providers previously associated with illicit activity. The investigation highlights that the portal appeared shortly after increased Russian information‑operations pressure against Moldova and was promoted on Telegram and other social platforms frequented by pro‑Kremlin actors. It targets Moldovan activists, journalists, politicians, and civil society figures who support the country’s European integration and condemn Russia’s invasion of Ukraine. The portal lists specific individuals with their names, photos, alleged home cities, professions, and accusations such as “NATO agent,” “Russophobe,” or “enemy of Orthodoxy,” with calls in Romanian and Russian to “remember their faces” and “hold them accountable.” The article notes that these practices fit a broader Russian hybrid‑war pattern of psychological intimidation and data‑leak style doxing aimed at deterring dissent and shaping domestic politics in states near Russia, including Moldova. It also observes that Moldovan authorities and civil society groups have condemned the site as dangerous, but legal and technical counter‑measures remain limited at the time of writing. The portal’s use of Russian cybercrime infrastructure suggests coordination or at least facilitation by networks comfortable operating in the Russian digital ecosystem, blurring lines between state‑aligned information operations and criminal resources.

The DFRLab article titled “Moldovan ‘traitors’ portal linked to Russian cybercrime group” documents an online intimidation and doxing campaign in Moldova tied to Russian-linked cybercrime infrastructure. The portal, branded in Romanian as “Trădătorii Patriei” (“Traitors of the Fatherland”), publishes personal data and photos of Moldovan citizens labeled as “traitors” for supporting pro‑European, pro‑Ukrainian, or anti‑Kremlin positions. The site mirrors the style and function of the Russian extremist “Mirotvorets” (“Peacemaker”) database, known for listing perceived enemies of Russia and Ukraine and exposing them to harassment or worse. DFRLab’s technical analysis shows the Moldovan portal was hosted on infrastructure overlapping with a known Russian cybercrime group’s environment, including shared IP ranges, domain registration patterns, and hosting providers previously associated with illicit activity. The investigation highlights that the portal appeared shortly after increased Russian information‑operations pressure against Moldova and was promoted on Telegram and other social platforms frequented by pro‑Kremlin actors. It targets Moldovan activists, journalists, politicians, and civil society figures who support the country’s European integration and condemn Russia’s invasion of Ukraine. The portal lists specific individuals with their names, photos, alleged home cities, professions, and accusations such as “NATO agent,” “Russophobe,” or “enemy of Orthodoxy,” with calls in Romanian and Russian to “remember their faces” and “hold them accountable.” The article notes that these practices fit a broader Russian hybrid‑war pattern of psychological intimidation and data‑leak style doxing aimed at deterring dissent and shaping domestic politics in states near Russia, including Moldova. It also observes that Moldovan authorities and civil society groups have condemned the site as dangerous, but legal and technical counter‑measures remain limited at the time of writing. The portal’s use of Russian cybercrime infrastructure suggests coordination or at least facilitation by networks comfortable operating in the Russian digital ecosystem, blurring lines between state‑aligned information operations and criminal resources.