EU Report Identifies Coordinated Election Interference Targeting European Voters

Russian election interference operations are becoming increasingly sophisticated and persistent across Europe, according to a new report from UK-based Refute that examines foreign meddling in recent European elections.

The report reveals that election interference has evolved beyond last-minute manipulation into “a deliberate, coordinated instrument of interference” that operates throughout the entire electoral cycle, often beginning months before votes are cast.

Refute’s Chief Technology Officer Vlad Galu, who will present these findings at the upcoming Warsaw Resilience Conference, explained the strategic approach behind these operations: “If you’re a politician running to be elected, mathematically speaking, the best strategy is to divide the electorate and then only appeal to part of it. That’s a much easier way to get into office than to try to speak to everyone.”

The report highlights Romania’s 2025 presidential election as a case study, where researchers identified approximately 32,500 TikTok videos promoting populist candidates. Many videos displayed signs of coordinated activity, including duplicate content across multiple accounts and AI-generated material. The pattern of engagement was particularly revealing – while only 24% of Romanian nationals live abroad, nearly half (48%) of the engagement with these videos originated outside the country, suggesting a deliberate targeting of the Romanian diaspora.

In Moldova, the interference campaign was even more extensive and resource-intensive. Russia allegedly deployed a combination of vote-buying networks, online disinformation, and embassy-linked personnel to influence electoral outcomes. Refute detected more than 16,000 accounts exhibiting bot-like behavior during the election period. Intelligence sources cited in the report estimate that approximately $150 million was spent on this operation, underscoring the significant resources being allocated to these influence campaigns.

The report describes a trend toward multi-layered operations that combine automated account networks, influencer amplification, and AI-generated media. Content is strategically distributed across platforms including TikTok, Telegram, and Facebook, often blending authentic and inauthentic engagement to obscure attribution.

Galu highlighted the asymmetric nature of information warfare: “We have to think about this information warfare as pretty much the same thing as conventional warfare. We are in a war situation, it’s just fought with different means on different grounds.” He emphasized the cost imbalance in the fight, noting that creating disinformation requires minimal effort for high yields, while combating it demands significant resources for computation and data analysis to ensure accuracy.

The interference campaigns exploit existing political divisions by focusing on divisive narratives. Common themes include portraying defense spending as competing with domestic welfare priorities, promoting dialogue with Russia as a path to stability, and preemptively undermining confidence in election legitimacy.

Looking ahead, the report warns that similar tactics are already visible in Hungary ahead of the April 2026 parliamentary elections. European security sources cited in the study indicate an interference campaign that “follows the same blueprint” previously observed in Moldova. Galu pointedly remarked, “Monday, April 12, is going to be a very interesting day to wake up to,” referring to the day after Hungary’s elections.

Refute’s analysis concludes that the primary vulnerability is no longer the mechanical process of voting itself, but rather the information environment leading up to elections. Coordinated amplification, activation of dormant social media accounts, and targeted narratives can significantly shape voter perception well before authorities have legitimate grounds to intervene.

“Once disinformation campaigns begin, it is extremely hard to rein it back in again. Prevention is far more cost-effective than damage control,” the report states. Galu advocates for a shift toward continuous monitoring and automated analysis of online activity, arguing that current institutional responses remain largely reactive and insufficient to address the scale of the threat.