Romanian Presidential Election Undermined By Russia

Authorities in the EU member nation, Romania, have revealed details of what appears to be a major attempt to interfere in the country’s presidential elections using the social media platform TikTok, and a series of cyber attacks.

The Romanian Intelligence Service (SRI) disclosed that over 85,000 computer network intrusions were launched against election websites and IT systems throughout the first round of the NATO member state’s election process. 

Based on the disclosure by the SRI, the persistent computer network intrusions are indicative of a state-sponsored cyber unit with considerable resources and capabilities at its disposal.

In consequence, Romania’s Supreme Court has moved quickly to annul the results of the first round of the presidential election. The Court has ruled that the first round process must be rerun and in a statement said the annulment was based on Article 146(f) of the Constitution, emphasising the need to ensure the correctness and legality of the electoral process. Romania's domestic intelligence service says there are signs the effort was "co-ordinated by a state-sponsored actor", which they clearly think is Russian.

Calin Georgescu, a  critic of NATO who has previously praised Russian President Putin, was almost unknown in Romania until he won the first round of voting in the presidential elections. Georgescu, a pro-Russian candidate who wants to end Romania’s support for Ukraine amid Russia’s invasion, emerged as the front-runner on November 24 despite being a political outsider who declared zero campaign spending.

Now, Romanian intelligence agencies say that his sudden and surprise surge in popularity is down to a "highly organised" and "guerrilla" campaign on social media, sharing identical messaging and using influencers.They say it was conducted from "external locations" to bypass controls.

A separate intelligence assessment says that Romania has been identified as an "enemy state" by Moscow and a priority target for what it calls "aggressive hybrid actions".

The politically disruptive information, came into the public domain only a few days before the second round of voting, as a result of declassified documents published by the outgoing President, Klaus Iohannis. They reveal how paid content supporting Georgescu was promoted on TikTok, without being marked as election campaigning, in violation of the platform’s own rules and of Romanian electoral law.

Other candidates’ content was subject to strict controls and Georgescu insists that he spent nothing on election promotion, denying he was even campaigning. However. the intelligence documents released identify one TikTok account alone which they say made payments of $381,000 (£299,819) to users who were promoting Georgescu in the five weeks from 24th October,

The European Commission has ordered TikTok to “freeze and preserve data” amid the ongoing Romanian presidential elections and declassified intelligence “pointing to interference from Russia.”

The declassified documents released were all papers drawn up for a meeting of the security council following the first round of the presidential election. They also reveal that access data for electoral websites was stolen from legitimate users and published online “on cyber-crime platforms originating from Russia”. Separately, the intelligence agencies report some 85,000 attempted hacks in an attempt to access electoral data and change content, including on election day. 

The report says the cyber-attackers used advanced methods to remain anonymous, working in a way and on a scale "typical of state-sponsored actors".

In comment, Craig Watt, an expert Threat Intelligence Consultant at Quorum Cyber said, "This recent event demonstrates that Russia’s ‘Information Confrontation Doctrine’ continues to form the foundation of Moscow’s strategic cyber targeting as influence assets capitalise on European political divisions to influence Western demographics in the direction of NATO-scepticism."

An investigation is ongoing to determine more details about the campaign and precisely who was responsible.  "It will be critical for the western intelligence community to work together to combat these malign cyber operations that continue to attack the fabric of European democracy." Watt concludes.

Presidency.ro   |    Reuters   |    BBC   |   AlJazeera   |    CNN   |   Record   

Image: Ideogram

You Might Also Read: 

Social Media Algorithms & Their Effects [extract]:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

 


Cyber Security Intelligence: Captured Organised & Accessible


 

« US Telecoms Customer Data Stolen By Chinese Hackers 
TikTok Will Be Banned In The USA »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

CERT-EU

CERT-EU

CERT-EU is a permanent Computer Emergency Response Team for the EU institutions, agencies and bodies.

Digital Infrastructure Association (DINL)

Digital Infrastructure Association (DINL)

DINL is the leading representative for companies and organisations which are active within the Dutch digital infrastructure sector.

SafenSoft (SnS)

SafenSoft (SnS)

SafenSoft delivers high-efficiency, low-impact proactive protection against malware, insider threats, and confidential data leakage.

Signal Sciences

Signal Sciences

Signal Sciences Web Protection Platform (WPP) provides comprehensive threat protection and security visibility for web applications, microservices, and APIs on any platform.

Epati Information Technologies

Epati Information Technologies

ePati Information Technologies is a specialist in information technology and cyber security.

Ironhack

Ironhack

Ironhack provide intensive training courses & bootcamps in Web Development, UX/UI Design, Data Analytics & Cybersecurity.

Matrium Technologies

Matrium Technologies

Matrium Technologies has been a leading provider of technology solutions since 1991, with a strong industry background in Network Testing, Network Visibility and Security.

TheGreenBow

TheGreenBow

TheGreenBow is a trusted VPN software company. We help organizations and individuals become cyber-responsible. For this, we design and develop reliable and easy-to-use solutions.

Goldilock

Goldilock

Goldilock is redefining how sensitive data, devices, networks and critical infrastructure can be secured.

Blackpanda

Blackpanda

Blackpanda is Asia’s premier cyber security incident response group, hyper-focused on digital forensics and cyber crisis response.

Harrison Clarke

Harrison Clarke

Harrison Clarke is a leading staffing and recruiting firm in the Cloud, Cybersecurity, Data & AI space.

WBM Technologies

WBM Technologies

WBM Technologies is a Western Canadian leader in the provision of outcomes-driven information technology solutions.

Resmo

Resmo

Resmo is an all in one platform for SaaS app and access management for modern IT teams.

Cyberlocke

Cyberlocke

Cyberlocke is dedicated to finding inventive solutions to meet the distinct IT obstacles of each organization we support.

Relyance AI

Relyance AI

Relyance AI - One unified platform for privacy, security, & governance.

Auria

Auria

Auria advances complex space, missile, and cyber operations with visionary solutions and software.