Lying Pigeon
Lying Pigeon is a Russian-speaking threat group assessed by Check Point Research (CPR) to conduct influence operations targeting Moldova’s election cycle. CPR reported the group ran “Operation MiddleFloor” ahead of Moldova’s October 2024 presidential elections and EU referendum, using spoofed emails and forged documents to spread anti-European narratives. CPR further reported a new wave of activity since mid-April 2025 aimed at Moldova’s September parliamentary elections, including a late-May 2025 defamation campaign leveraging over a dozen domains to promote an anti-PAS (Party of Action and Solidarity) poster contest targeting Moldova’s ruling PAS and President Maia Sandu.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇲🇩 Moldova
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Influence/disinformation operations targeting Moldovan elections using spoofed emails, forged documents, and coordinated domain infrastructure to spread anti-EU narratives and defamation content.
Russian-speaking influence/disinformation operator targeting Moldovan elections and other European political events using spoofed emails, forged documents, and coordinated domain infrastructure for propaganda/defamation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.