Operation Undercut
Operation Undercut is a Russia-linked influence operation attributed by Insikt Group to the Russian company Social Design Agency (SDA) and assessed to have likely been active since at least December 2023. The operation has targeted European audiences, including Moldovan social media users ahead of Moldova’s September 28, 2025 parliamentary elections and German audiences during the 2025 federal election cycle. In Moldova, Operation Undercut was described as part of a broader effort to undermine President Maia Sandu, the ruling Party of Action and Solidarity (PAS), election integrity, and Moldova’s EU accession path. It promoted anti-Sandu, anti-PAS, anti-European integration, and pro-Kremlin narratives, including claims designed to condition audiences to expect rigged elections in favor of PAS, fear war with Russia, and worry about inflation, agricultural collapse, and child-welfare costs. Insikt Group identified anti-PAS and anti-Sandu TikTok activity in Romanian in early June 2025 and attributed it to Operation Undercut, marking activity on TikTok noted for the first time in the provided content. The operation used TikTok accounts impersonating Moldovan or Romanian-speaking individuals, including Bella Popescu, dorinrobu5, Gergely Dezir, and moldova457u, and videos created with CapCut and likely VEED Gen-AI avatars named Aisha, Elena, and Marcus; one post calling on Maia Sandu to resign received more than 113,000 views. In Germany, the network continued posting German-language content supporting Alternative für Deutschland (AfD) and undermining Chancellor Olaf Scholz. More broadly, reporting describes Operation Undercut as one of several longstanding, at least partially Kremlin-funded influence networks targeting major European allies. Its objectives almost certainly include inciting domestic socio-political conflict, polluting the information space with manipulated content, fostering criticism of the United States, the European Union, and European integration, and undermining NATO cohesion. The operation has been described as posing as real news organizations to increase credibility.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇲🇩 Moldova
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russia-linked influence operation targeting European audiences; grouped with other campaigns that impersonate media outlets to push Kremlin-aligned narratives.
Russian influence operation likely conducted by the Social Design Agency to target Moldovan audiences with anti-PAS, anti-Sandu, anti-EU messaging, especially on TikTok and other social platforms, while conditioning audiences to expect election fraud and fear war and economic collapse.
Russia-linked influence operation posting German-language content to support AfD and undermine Chancellor Olaf Scholz; also described as posing as real news organizations to increase credibility.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.