Isolationist, far right politician George Simion emerged as the frontrunner in the first round of Romania’s rerun presidential election, held on May 4, 2025, following the unexpected annulment of the previous vote due to foreign interference.

Simion secured 40.96% of the vote in the first round of the Romanian elections, and will face independent centrist Nicușor Dan, the mayor of Bucharest, who received 20%, in a run-off scheduled for May 18. This vote followed the annulment of the November 2024 election, which was invalidated due to alleged foreign interference, with a modus operandi described by the state authorities as including "cyberattacks and coordinated disinformation campaigns” (CSAT SRI II).

Unionist in the relationship Republica Moldova - Romania, Simion is very little voted in Republica Moldova. More than that, he has an active ban of entering into the country for attempts of "destabilising the state”, as explained by the Moldovan prime-minister Recean (Buruiană, 2025). Simion has contested the Moldovan ban, and a court verdict is expected in mid-May. Simion is banned from entering Ukraine on official reasons of "systematic anti-Ukrainian activities” (Mihai, 2024).

Simion has repeatedly expressed loyalty to Georgescu, a pro-Russian figure, with an anti-NATO and an anti-EU discourse. To secure the support of Georgescu’s voters, Simion has pledged to nominate Georgescu as prime minister if elected (Pândaru, 2025). 

George Simion and Călin Georgescu were political rivals during Romania's annulled November 2024 presidential election. In that first round, Georgescu, running as an independent, secured approximately 2.12 million votes (22.94%), while Simion, representing the Alliance for the Union of Romanians (AUR), garnered about 1.28 million votes (13.86%). The election was later annulled due to allegations of foreign interference of a "state actor" favouring Georgescu. 

Despite their early criticism, in the 2025 re-run, Georgescu's figure brought significant votes to Simion, twice than he got himself in the first round. To attract his votes, Simion has repeatedly expressed loyalty to Georgescu, a pro-Russian figure, with an anti-NATO and an anti-EU discourse. To secure the support of Georgescu’s voters, Simion has pledged to nominate Georgescu as prime minister if elected. (Pândaru, 2025). 

While Georgescu appeared rarely in the mainstream media, before November 2024, Simion had a long history of controversies covered by Romanian and foreign newsrooms, as a party leader. In fact, Simion was a constant subject in the media, as his far right party entered the Parliament in 2020 and in 2024 became the second largest political group, after the Social Democrats. Some of these controversies are linked to Russia. For example, Simion was accused of ties with Russian intelligence, by a former Moldovan official. Anatol Șalaru, former Minister of Defence of the Republic of Moldova, publicly stated that Moldova's Intelligence and Security Service (SIS) "had informed authorities that Simion held meetings in Chernivtsi with Moscow agents” (Ziarul de Gardă, 2025).

Simion denied these allegations and filed a defamation lawsuit against Șalaru, which the far right leader lost in the first court ruling (News.ro, 2025). For Georgescu, there are no public evidences of direct ties to representatives of Russia or of any other foreign state yet. A key factor behind the collapse of the 2024 elections was the interference of state and nonstate actors, performing an array of digital attacks, including the widespread use of coordinated inauthentic behavior on social media, as revealed in declassified documents presented to the Supreme Council of National Defense - CSAT (Presidential Administration, 2024). [All the five declassified reports can be accessed in Romanian here]

"Romania is a target for hybrid aggressive actions, including cyber attacks, hacks, leaks, sabotages”, one of these documents announced (CSAT - SIE, 2024). The metric analysis revealed an abrupt rise between 13 and 26 November 2024, that pushed Călin Georgescu on 9th place globally in video trends associated with certain hashtags; artificially amplification was noticed on TikTok Tok after 24 November 2024, with an explosion of hundreds of million views after the first round of elections (CSAT - MAI, 2025). In 2025, on the rerun election day, Romanian government websites and an online platform affiliated with a pro-Western candidate were targeted by Russian hackers.

This reminds of the previous interference in Romanian elections from state actors, described by the Romanian services report SRI-CSAT (2024). Over 85,000 cyber-attacks were launched from 33 countries "aimed at exploiting existing vulnerabilities in the IT systems supporting the electoral process, in order to gain access to data in the IT systems, alter their integrity, change the content presented to the general public and make the infrastructure unavailable.” (CSAT SRI, 2024).

In both occasions, the Romanian cyber infrastructure resisted the attacks. In the same context, SRI's analysed the electoral campaign of the candidate Călin Georgescu: "The activity of the accounts [in the case of the candidate Calin Georgescu] would have been coordinated by a state actor, who would have used an alternative communication channel to spread messages on the platform”. "The activity was coordinated from various geo-locations" and operated not through bot farms, but "more discreetly from outside to avoid violating platform usage policies".  TikTok considers that, in practice, they are coordinated volunteers (a mass guerrilla political campaign or brute force attack in cybersecurity). The dissemination of messages on the TikTok platform was done in swarming.”  

Evidences documented by the Romanian state authorities: the "foreign state actor"

The Romanian Constitutional Court's (CCR) decided, through the Decision no. 32/2024 to annul the presidential 2024 elections and to rerun the whole scrutiny. The reasoning of the decision references five intelligence reports, which include elements of foreign meddling in the electoral process. 

Specifically, the reasoning in the CCR's Decision No. 32 of 6 December 2024 (p.3) references five declassified reports provided by the Romanian Intelligence Services (CSAT - SIE no. DSN1/1740/4.12.2024, no. CSAT - MAI DSN1/1741/4.12.2024 , no. CSAT SRI I DSN1/1742/4.12.2024, CSAT SRI II no.DSN1/1743/4.12.2024, CSAT STS no. DSN1/1701/2.12.2024). [All the links can be also found in the press-release of the Presidency.

What the Decision of annulment  reads: 

• The Court finds that the electoral process concerning the election of the President of Romania was marred throughout its conduct and at all stages by multiple irregularities and breaches of electoral law which distorted the free and fair nature of the vote cast by citizens and the equality of opportunity of the electoral contestants, affected the transparent and fair nature of the electoral campaign and disregarded the legal regulations on its financing. All these aspects had the converging effect of disregarding the essential principles of democratic elections.
• The electoral campaign of one candidate "disregarded the legal regulations on its financing".
• The social media platforms were flooded with unmarked electoral advertising of Calin Georgescu, massively distributed a few days before elections and during the election day (which is forbidden by the electoral legislation), while he registered zero costs at the Electoral Authority.
• Based on the five declassified five reports presented, the Romanian Constitutional Court found "multiple irregularities" and "breaches of electoral law which distorted the free and fair nature of the vote, which have distorted the free and fair nature of the vote cast by citizens and the equality of the electoral contestants, affected the transparent and fair character of the electoral of the electoral campaign and disregarded the legal regulations concerning its financing." (CCR Decision 32/6 Dec 2024, p. 3). 
• The main findings of the CSAT - SRI report (part of the Motivation of the annulment decision of the Constitutional Court).

- State-Sponsored Cyber Actor on IT&C Infrastructure;

- Over 85,000 cyber-attacks identified;

- Computer systems from more than 33 countries were used to launch the attacks

 - Călin Georgescu's campaign would have been coordinated by a state actor;

"the activity was coordinated from various geo-locations" and operated not through bot farms, but "more discreetly from outside to avoid violating platform usage policies".  

CSAT - SRI DSN1/1743/4.12.2024  indicated:

• Actions of a State-Sponsored Cyber Actor on IT&C Infrastructure Supporting the Electoral Process, hosted by the Permanent Electoral Authority (AEP) and the Special Telecommunications Service (STS)
• Using specific methods, on November 24, 2024, the Romanian Intelligence Service (SRI) obtained information regarding the publication of access credentials associated with bec.ro (the Central Electoral Bureau), roaep.ro (Romanian Permanent Electoral Authority), and registrulelectoral.ro (Electoral Registry) on cybercrime platforms of Russian origin.
• Similar data were also identified on a private Telegram channel known for disseminating exfiltrated data from numerous countries, with the exception of the Russian Federation.Following the initiated investigations, it was determined that the data exfiltration occurred either by targeting legitimate users to whom the credentials (username/password) were distributed or by exploiting the legitimate training server provided by STS at https://operatorsectie.roaep.ro. These posts were made after November 19, 2024, a cyber incident targeted and affected AEP's IT&C infrastructure, where cyber attackers compromised a map server (gis.registrulelectoral.ro), connected both externally to the internet and to AEP's internal network.
• In this context, a high number of cyber-attacks (over 85,000) was identified, which were aimed at exploiting existing vulnerabilities in the IT systems supporting the electoral process, in order to gain access to data in the IT systems, alter their integrity, change the content presented to the general public and make the infrastructure unavailable.
• The attacks in question continued in a sustained manner, including on election day and the night after the elections (25.11.2024). Computer systems from more than 33 countries were used to launch the attacks, using advanced anonymization methods to make the attribution process more difficult.

 

• "The modus operandi and the scale of the cyber campaign lead to the conclusion that the attacker has considerable resources, coupled with a specific modus operandiof a state actor.”

CSAT SRI report II DSN1/1743/4.12.2024, p. 2

• "The activity of the accounts [in the case of the candidate Calin Georgescu] would have been coordinated by a state actor, who would have used an alternative communication channel to spread messages on the platform. It doesn't use bot farms, but operates more discreetly from outside to avoid violating platform usage policies. The growth of the accounts was not organic (similar to viral events that occur organically), so TikTok considers that, in practice, they are coordinated volunteers (a mass guerrilla political campaign or brute force attack in cybersecurity). The dissemination of messages on the TikTok platform was done in swarming.

CSAT SRI report I (DSN1/1742/4.12.2024):

The document generally describes how "the candidate Calin Georgescu benefited from an aggressive promotional campaign, carried out in circumvention of national electoral legislation, as well as the exploitation of the algorithms of some social media platforms to increase the popularity of Călin Georgescu at an accelerated pace." 

| "Use of TikTok to increase the notoriety of Călin Georgescu: His ascent in the opinion polls was determined by a coordinated campaign to increase his popularity, amplified 2 weeks before the polling date, in particular on the TikTok platform, which managed to ensure his victory in the first round with 22.94%." (DSN1/1742/4.12.2024, p. 1)

The same report (p. 3 and p.6) makes an indication to Sputnik: "Tik Tok said it had identified a potential network of accounts involved in manipulating public opinion in an electoral context, as well as a network of accounts affiliated with the Russian publication Sputnik, which targeted users in Romania and Moldova" and to "FA Agency, through which influencers were paid 1000 euro each.

"Regarding the FA agency, subsequent investigations by foreign media revealed potential links of this marketing agency to Russia.  "Elections in Romania. The marketing agency had links with Russia and offices in Warsaw" headlined the Polish publicationOKO.press (2024). An article inLe Monde is also relevant on the topic.SIE report, 2024The report of SIEDSN1/1740/4.12.2024describes Russia's modus operandi in various EU countries, and its conclusions are based on behaviour observed in 2024 European elections. 

At the Kremlin's behest, detailed sociological research has been carried out in the target countries to see what the trends in public opinion are, and the political perspectives of the candidates. They also studied the breaches, vulnerabilities, response capacity of the targeted countries. The report SIEDSN1/1740/4.12.202 identifies:informational aggression, including propaganda, and the use of the AI technologies for rapid use of content creation. constant efforts to target large categories of audiences (various dissemination channels, from official vectors, local influencers and trolls network), diversification of the techniques of spreading (pro)Russian narratives, with a focus on the local dissemination (coordination of the messages, the increase of the quantity and quality of the multimedia content, including through AI, creating hashtags and hacking others high interest in supporting the pro-Russian, far right, anti system candidates. In Kremlin’s vision, the European far right is receptive towards Moscow and is on ascending popularity trends.

Russia flooded the information space with divisive and supportive narratives of vectors (persons or political parties) with visions close to the Kremlin (extremists, nationalists, populists, anti-Semitic political figures).To achieve its goals, Moscow created and strengthened extensive online networks, support groups that later functioned as vectors for promoting Russian narratives, with a focus on local opinion makers with Eurosceptic visibility and views, with which they fed conspiracy theories, smeared inconvenient candidates, and took statements by European officials out of context. 

Moscow's objective was, among other things, to "exploit the passivity of the authorities in order to force breaches in public opinion", undermine confidence in the authorities, and increase fears of war. (Source: CSAT SIE DSN1/1740/4.12.202)

Context: the interesting case of Republica Moldova

The intelligence from Republica Moldova has recently published well documented reports on concrete actions of identifying Russian operations. Those describe the Russian operations on the territory of Republica Moldova, during the Moldovan elections and referendum with concrete data. 

The Moldovan authorities took strict measures in limiting Russian disinformation, and propaganda operations. 

In the rerun 2025, the vast majority (over 85%) out of the 90,851 participants voted for pro-European candidates, while 12.47% voted for George Simion (Popa, 2025). Interestingly, in the Republic of Moldova, a record number of people participated in 2024 November elections, 80,939 with Romanian citizenship, which massively voted for pro-European candidates and marginally for extremists: 3,98% George Simion, 3,11%, Călin Georgescu (Călugăreanu, 25.11.2024).

References 

Călugăreanu, V. (2025, May 6). They saved Romania so that Romania could save Moldova. DW.https://www.dw.com/ro/au-salvat-rom%C3%A2nia-pentru-ca-rom%C3%A2nia-s%C4%83-salveze-r-moldova/a-70880866

Popa, B. (2025, May 5). Presidential election results 2025, first round – Republic of Moldova: Nicușor Dan obtains over 52% of the votes. Mediafax. https://www.mediafax.ro/politic/rezultate-alegeri-prezidentiale-2025-turul-i-republica-moldova-nicusor-dan-obtine-peste-52-din-voturi-23547805

Romanian Constitutional Court. (2024, December 6). Decision No. 32/2024 regarding the annulment of the electoral process for the election of the President of Romania [PDF]. Monitorul Oficial al României, Part I, No. 1231. https://www.juridice.ro/wp-content/uploads/2024/12/Textul-integral-al-Hotararii-Curtii-Constitutionale-a-Romaniei-nr.-32-din-6-decembrie-2024-privind-anularea-procesului-electoral-cu-privire-la-alegerea-Presedintelui.pdf