Made in Hanoi, delivered to Romania

On February 8, 2024, 18 pages were created on the same day, with different areas of activity: 9 in Health and Beauty, 6 in Grocery Stores, and 3 in Musicians and Bands. All had apparently independent profiles with no visible connection between them. The names and profile pictures suggest Vietnamese identities.

Link to the full report - HERE.

The same signature appears on another 153 similar pages, created between July 21, 2021 and April 4, 2024, part of the same wave of fake accounts. The pace of page creation is not uniform: the majority of pages appeared in concentrated bursts in January and February 2024.

These are just 35 accounts out of 170 discovered in total. 

At a first glance, nothing unusual. Niche pages, local content, with no visible connection between them. But the network analysis reveals something different. These profiles do not operate independently — they coordinately follow the page of the Partidul Mișcarea România Suverană (Sovereign Romania Movement Party). Their role is to amplify this content through follows, creating the impression of organic popular support.

The Sovereign Romania Movement is a political formation established in 2024, with the support of Liviu Dragnea, the former leader of PSD. The party was initially led by Carmen Dan, the former Interior Minister, who took over the leadership in April 2024. At present, the party is led by Alexandru Oprea, who served as President of the Dâmbovița County Council and was a former PSD member. The party was validated by the Central Electoral Bureau for the June 2024 elections.

Stolen identity

The names and profile pictures indicate an apparently Vietnamese origin of the identities, however, as the analysis below shows, many images are stolen from various Asian sources. The actual location of the network's operators cannot be established on the basis of these elements alone.

The most important clue appears at the level of the profile pictures. The account Lê Hương Thi uses a photograph stolen from Lalisa Manobal, known as Lisa, a singer, dancer, and fashion icon from Thailand. The original photograph was published by Lisa on her official Instagram account, followed by 105 million people, and its theft shows how simple it is for network operators to construct credible identities without any real effort.

The second account, Ngô Thảo Linh, repeats the same pattern. The profile picture was taken from manttien, a Vietnamese influencer. The choice of a real person with an active online presence makes the fake profile appear authentic upon first inspection.

Furthermore, manttien's profile picture was also found on a TikTok channel called haboraostudio, which posts videos about baseball and has 19,500 followers and 156,200 likes. The reappearance of the same image across different platforms shows that the network's operators reuse the same set of stolen photographs, without bothering to seek out new sources for each account.

The pattern repeats itself: false identities, built on stolen images, used to lend credibility to pages specifically designed to amplify political messages.

This pattern is not new to the Romanian informational space. A Public Record investigation from November 2025 had already identified a similar phenomenon: over 130 accounts with Vietnamese names were following the activity of politician Anca Alexandrescu on Facebook, many of them using stolen identities or automatically generating messages through artificial intelligence. The network analysed below shows that this type of operation was not isolated, but was repeated and redirected toward a different political subject. 

Where do the party's messages go?

In order to access the network analysis, access the link here.

The most shared 80 clusters address the following topics

We analysed which groups the party's 13 posts were shared into during the period December 2024 – June 2026. Most frequently, the posts reached the party's supporter groups and those of its county or local branches.

In addition to these, two Facebook pages and several accounts consistently shared the party's posts into nationalist groups and into several groups of Liviu Dragnea supporters (here, here, here). The party's messages also reached groups of sympathisers of Călin Georgescu, Anca Alexandrescu, and the sovereigntist movement in general.

From January 2026, the systematic distribution of posts into Facebook groups was carried out by two satellite pages: România Suverană and Mișcarea Suverană România Poiana. The latter was created in 2022, under the original name Alianța Pentru Patrie Poiana, the local branch of another party linked to Liviu Dragnea.

Not all of the fake accounts originated from Hanoi. Several of them have Romanian names and share the same surname and the same profile picture: Rodica Matei, from Craiova, and Gianina Matei, from Bucharest. For a brief period, the two used the identity of the same girl, with minor adjustments. From January 2025, their accounts shared the party's posts into groups of members and sympathisers, but also into support groups for Liviu Dragnea, Călin Georgescu, and Anca Alexandrescu, as well as into diaspora communities.

Another account, Maria Matei, kept people in several sympathiser groups informed about the party's activity, using the photo of a former Egyptian TV presenter, Doaa Salah Dody.

In total, 13 accounts disseminated 13 posts into 279 different groups, in some cases multiple times, reaching 921 reshares of these materials. Among the most prolific accounts is "România Suverană," which shared 4 posts to 101 groups, with a total of 243 reshares, followed by "Lica Sac," which shared 5 posts to 89 groups, with a total of 232 reshares. Another notable case is that of the account "Daniela Pîrvu," which shared 2 posts to 69 groups, with a total of 78 disseminations.

These behaviours are similar to the information poisoning phenomena documented by organisations such as VIGINUM, used in the public sphere for more than 10 years.

We invite you to explore the dataset in the graph above: accounts are represented in blue, and groups in orange. You can explore the network by interacting with the nodes or the links between them.

Why is this phenomenon harmful 

It is important to note that the data visualised above represents only a sample of a much broader phenomenon — the "tip of the iceberg." Any post, from any account, can be artificially reshared at any moment to flood the information space and create the impression of organic support. Moreover, when relevant events appear on the public agenda, such as the drones at Galați and Constanța, social media algorithms show us recommended content, and these mechanisms remain vulnerable to such tactics.

The use of fake accounts for artificial amplification is not merely a technical problem, but one that directly affects the way people perceive reality.

Firstly, fake accounts distort the perception of a party's real support. A page that appears to have thousands of organic likes may in fact have been artificially boosted by a network of coordinated accounts. Citizens who see this "popular" support may be influenced into believing that a political option has a broader base than it actually does.

Secondly, these networks erode general trust in online information. When people discover that some of the content they see is fabricated, they tend to become sceptical of everything, including legitimate sources and pages. This effect makes it more difficult to distinguish between genuine public debate and manipulation.

Thirdly, there are real victims of these tactics, because the bots have stolen the images of multiple individuals. But the other people whose photographs were used also did not consent to being associated with the political messages of a Romanian party.

Fourthly, these networks can influence concrete electoral processes. If a political page is artificially amplified just before elections, this can distort voters' perceptions during the most sensitive period of a campaign.

Finally, the persistence of these networks also points to a problem of platform accountability. The accounts and pages documented here have operated for months, in some cases years, without being removed, even though their behavioural patterns — identical posts distributed simultaneously to dozens of groups, stolen identities, duplicate profile pictures — are detectable. Social media platforms have the technical tools necessary to rapidly identify and remove such coordinated networks. The absence of a prompt response on their part allows these tactics to operate unhindered and effectively transfers the cost of moderation to users, researchers, and journalists.

Under Article 35(1) of the Digital Services Act, very large online platforms are obliged to put in place reasonable and effective mitigation measures against the systemic risks identified under Article 34, among which point (b) explicitly provides for the adaptation of moderation and algorithmic systems to counter manipulation of the service and inauthentic behaviour. The persistence of these networks for months or years, despite detectable indicators, raises legitimate questions regarding the effectiveness of these mitigation measures.

This material is funded through the Tech Accountability Grants 2026 Programme of the European Fact-Checking Standards Network (EFCSN), under the CERV grant (no. 101236606) awarded by EACEA.

The views and opinions expressed in this material belong exclusively to the authors and do not necessarily reflect the position of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor the funding authority can be held responsible for them.