Loading threat actor…
Lying Pigeon is a Russian-speaking influence operation actor focused on Moldova’s political environment. The group is known for information operations designed to shape public opinion during election periods, including campaigns tied to Moldova’s 2024 presidential election, EU referendum, and the 2025 parliamentary election cycle. Its operations have used spoofed emails, forged documents, and coordinated defamation themes to amplify anti-European narratives and undermine pro-European political leadership, including the ruling Party of Action and Solidarity and President Maia Sandu. Lying Pigeon has been associated with Operation MiddleFloor and subsequent waves of election-focused activity. The actor’s tradecraft, as reflected in available reporting, is centered on spoofing and influence-oriented deception rather than conventional network intrusion or ransomware activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Influence/disinformation operations targeting Moldovan elections using spoofed emails, forged documents, and coordinated domain infrastructure to spread anti-EU narratives and defamation content.
Russian-speaking influence/disinformation operator targeting Moldovan elections and other European political events using spoofed emails, forged documents, and coordinated domain infrastructure for propaganda/defamation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.