Documents declassified by Romania's security council on December 4 said the country was the target of an "aggressive hybrid Russian action" during recent election campaigns, including last month's surprise victory of a pro-Russian far-right candidate.

The Supreme Council of National Defense declassified the documents, saying they showed that Romania was the target of various coordinated actions leading up to the presidential election's November 24 first round, won by Calin Georgescu, Radio Free Europe writes.

It had already been reported that TikTok was used to generate support for Georgescu and connect him to a Romanian audience in the millions. But the declassified documents show that Romania's intelligence service believes that Georgescu was massively promoted on TikTok with backing from Russia through multiple methods, including coordinated accounts, algorithms to boost his presence on the platform, and paid promotion.

The documents help explain how Georgescu's popularity increased from 1 percent shortly before the race to 22 percent artificially, through a vast operation of manipulation that involved influencers and ensnared Romanian institutions as well as ordinary voters.

Some 25,000 TikTok accounts allegedly used to increase Georgescu's popularity "became very active two weeks before the date of the elections," according to the declassified documents.

About 800 of these accounts [which were created in 2016 which means they were registered from China - Ed.] had extremely low activity until November 11. From that date onward "the entire network was activated at full capacity," and generated tens of millions of views until election day, according to the documents.

The intelligence service documents also show that influencers on TikTok were recruited to promote Georgescu directly by publicly supporting him and indirectly through neutral messages that contained labels associated with him.

Another method used to promote the independent candidate involved the creation of accounts that falsely represented institutions of the Romanian state.

These fake accounts had supportive posts for Georgescu, presenting the false notion that these state institutions supported him.

In addition, Georgescu's posts were not marked as belonging to a candidate, and this favored their mass dissemination. Other candidates whose posts were labeled as belonging to a candidate had a diminished online presence.

Romania's intelligence services hinted that large sums of money would have been spent in the operation. Georgescu, according to information revealed in the declassified documents, declared to Romanian electoral authorities that he spent nothing on his campaign.

The intelligence service linked the operation to Russia by noting that access data for official Romanian election websites was published on Russian cybercrime platforms. The access data was probably procured by targeting legitimate users or by exploiting the legitimate training server, the intelligence service said.

It added that it had identified more than 85.000 cyberattacks that aimed to exploit system vulnerabilities.

On Saturday, $7 million were reportedly seized from the home of crypto entrepreneur, 36-year-old Bogdan Peșchir, best known by his TikTok handle “bogpr” for handing out bundles of cash to fellow creators. He made headlines for allegedly sending $381,000 to various TikTok accounts that relentlessly promoted Călin Georgescu, protos reports.

Peșchir is now suspected of spending €1 million financing Georgescu’s campaign with criminal, money-laundered funds.

However, Peșchir insists his donations were independent and not tied to any agreements. He emphasized his support for Georgescu was voluntary and accused the media of harassment — even threatening to sue.

Authorities are also concerned that Peșchir’s declared income is inconsistent with his luxurious lifestyle, which includes driving a Porsche and a BMW. The TikToker denies this, saying “I have income from other sources, completely legal, that are declared and taxed.”

As for the accusations of financing Georgescu’s controversial rise, he maintains that he did nothing wrong. “I don’t even know [Georgescu] personally,” Peșchir said, “and I don’t feel that endorsing a cause that I support is unethical.”

Late on Monday, Georgescu struggled to explain his ties with a mercenary group’s leader, a former member of the French Foreign Legion, Horatiu Potra, after pictures emerged of the two men meeting. After initially denying that he knew Potra, he conceded that the two had had contact — but not recently, Bloomberg writes.

Judges on Tuesday imposed restrictions on Potra’s travel and ordered him to check in with police, though stopped short of detaining him. He’s being investigated for weapons possession and certain social media posts, Potra’s lawyer, Serban Moga, said.

Some influencers who supported Georgescu on TikTok immediately posted videos announcing they were either at the Bulgarian border or on planes, leaving Romania permanently after the elections were annulled. These influencers initially supported Georgescu after being paid but later distanced themselves from him following the declassification of official CSAT (Supreme Council of National Defense) documents.