Nearly 150 fake bomb threats have “hit” Moldova since the beginning of the year, targeting no fewer than 885 locations. Authorities are informed about the bombing of public or private institutions either by e-mail, using encrypted messaging services, or by phone.

Callers who report the presence of explosive substances in certain locations are caught by the police shortly after the calls are recorded. They are Moldovan citizens and usually call while under the influence of alcohol and later regret the act. ZdG has identified and analysed the profiles of some of those who have issued false bomb threats by phone in recent months.

The email alerts, the authors of which are much more difficult to trace, are all in Russian and have various messages that often contradict each other. In these cases, all traces of the authors lead abroad. In January, when the first wave of e-mail bomb alerts began in Moldova, police identified a minor from a village in Gagauzia who admitted he was part of an international group that was issuing several bomb alerts in countries in the region. “He’s an ordinary kid, like everyone else, but he probably prefers to stay on the internet more than others. He got carried away and went down the wrong line,” his headmistress describes him.

January 2022: The first wave of false bomb scares

18-21 January 2022. Several messages arrive on the government e-mail addresses of state institutions in Ceadir-Lunga, Vulkanesti and Comrat, announcing the placement of explosive devices in several locations with a high flow of people. All messages were sent via the ProtonMail platform, an encrypted email service designed to protect the identity of those using it.

ZdG analysed some of the messages sent at that time to the email addresses of the Ceadir-Lunga Police Inspectorate (IP) or the Police Directorate of ATU Gagauzia. In one of the first messages, the author wrote in Russian: “I am “KRONOS” and I want to announce that I have mined all the streets of the city of Ceadir-Lunga, there are 120 kg of explosives on each street. If the explosives explode, everything will blow up, but there is a chance to avoid the explosion. You must insert this message in the news. Good luck to you all. You have until 12:00.”

In another message, sent from the email address adminkronosa@protonmail.com, the author, who introduced himself with the nickname “FeedSky”, announced that he would mine “all educational institutions in the village of Cazaclia” (a village in Gagauzia) and that he would kill “many people” if his conditions were not met. “I hate the people who pressured me and I decided to take revenge. I have a detonator in my hand and if I press the button, everything will blow up. First condition: my nickname “FeedSky” has to be in all the news. Second condition: Outside the school entrance, at the cleaning lady’s, leave 70 thousand lei. Good luck with the game.”

At the same time, the authorities reported that similar bomb threats had been made in Gagauzia, all via e-mail, announcing that the school in Vulcanesti had been mined, as well as the gymnasium, primary school and cemetery in the village of Baurci, Ceadir-Lunga district.

The first person identified: a minor, whose activity was directed from abroad

21 January 2022. A few hours after a bomb threat was registered by e-mail, the General Police Inspectorate (IGP) and the Intelligence and Security Service (SIS) announced that they had managed to identify the perpetrator: a minor, whose activity was directed from abroad. The police said that he had been “directed by third parties to send false alerts about the mining of several strategic targets in other countries”.

On 6 July, the case against the juvenile was sent to court, accusing him of submitting seven false reports that locations in the south of the republic had been mined. According to the materials in the case file, the teenager allegedly aimed to disrupt the work of state institutions. In addition to the criminal penalty, the authorities have also brought a civil action for the recovery of about 60 thousand lei spent “on mandatory actions to prevent potential consequences of such attacks, carried out by specialised services”.

ZdG found that the minor, who is listed in the case file, is 15 years old and comes from a locality in Gagauzia, which was targeted in the bomb alerts of 18-21 January this year. The authorities found that he was part of a group calling itself “KRONOS”, members of which were active abroad.

“Somehow, through the Internet, they lured the child. They were supposedly giving him tasks and he was doing them.”

In talks with ZdG, people in his home village say that the boy comes from a good family, he is a keen computer student and was allegedly lured into a game where he was shown how to act. Those who don’t know his name call him “взрывник”.

“The boy comes from a semi-superior family with exemplary parents. The boy is good, capable, but, lo and behold, they lured him into some kind of play. That’s what we understood. He got carried away. He alone didn’t understand how he got there,” one woman told us.

Another local woman told us that the boy is fond of computers and was allegedly recruited on the internet. “He’s a capable child, he’s especially good with computers. Somehow, through the internet, they lured the child. Supposedly, there they would give him tasks and he would do them. As far as we know, there was an investigation. Now he has stopped playing, he is studying in the same class,” the woman told us.

The boy’s headmistress says he’s no different from the rest of the students, he just prefers to spend more time on the internet.

“He is an ordinary child, but with a special passion for computers. With all the technology now, he has made mistakes and now he is suffering. He’s suffering and so are his parents. He’s an ordinary child, like everyone else, but he probably prefers to be on the internet more than others. We talked to him. He got carried away and took a wrong turn. I’m sure he realizes what he’s done. He regrets it and is now trying to correct it,” the teacher told us.

11 March: Russia-Belarus joint operation: members of the “Kronos” group detained

After identifying the minor from Gagauzia, the authorities in Chisinau sent to the law enforcement bodies of the Russian Federation and the Republic of Belarus the information about the IPs of the devices that were identified as a result of special investigative actions. Data obtained by ZdG show that neither the Russian nor the Belarusian authorities have informed the Chisinau authorities about the measures taken. What is certain is that shortly afterwards, on 11 March 2022, the Belarusian authorities announced that they had detained several members of the so-called “KRONOS” group as a result of a joint operation with the Ministry of Internal Affairs of the Russian Federation and the Federal Security Service of the Russian Federation.

“It all started as a childish joke on some teenage forums, but things escalated. Members of this group started acting on command, for a fee. These hackers were announcing that they were undermining certain targets, which would create problems for certain characters who were of a different political persuasion from those who paid them to make these bomb threats happen,” said Andrey Kovalev, head of the Main Directorate of the Ministry of Internal Affairs of the Republic of Belarus.

The Belarusian authorities have released video footage of the raids and interviews with the detainees who admitted their guilt. “We sent out alerts to schools and shopping centres. We made more than 30 such alerts,” said one of the youths.

At the same time, according to Belarusian officials, the anonymous hacker group “KRONOS” is believed to have started its activities in 2020 in Belarus and is composed of several students. The bomb alert messages were sent via secure email networks. The Russian state agency, referring to a Russian official, said the group had two leaders, both aged 16, from Moscow and Vitebsk.

148 bomb threats in 2022. 124 of them in July-August

In Moldova, false bomb alerts stopped in January after the detention of the minor in Gagauzia, but picked up again in July. Data presented by the IGP shows that while 24 false bomb alerts were registered between January and June 2022, nine of them in January, in July and August the number “exploded”, with no less than 124 alerts registered by Wednesday 24 August.

In total, from the beginning of this year to Wednesday 24 August, Moldova was the target of 148 false bomb threats, targeting no less than 885 locations. Of these, 114 alerts were sent by e-mail, and the others – by telephone.

August 16 alert: Author says he’s part of the “Dirlewanger Brigade”

As in January, the fake bomb alerts emailed in July and August are written in Russian and the authors’ messages are diverse. In one of the most recent e-mails, dated 16 August, sent to the “Air Moldova” company and the Criminal College of the Supreme Court of Justice, the author, who calls himself the “Almighty Magister” and who presents himself as being from the “Dirlewanger Brigade” organisation, referring to Oscar Dirlewanger, a former military officer and German war criminal who was the founder and commander of the Nazi SS criminal unit “Dirlewanger” during the Second World War, accused the citizens of the Russian Federation of “committing a crime”. Moldova for being too “tolerant” and threatened that he would personally kill all pro-Russian officials in Moldova unless “a few bitcoins” were sent to the address he gave.

In another message, dated 23 August, sent to other state institutions, the author, who calls himself Maxim Grimak, identifies himself as being from the Transnistrian region. He praised Russia and announced that “our special services have mined Chisinau airport, all shopping centres, the Parliament…”. He calls on Moldova to recognise the independence of the Transnistrian region and to renounce integration into the EU and NATO.

Fake alerts ‘hardened’ with Russian and Ukrainian IPs

Because there were several similarities between the messages sent by the minor from Gagauzia in January and the bomb alerts in July and August, he was among the first targeted by law enforcement officials in the criminal case opened and investigated by the Prosecutor’s Office for Combating Organised Crime and Special Cases (PCCOCS).

“In July, we searched this boy’s house. It is not clear who and how gave him directions in January. We are now examining whether he has anything to do with the wave of false alarms that started in July. No version is excluded, but in this case, he does not have the procedural state,” prosecutor Maxim Motînga, one of the state prosecutors investigating the false bomb alarms case, told ZdG.

“The letters with the false communications are sent using IPs from abroad. We have from Russia and Ukraine. One of the IPs used is from Ukraine. From Belarus, we have no official data that it is. In order to establish the users of some IP addresses, at the end of July, we sent letters rogatory to the Russian Federation and at the beginning of August to Ukraine. The investigation is complicated. For example, we can establish the IP of the person who sent the message, but there is no certainty that it is his IP. He can use any IP, using VPN,” the prosecutor told us.

• *VPN – Short for Virtual Private Network. When a person is connected to a VPN, their internet activity is encrypted and their real IP address is masked. No one can see who that person is or what they are doing, not even ISPs, governments or hackers.

Who are the authors of phone bomb alerts

Email bomb alerts are the hardest to trace. Phone alerts are usually not a problem, and the authorities almost always manage to catch the perpetrators within hours of the crime. ZdG checked out some of the most recent fake phone bomb alerts, identified the people behind them and verified their activity.

13 July 2022. 03:41. Via a 112 call, an unknown caller reports that Moldovan President Maia Sandu’s home is mined. The caller turned out to be a 37-year-old man. ZdG found that in 2015, this man was tried for hooliganism. In a ruling by the Cahul Court, he was acquitted of criminal responsibility on the grounds that he acted “in a state of irresponsibility” and was admitted to the IMSP Clinical Psychiatric Hospital in Chisinau. At the end of the six-month period set by the court, the general director of the hospital requested an extension of the measure, citing “the existence of social danger in the event of his release”, as he had been diagnosed with “progressive paranoid schizophrenia with under-compensated mixed defect”. The man spent a year in a psychiatric hospital.

23 July 2022. 15:11. A 112 call from an unknown caller again reports that the President’s home is being mined. The perpetrator, aged 64, was detained the same day. The ZdG found that the man was sentenced to one year in prison for a similar offence in March 2021, with his sentence suspended for a probationary period of three years. At the time, being in a drunken state, he alerted the police saying that an explosion caused by a grenade was about to take place in the premises of the Metropolitan Cathedral “Nativity of God” in Chisinau. During the hearings, he did not admit his guilt, but said he was sorry for his actions and that he “just wanted to stop the church bell ringing and allow him to pray in the church”.

July 26, 2020. 3:20 a.m. Through a phone call to 112, an unknown person reported that Chisinau International Airport is mined. The perpetrator, aged 20, was detained shortly afterwards and was found to be intoxicated when he made the call. ZdG found out that the young man comes from a socially vulnerable family in Fuzăuca, Soldănești district. The young man, left without parents since childhood, was brought up by his grandmother, and lately lived with a concubine. Recently, the two separated. According to the local mayor, the young man was “emotionally disturbed” by this event and had recently started drinking a lot of alcohol. “The boy was in depression, I think this forced him to do this stunt. In addition, from what I hear, he has been drinking a lot lately,” said the mayor of Fuzăuca. His name also appears in a criminal case for hooliganism, having been fined 20 thousand lei in January 2018.

16 August 2022. 15:23. An unknown person alerted the police saying that IP Cahul is mined. The caller was apprehended on hot tracks the same day. ZdG learned that the perpetrator is a 60-year-old man who lives in a village in Cahul district. We called the local town hall to try to get in touch with the man and found out that this is not the first time he has done such things.

“It didn’t surprise us at all. He often calls the police from unknown numbers and causes all sorts of ‘circuses’ (troubles). One day, he called the police and said all his tomatoes and peppers had been stolen from his garden. When we got there, that garden was full of weeds. He likes to drink. We rarely see him sober,” a city employee told us.

10 months in prison, the latest sentence for a false alarm perpetrator

Data from the court portal shows that the most recent conviction for the false communication about the preparation of explosions was handed down on 2 August this year by the magistrates of the Buiucani court in Chisinau. The case concerns a 38-year-old man from the capital who, on 27 March this year, in an advanced state of drunkenness, called three times the National Single Emergency Call Service 112 and falsely reported that, in a supermarket on bd. Mircea cel Bătrân supermarket in the capital, explosive devices were installed. Identified by law enforcement officers, the man admitted his guilt, said he was sorry and that he had committed an unintentional act, but that he did not remember the details. He requested that the trial be conducted on the basis of the evidence presented during the prosecution phase, a basis in the Code of Criminal Procedure, on the basis of which he received a one-third reduction in the statutory sentence and was sentenced to 10 months in a semi-open prison.

Two months earlier, another man, the perpetrator of a bomb scare on 9 November 2020 at the Chisinau Court of Appeal, was sentenced. The man alerted the police while inside the courthouse and, without good reason, said that an explosive device was installed in the building. Forensic expertise showed that he was suffering from chronic and progressive mental illness and had acted indiscriminately, which is why he was committed to a psychiatric institution with regular supervision.

The harshest sentence for communicating false information about acts of terrorism was imposed in 2015 on a man from Soroca, who was serving his sentence for murder in Prison No. 6 in the city of Soroca. Calling the police, he reported that an explosive object had been brought to the Chisinau City Hall in a pizza box for then mayor Dorin Chirtoaca. The false appeal added one year and four months to his 18-year sentence for murder.

12 years in prison for perpetrators of fake bomb threats

Multiple waves of false bomb threats have prompted authorities to intervene with changes in criminal law to punish perpetrators more harshly. While currently, knowingly communicating false information about a terrorist act is punishable by up to two years’ imprisonment, a fine of 550 to 850 conventional units or unpaid community service of 180 to 240 hours, a proposal to amend the Penal Code, drafted by the Ministry of Internal Affairs and sent to the State Chancellery in mid-July this year, provides for a penalty of between two and five years’ imprisonment and an increase in the ceiling for fines from 50 thousand lei to a maximum of 150 thousand lei.

The new article also provides for up to 12 years’ imprisonment for this offence if the knowingly false communication of the act of terrorism is made under aggravating circumstances, such as “during a state of emergency, siege and war, caused or could have caused damage to the interests of state security”.

The state spends millions of lei checking false bomb alerts

To verify and counter false bomb alerts, the state spends millions of lei. In the case of a report of an explosive placement, 3 to 15 police officers from different police services and subdivisions are on the scene.

“During the current year, so, as an estimated figure, we have exceeded 2.2 million lei for the actions that the police have carried out, for going on the spot and documenting bomb alerts. This is just a figure for the police institution,” Viorel Cernăuțeanu, head of the IGP, told ZdG.

Several countries in the region targeted by false bomb threats

Moldova is just one of the countries that have been the target of false bomb threats in recent months. In Russia and Ukraine, in addition to members of the “Kronos” group, other people have been detained on suspicion of being behind fake bomb threats in their countries and other countries in the region.

In January this year, when the avalanche of false bomb threats began in Moldova, several Russian cities were exposed to a large wave of similar false threats. Schools, hospitals and railway stations were reported to have been mined. On 21 January 2022, the very day the Gagauz minor was detained in Moldova, Russian law enforcement agencies announced that they had also identified a group of schoolchildren allegedly behind the alerts. The suspects were allegedly caught by mistake after one of the threatening letters about alleged bombs was sent not via the secure VPN but directly by email. In addition, “feeling like ‘heroes’, the students told their friends about their fun,” Russian authorities said, as quoted by local media. The Russian authorities also said it was possible that, in addition to the bomb threats they had launched in their own city, the group of schoolchildren were behind bomb threats in several Russian cities as well as in other countries.

On the same day, 21 January 2022, Ukrainian authorities accused Russia of being behind hundreds of fake bomb threats designed to “cause panic” in the country amid international fears of a Russian invasion. At the time, more than 300 false bomb threats were registered in Ukraine, according to the Security Service of Ukraine (SBU).

Earlier this February, Russia’s Federal Security Service (FSB) announced that 14 more people had been detained in the case. According to the FSB, one of the organisers of this hacker group was Anton Osipchuk, born in 2003, a native of Volinskii region, Ukraine, studying at the Faculty of Information Security of the National Technical University of Ukraine (Kiev), and his accomplices”.

In mid-August this year, the Ukrainian Security Service announced that it had “unmasked” two of the leaders of the group which, over the past two years, has made numerous false bomb threats in different regions of Ukraine. The figures lived in Kiev and the Rivne region.

They were officially considered temporary unemployed. Unofficially, they had sufficient IT knowledge and acted in a coordinated and professional manner, the SBU announced.

After the outbreak of war in the neighbouring country, the number of bomb alerts in Ukraine and Russia has been decreasing. In spring this year, however, it was the turn of several Eastern European countries, including Serbia, Hungary and Bulgaria, to be “bombarded” with false alerts about the bombing of several targets. Mostly, state institutions, shopping centres, schools, kindergartens or churches were targeted.

Thursday, August 25: Prosecutors announce that they have launched criminal proceedings for acts of terrorism

The Prosecutor General’s Office announced on Thursday, August 25, the start of criminal prosecution for terrorist acts in the context of multiple false bomb threats on the territory of Moldova. According to prosecutors, the initiation of criminal prosecution for terrorist acts stems from the progress of investigations carried out so far regarding the knowingly false communication about the presence of explosives in various locations, which in certain episodes, “in order to create danger to the life and health of citizens, aimed at intimidating the population”.

“The qualification of the criminal acts according to Article 278 of the Criminal Code is not only related to the aspect of the punishment that the perpetrators risk, of minimum 6 years imprisonment (versus maximum 3 years imprisonment in the situation of Article 281 of the Criminal Code), but also ensures the national institutions responsible for the investigation of the facts the possibility to cooperate with the counter-terrorism institutions of the states from which information was previously requested, on the subject of false alerts,” a PG press release said.

At the same time, most of the requested states are said to have provisions in their legislation that give counter-terrorism institutions more far-reaching procedural tools and alert terms for their execution, prosecutors say.

Thus, to the foreign jurisdictions to which previous requests on the subject of false alerts have been sent, the requests are to be completed. At the same time, prosecutors say that in the course of the prosecution, requests have been made to the institutions concerned by the bomb alerts, including public ones, to establish the amount of damage.