Understanding Illicit Political Finance to Counter State Threats

In 2024, Western governments warned that Russia was actively interfering in Moldova’s elections, seeking to prevent the re-election of pro-European Union politicians. This interference targeted Moldova’s political system from multiple angles, including covertly funding political actors and protest movements. There were widespread reports of vote-buying, including cash payments of up to €100 to voters. Reports described individuals selling or transferring access to their bank accounts to allow foreign money to move surreptitiously into the political system. Cryptocurrency also played a role, further facilitating funds to move covertly into the political system and facilitating payments. While Russian interference in Moldova was well publicized, it is far from the first example of the funding behind foreign influence and interference networks: even Canada’s Public Inquiry into Foreign Interference flagged a financial angle to foreign influence in its own democratic processes.

Behind every covert influence campaign lies a hidden economy of payments, intermediaries, digital assets, illicit donations, and patronage networks. This is illicit political finance: funding or support in political and democratic processes that is illegal, undisclosed, or disguised, designed to evade detection, attribution, and accountability. This issue is a nascent but fundamental security challenge facing democracies around the world.

Democratic institutions and processes face growing threats from covert political influence operations. These activities target information ecosystems, democratic elections, referendum questions, candidate selections, broader policy debates, and even legislation through third-party litigation financing. The goals of this interference include transnational repression, voter suppression or intimidation, polarization amplification, nomination contest manipulation, policy capture, and, broadly, challenging the liberal international order. Ultimately, actors seek to covertly influence political processes to achieve their strategic aims, and they deploy considerable financial resources to do so.

The Tenet Media case illustrates how financing can turn an ostensibly independent media venture into a vehicle for covert political influence. According to a September 2024 U.S. indictment, two Russia Today (RT) employees directed and financed a Tennessee-based, right-wing content company, widely identified as Tenet Media, without disclosing RT’s role to its audience. The indictment alleges that approximately $9.7 million reached the company through foreign wire transfers between October 2023 and August 2024.

The network aimed to influence the U.S. information environment by amplifying divisive political content favourable to Russian interests, seeking to shape public debate while concealing its foreign role. The indictment describes contracts and invoices, roughly 30 incoming wire transfers to Tenet Media, payments to its founders, and transfers routed through companies in several jurisdictions. Although much of this activity was unlawful under U.S., Canadian, and EU sanctions, the network operated undisrupted for several years.

In the Moldovan case, authorities alleged that networks linked to Russia paid voters, supported political actors, and financed efforts to shape public opinion. In October 2024, investigators said a network associated with fugitive oligarch Ilan Sor had transferred €15 million to some 130,000 people ahead of the presidential vote and referendum. In April 2025, then Prime Minister Dorin Recean estimated the total spent by Russian agents to influence the 2024 votes at about €200 million. The alleged activity continued into the 2025 parliamentary campaign. A BBC undercover investigation found a network offering Moldovans monthly payments to publish pro-Russian content and false claims on social media. Moldova’s National Anticorruption Center (CNA) subsequently described an alleged scheme that converted cryptocurrency into cash for party support, paid political promotion, voter bribery, and rally participation. Much of this activity was likely unlawful under political finance rules, but, as with Tenet media, these laws were insufficient to disrupt the financial operation in a timely manner.

This activity is not just confined to vote-buying or influence campaigns, but can also extend to kinetic operations. Harakat Ashab al-Yamin al-Islamiya (HAYI) emerged in March 2026 and claimed a series of attacks against Jewish, Israeli- and U.S.-linked targets in Europe. The attacks generally focused on accessible targets and used relatively simple tactics, including arson and small explosive devices, while videos and claims of responsibility extended their reach online. U.S. prosecutors allege that HAYI was a front for Iran-backed proxy Kata’ib Hizballah (KH), operating through Mohammad Baqer Saad Dawood al-Saadi on behalf of KH and Iran’s Islamic Revolutionary Guard Corps (IRGC). HAYI principally financed political violence and intimidation and intended to shape political outcomes and public debate through fear and coercion. At the local level, the implementers appear to have been small teams or individually recruited residents rather than a conventional, enduring HAYI membership. Recruitment occurred through online channels, and people with limited operational experience were paid modest sums to conduct attacks. Al-Saadi made third-party payment arrangements, agreed to pay $10,000 for attacks, and sent an approximately $3,000 cryptocurrency advance to an undercover officer.

The emergence of HAYI and Iranian-financed operations illustrates the kinetic component of illicit political finance. While other aspects of illicit political finance might involve bot networks, mis- and disinformation, propaganda, and direct political interference, paying to create the illusion of a terrorist organization operating across Europe further illustrates how money can be deployed to sow chaos and dissent in democracies.

The case of HAYI also illustrates some of the challenges in countering this activity: while the ties to state-sponsored terrorism became clear relatively quickly, the lightning-fast emergence of this group and the rapid deployment of financial assets to pay for immediate (and sometimes amateur) operations challenged counter-terrorism (and counter-terrorism financing) tools, many of which require a formal listing or designation of a terrorist group in order to be effective. Further, the initial criminal appearance of this activity blurred the lines of what criminal or intelligence response was appropriate.

In all these cases, illicit political finance illustrates how money functions as the critical infrastructure of covert influence. By making finance central — rather than peripheral — to analysis, illicit political finance illuminates how money, power, and covert influence intersect in contemporary democratic challenges. This also underscores the need for a coordinated governance system to combat illicit political finance — one that accounts for the roles of all state and non-state actors, including corporations, non-profit organizations, and criminal and terrorist groups, as well as their goals in deploying financial resources.

Many of these actors involved in illicit political finance operations work across jurisdictions in ways that challenge the current liberal international order, exploiting gaps between national regulatory regimes that were never designed to address transnational financial activity on this scale or for this purpose. At the same time, good, if not great, tools to counter this activity exist; anti-money laundering and counter-terrorist financing toolkits provide a variety of legislative, policy, and intelligence responses that could be adapted to thwart illicit political finance. Other areas like political finance and anti-corruption, as well as sanctions law, could also be deployed against this threat. However, fully understanding the actors, objectives, and methods used to finance this activity will illuminate networks, help design better legislative, criminal, and intelligence responses, and ultimately make democracies more resilient against foreign influence, interference, and espionage.

Jessica Davis is the President of Insight Threat Intelligence, a post-doctoral associate at the University of Calgary Faculty of Law, and a visiting senior fellow with the Soufan Center.