Ilan Shor, the fugitive oligarch convicted of masterminding the billion-dollar collapse of Moldova’s banks in 2014, has re-emerged as the operator of what may be Russia’s most ambitious effort to escape Western sanctions, according to a major investigation published by The New York Times.
Drawing on thousands of internal documents leaked by hackers and analysed in a June report by Britain’s Open Source Centre, the Times describes A7, Shor’s Moscow-based firm, as a state-backed machine for paying Russia’s foreign suppliers: a web of front companies from Kyrgyzstan to the Gulf, currency conversions that scrub the origin of ruble funds, and a custom app that used OpenAI’s models to rewrite invoices so that drone parts and electronic-warfare sensors bound for Moscow appeared on paper as car floor mats and LED light boxes. In the first four months of 2025 alone, the Times tallied more than $500 million in prohibited transactions, over $130 million of it for goods usable by Russia’s military-industrial base. Three Western intelligence officials told the paper Shor reports directly to none other than Sergei Kiriyenko, the first deputy chief of staff of the presidential administration who is said to run run influence operations across the former Soviet space.
For anyone who has followed Moldova, the most striking finding is not the scale. It is the cast. And collectively, they’ve quite the rap sheet.
The 2014 crew, reassembled in Moscow
The OSC report draws an unbroken line from the architects of the heist to the engineers of A7. Maria Albot, Shor's cousin and a central figure in the Kroll audit, runs customer relations at a core A7 company; the EU sanctioned her in 2024 as a trusted Shor associate implicated in the fraud, and last October its General Court threw out her appeal, as it had Shor's and Marina Tauber's. Tauber, Shor's former classmate and parliamentary lieutenant — now in Russia with a Putin-awarded Order of Friendship — is treated internally as a senior figure with her own secure VPN.
Albot's ex-husband, Victor Gutuleac — a former anti-corruption inspector whom RISE Moldova dubbed "Shor's courier in Moscow" — handles major transfers for the network. Moldovan intelligence traced the "Moldovan Village" vote-buying scheme of 2023 to a €1 million loan he routed through a Kazakh bank, and two years earlier his Chișinău account received over €2 million from Anastasia Dronova, an associate of Andrei Goncharenko, the Gazprom-linked Russian billionaire who took over Shor's stake in Chișinău airport (no relation to the Ukrainian MP). Dronova now appears in the leaks as a senior A7 executive.
The money and the politics turn out to be one operation. Evrazia, the Russian “traditional values” NGO through which, per earlier Times reporting, Moscow funnelled hundreds of millions to pay Moldovans to vote against EU accession, runs on the same servers and messaging platform as A7’s core business. Leaked budgets and chat logs show it paying activists and building an app to track sympathisers ahead of last year’s parliamentary election. The laundry and the political-warfare unit share a building.
Two further details will land in Chișinău. In August 2025, Moscow proposed an A7 front company in the UAE as the intermediary for paying Hungary’s MET for Russian gas to Transnistria — a plan Moldovan authorities blocked. And TRM Labs, OSC’s blockchain partner, traced crypto wallets it attributes to Igor Himici, the former Shor Party MP, to direct transfers from addresses tied to Iran’s Revolutionary Guard and Hamas, and to laundered proceeds of North Korean exchange hacks.
Shor, sanctioned by Washington in 2022 for working with Russian security services to meddle in Moldovan elections, has hardly been discreet. He told the St Petersburg forum last year his mechanism was “pretty much invulnerable,” and told Kommersant this month A7 has no trouble moving money anywhere. After failing to swing either the referendum or the 2025 election, he announced in December he was winding down his Moldovan “social projects.” The infrastructure did not wind down with them.
The lesson is uncomfortable. The individual sanctions on Shor slowed nothing. The vote-buying failed, but the operator, his 2014 crew and their influence machine survived — and were scaled up into a financial lifeline for Russia’s war, with a proposed hand on Transnistria’s gas bill. Chișinău’s problem is now Kyiv’s.
Tomorrow: how A7 actually works, why Kyrgyzstan became a “front country,” the Budapest detour, and why the West’s response has been so weak.
News Briefs
Counter-terrorism police in the UK are investigating whether Iran is behind a suspected bomb plot after armed officers found explosives on three vans parked minutes from an RAF base used by the US military. The Guardian understands that after five men were arrested on terrorism charges, investigators were examining materials found in the vans, with an initial view being they were consistent with improvised explosive devices. Images circulating on Sunday showed shirtless men being handcuffed in a dark country lane in the early hours of Sunday after police were called to reports of three suspicious vans travelling towards RAF Fairford in Gloucestershire, which hosts US air force missions against Iran. The suspected plot appears to have been foiled by chance when a member of the public spotted unusual behaviour late at night in the countryside from a group of men and called 999. During the major incident the residents of 85 households in the Cotswolds village of Whelford were rapidly evacuated to Cirencester leisure centre and a 400m cordon was placed around the white vans as robots from the army’s bomb squad examined them. Tests were ongoing to find out whether the suspected explosive devices were viable, with bomb robots deployed in the Gloucestershire countryside as investigations continued. After their initial arrest over explosives offences, the five men detained early on Sunday were further arrested later in the day on suspicion of the preparation of a terrorist act. The pictures of the men with their shirts off could point to a precautionary measure against the risk of suicide vests or concealed weapons - The Guardian
London’s Daily Telegraph newspaper reported late Sunday that police were investigating a possible Iran link into the attempted operation. In July Iran’s Islamic Revolutionary Guard Corps noted RAF Fairford’s use by US bombers, warning the UK that “any base used for aggression against Iranian territory constitutes a legitimate target for our forces”.
The US and Iran signaled a willingness to continue negotiating this week, even as the two sides appeared no closer to closing the stark gap between them. US President Donald Trump said Saturday he rejected Iran’s proposal to reopen the Strait of Hormuz, yet told Axios he expects “more talks.” Tehran’s foreign minister struck a similar tone, saying Iran is “fully prepared” to resume fighting while insisting it remains ready for diplomacy. But escalation risks continue to grow: Pakistan’s and Turkey’s military chiefs headed to Saudi Arabia while weighing intervention against the Houthis on Riyadh’s behalf, as UK investigators probed Tehran’s possible involvement in an attempted bomb plot Sunday against an air base used by Washington in its war against Iran - Semafor
Russia hit the headquarters of Kyivstar, Ukraine’s largest mobile service provider, on Sunday, the company told local media, as Moscow continued a bombardment of Ukrainian data centers and communications infrastructure. Kyivstar told Interfax Ukraine news agency that its head office in Kyiv had been hit, but there were no casualties. Russia’s Defense Ministry also said on Sunday it hit a data center belonging to Vodafone Ukraine, the country’s second-largest cell network provider. Ukrainian President Volodymyr Zelenskiy said Russia struck a data center in Kyiv twice on Sunday morning, wounding two children and an adult. Moscow has also hit data centers belonging to Ukrainian internet providers over the past week, causing service outages to about 100,000 households in Kyiv and the surrounding region, according to Ukraine’s Digital Ministry. “Russia has targeted major Ukrainian data centers, seeking to disrupt the flow of information. Rapid alerts about missile and drone threats are essential — they save lives,” Ukraine’s Foreign Minister Andrii Sybiha wrote on X on Wednesday - Reuters
Russian Foreign Minister Sergei Lavrov met his German counterpart Johann Wadephul on the sidelines of the UN General Assembly on Saturday, their countries’ first talks at foreign minister level since before Russia’s full-scale invasion of Ukraine. Russia’s Foreign Ministry said the German side had requested the talks and that the ministers discussed bilateral relations and the war in Ukraine. “On these and other issues, Johann Wadephul reaffirmed the German government’s position, which has been stated publicly on numerous occasions,” the ministry said. The meeting came amid renewed tensions between the two countries after Germany accused Russia of attempting to blow up two cargo planes at Leipzig airport in August using a drone rigged with explosives. Wadephul told the UN Security Council this week that German support for Ukraine remained firm and called for a ceasefire and negotiations toward a lasting peace. Lavrov last met a German foreign minister in January 2022, when he held talks with Wadephul’s predecessor Annalena Baerbock weeks before Russia invaded Ukraine - Moscow Times
President Donald Trump appears to have insinuated that he may tear down the White House Press briefing room and restore the building's historic swimming pool in a new Truth Social post on Sunday. Trump, who has been at odds with the White House Press Pool since he enacted a ban on CNN, Politico, and MS NOW from entering the White House, posted a side-by-side of before and after image of the James S. Brady Press Briefing Room next to what appears to be a digitally created image of the historic indoor pool built by then president President Franklin D. Roosevelt in the White House. The image of the briefing room was captioned “Fake News, Before,” while the pool, surrounded by gold-trimmed embellishments, was captioned “FDR Pool After.” The press briefing room, located in the West Wing, was once the site of FDR’s swimming pool, built in 1933. After Roosevelt was diagnosed with polio in 1921, he regularly swam for exercise. In 1970, in an effort to accommodate the growing White House Press Corps, Richard Nixon directed that the pool be covered with flooring and converted into the present-day James S. Brady Press Briefing Room. The project architect noted that Nixon didn’t want the pool destroyed and that the press room would be designed with the understanding that restoration could occur in the future, so as not to be accused of destroying the FDR pool - The Mirror
The journals…
