Matryoshka: Multi-year Russian disinformation campaign targeting 2025 global events

VIGINUM, the French technical agency for digital vigilance, has declassified the operational schematics of Operation Matryoshka, revealing a sophisticated, multi- disinformation architecture designed not to spread falsehoods, to weaponize the verification processes of Western media. Unlike previous brute-force botnets, Matryoshka functions as a recursive “nesting doll” method, trapping fact-checkers in a resource-draining loop of debunking fabricated content that the network itself generates.

The “Seeder-Quoter” Binary Architecture

The core innovation of the Matryoshka node structure is its bifurcation of bot roles into two distinct technical classes: Seeders and Quoters. VIGINUM technical reports from 2024 and early 2025 identify this binary behavior as the primary signature of the network. * Tier 1: The Seeders (Injection Nodes). These accounts initiate the infection chain. They post high-quality visual forgeries, fake covers of Le Parisien, Der Spiegel, or Libération, and increasingly, AI-generated audio deepfakes of political leaders. These nodes operate in strict synchronicity, frequently publishing identical content within seconds of each other. * Tier 2: The Quoters (Amplification & Harassment Nodes). Approximately 30 to 40 minutes after the initial seed, the “Quoter” nodes activate. These accounts do not post original content. Instead, they quote-tweet or reply to the Seeder’s post, tagging specific: major news outlets (BBC, CNN, AFP), independent fact-checking organizations (Bellingcat, Correctiv), and individual investigative journalists. The Quoters use a standardized social engineering script, asking variations of: “Is this true? Please verify!” or “Why is the media silent on this?” This tactic, by researchers as Operation Overload, turns the media’s open-source intelligence (OSINT) workflows against them, flooding inboxes and notification feeds with requests to investigate non-existent events.

Table 1. 1: Matryoshka Node Behavioral Signatures (2024-2025)

Node Type	Primary Function	Latency / Timing	Target Vector	Volume Metrics (Avg)
Seeder	Content Injection	T-0 (Synchronous Launch)	General Public Feed	5-10 posts/day per cluster
Quoter	Harassment / Baiting	T+30 to T+45 Minutes	@Media, @FactCheckers	150+ tags per operation
	Cross-Platform Transit	Pre-Launch (T-2 Hours)	Telegram -> X/Twitter	N/A (Backend coordination)

The Telegram-to-X Pipeline

Technical analysis by the Bot Blocker project and VIGINUM confirms that Matryoshka’s command and control (C2) infrastructure relies heavily on a Telegram-to-X . The content supply chain follows a rigid, traceable route: 1. Fabrication: Visual assets (fake graffiti, doctored magazine covers) are created, likely using generative AI tools for speed and. 2. Staging: Content is uploaded to specific Russian-language Telegram channels (e. g., Voyenny Obozrevatel or “Military Observer”). These channels serve as the “primordial soup” for the operation. 3. Migration: Within hours, the Seeder bots on X (formerly Twitter) scrape this content and repost it to Western audiences, stripping the Russian context and adding localized captions in German, French, or English. 4. Legitimization: The Quoters immediately tag local authorities to create a false sense of urgency. In the lead-up to the February 2025 German Federal Elections, this pipeline was used to disseminate deepfake audio recordings purporting to show German officials discussing the surrender of Ukraine. The “Incident 929” report by the AI Incident Database notes that this specific campaign utilized over 100 bogus news sites, part of the “Portal Kombat” infrastructure, to host the long-form versions of these fakes, while Matryoshka nodes handled the distribution.

Targeting 2025: The “Overload” Strategy

The operational tempo of Matryoshka shifted aggressively in late 2024 to target 2025 electoral events. Data from the Institute for Strategic Dialogue (ISD) indicates that in the quarter of 2025 alone, the network executed at least 135 discrete operations targeting 80 different organizations. The campaign’s focus on Moldova’s 2025 parliamentary elections provides a clear case study of this evolution. Between April and July 2025, Matryoshka nodes pushed 39 separate fabricated narratives against the Moldovan government. Unlike previous years, where the goal was simply to be believed, the 2025 strategy focuses on saturation. By flooding the information space with so high-quality fakes that require verification, the network aims to paralyze the capacity of truth-guarding institutions.

“The aim is to limit their ability to respond… dealing with fake media content, of course, limits our capacities.”
, Janina Lückoff, Head of Fact-Checking at BR24 (German Public Broadcaster), regarding the 2025 surge.

Technical Convergence with “Portal Kombat”

While Matryoshka is behaviorally distinct, it shares technical DNA with the Portal Kombat network, a sprawling web of 193+ “zombie” media sites (e. g., pravda-en. com, news-de. com). VIGINUM’s forensic analysis suggests a shared backend or at least a coordinated hand-off. Matryoshka bots frequently link to Portal Kombat domains as the “source” of their claims. This convergence creates a self-reinforcing ecosystem: 1. Portal Kombat hosts the fake article. 2. Matryoshka Seeders post the headline and link. 3. Matryoshka Quoters demand journalists verify the “breaking news.” 4. Search Engines index the Portal Kombat site due to the sudden spike in social signals. This closed-loop system allows Russian operators to bypass traditional algorithmic filters, as the content appears to be generating “organic” discussion and inquiry from real users (the Quoters) to verified accounts (the journalists). The use of compromised or aged accounts for the bot network further complicates detection, as these accounts frequently have years of dormant history before being reactivated for the campaign.

The “Reverse-Outreach” Vector: Weaponizing the Tipline

While the Matryoshka network constructs the disinformation, “Operation Overload” serves as its delivery system. Identified by the Finnish technical analysis firm Check in June 2024, this campaign represents a tactical inversion of traditional propaganda. Instead of broadcasting falsehoods to the public and hoping for organic uptake, Russian operatives directly solicit Western journalists and fact-checkers. They demand verification of fabricated content. This technique functions as a Distributed Denial of Service (DDoS) attack on human editorial resources. It forces newsrooms to waste hundreds of hours investigating non-existent scandals.

The operational logic is binary. If a fact-checker debunks the fake content, the operatives cite the debunking article as proof that the topic is “being discussed” by mainstream media. If the fact-checker ignores it, the operatives claim the media is “censoring the truth.” Between January 2024 and May 2025, Check documented 997 specific deceptive emails sent to over 245 distinct media and research organizations. These emails frequently impersonated concerned citizens, whistleblowers, or fellow journalists.

The “Please Check” Protocol

The standard Overload email follows a rigid template designed to bypass spam filters and trigger editorial urgency. The subject lines rarely contain sensationalism. They use bureaucratic or pleading language to lower defenses. VIGINUM, the French vigilance agency, released technical indicators in 2024 showing that these emails frequently originate from protonmail or temporary domains. They direct recipients to Telegram channels or X (formerly Twitter) threads where the “evidence” is hosted.

“Dear Editor, I am a concerned citizen from [Region]. I saw this disturbing video on Telegram regarding [Target Topic]. Can you please verify if this is true? It seems very serious. Link attached.”
, Template of a typical Operation Overload solicitation (Source: Check, 2024)

Targeting the 2024 Paris Olympics

The most aggressive phase of Operation Overload occurred prior to the 2024 Summer Olympics in Paris. Microsoft Threat Analysis Center (MTAC) attributed this activity to a group tracked as Storm-1679. The campaign did not spread rumors. It produced high-budget, AI-enhanced media assets designed to withstand initial scrutiny.

The centerpiece of this effort was a four-part fake documentary titled Olympics Has Fallen. The film used an AI-generated voiceover impersonating American actor Tom Cruise. It falsely alleged corruption within the International Olympic Committee. Operatives sent thousands of emails to sports desks and general newsrooms in France, Germany, and the United States. They claimed the documentary was a “banned” production from Netflix. Simultaneously, the network circulated fake warnings attributed to the CIA and the French General Directorate for Internal Security (DGSI). These forged documents warned of imminent terror attacks at Olympic venues. The goal was to trigger a security panic and depress ticket sales.

2025 Evolution: The Shift to Media Impersonation

Following the Olympics, the campaign mutated. By mid-2025, the Institute for Strategic Dialogue (ISD) reported a tactical shift. The operatives moved away from impersonating individuals. They began impersonating the media outlets themselves. In the second quarter of 2025, 70 percent of Operation Overload posts analyzed by ISD attempted to mimic legitimate news organizations. The primary included Euronews, the BBC, and Deutsche Welle (DW).

The network also expanded its platform focus. While X remained a primary vector, July 2025 data showed a surge in activity on TikTok. Operatives used the platform to target younger demographics with short-form videos attacking USAID and the Ukrainian government. These videos used stolen logos and AI-generated voiceovers to mimic viral news clips.

Verified Metrics: The of the Deluge

Data aggregated from Check, VIGINUM, and Recorded Future reveals the escalating volume of the campaign between 2024 and 2025.

Metric	2024 Statistics	2025 Statistics (Jan-June)
Targeted Organizations	800+ (Global)	245+ (High-priority )
Primary Attack Vector	Email / X (Twitter)	Email / TikTok / Bluesky
Content Type	Fake Whistleblower Videos	Media Brand Impersonation (70%)
Key Narrative Focus	Paris Olympics / French Elections	USAID / German Elections / Ukraine
Attributed Emails	200+ ( 6 months)	700+ (Since Sept 2024)

The persistence of Operation Overload demonstrates a resource asymmetry. It costs Russia pennies to generate a fake “whistleblower” video using generative AI. It costs a Western newsroom thousands of dollars in man-hours to verify, geolocate, and debunk that same video. This economic is the engine of the campaign.

The “Seeder-Quoter” Binary Architecture

The operational backbone of Operation Matryoshka, as exposed by the volunteer shared Antibot4Navalny (also known as Bot Blocker), relies on a distinct bifurcation of bot roles. Unlike the “Doppelganger” campaign, which relies on brute-force link spamming, Matryoshka uses a recursive “nesting doll” structure. VIGINUM technical reports from 2024 and early 2025 identify this binary behavior as the primary signature of the network.

Tier 1: The Seeders (Injection Nodes)

The infection chain begins with “Seeder” accounts. Antibot4Navalny telemetry indicates these are frequently hijacked or dormant accounts created years prior, frequently between 2015 and 2020, to bypass platform “new account” filters. These accounts post the initial fabrication, such as a falsified cover of Libération or a staged photo of anti-Zelensky graffiti in a Western city. A defining characteristic of Seeder telemetry is the artificial inflation of view counts. Analysts observed Seeder posts registering tens of thousands of views within minutes of publication, yet displaying near-zero organic engagement (likes or reposts) from real users. This gap signals the use of commercial “view boosting” services to trick platform algorithms into indexing the content.

Tier 2: The Quoters (Amplification Swarm)

Once a Seeder posts, the “Quoter” nodes activate. These are fresher accounts, frequently created in large batches during 2023 and 2024. Their function is not to retweet the content directly to “quote-tweet” or reply to it while tagging specific. The telemetry reveals a hard-coded target list: major Western media outlets (CNN, BBC, Deutsche Welle), fact-checking organizations, and government officials. The Quoters use a standardized linguistic template, asking variations of: “Is this true?” “Why is no one reporting this?” or “Can you verify this?” This tactic weaponizes the journalistic verification process, forcing newsrooms to waste resources investigating non-existent events.

Table 3. 1: Matryoshka Node Telemetry Comparison (2024-2025 Data)

Metric	Seeder Nodes	Quoter Nodes
Account Age	5+ years (Hijacked/Dormant)	< 1 year (Mass Created)
Primary Action	Upload Media (Image/Video)	Tag Verified Accounts + Question
Volume per Cluster	1-5 accounts	50-200 accounts
Engagement Pattern	High Views / Low Interaction	High Reply Rate / Low Views
Content Type	Fake Invoices, Graffiti, Covers	“Is this real?”, “Check this”

Temporal Patterns and The 2025 Shift

Antibot4Navalny’s longitudinal data shows a clear evolution in Matryoshka’s targeting logic, shifting from general anti-Ukrainian sentiment in 2023 to specific electoral interference in 2025. In the lead-up to the February 2025 German federal elections, the network executed a “burst” strategy. Between January 29 and January 31, 2025, the network activated to distribute 15 distinct fake videos targeting German political figures, using the “ask the media” mechanic to bypass spam filters. This coordinated release suggests a command-and-control structure capable of holding assets in reserve for high-value political windows.

The network also demonstrated geographic pivoting capabilities. In May 2025, telemetry indicated a massive retargeting toward Moldova. Analysis by software firm CheckFirst and non-profit Reset Tech recorded a surge in Matryoshka bots mentioning Moldovan President Maia Sandu. During this period, the bots generated 75 distinct mentions of Sandu in verification requests, compared to only 28 for French President Emmanuel Macron and 22 for Volodymyr Zelensky. This data confirms the network’s function as a “service-for-hire” or a centrally directed asset that reallocates bandwidth based on Kremlin foreign policy priorities.

Cross-Platform Bleed: The Bluesky Expansion

By late 2024, the containment of Matryoshka on X (formerly Twitter) failed. Antibot4Navalny and Agence France-Presse (AFP) identified the network’s migration to Bluesky, a decentralized social platform. The telemetry on Bluesky revealed a tactical “twist”: instead of just impersonating concerned citizens, the bots began using AI-generated profiles to impersonate academic institutions and universities. In January 2025, researchers identified approximately 50 Matryoshka nodes on Bluesky executing the same “verify this” loop. This cross-platform bleed indicates that the operators are actively testing the resilience of moderation systems outside of the Musk-owned ecosystem.

“The operation is trying to test its efficacy in reach and assess how much and how fast it is going to be taken down.” , Valentin Chatelet, Atlantic Council DFRLab (January 2025)

Visual Telemetry: The “Fake Proof” Templates

The visual metadata associated with Matryoshka posts provides another of identification. The network relies heavily on two specific visual templates:

• The Fake Graffiti: Low-resolution images of anti-Zelensky or anti-Western graffiti allegedly painted in cities like Los Angeles, Paris, or Berlin. Metadata analysis frequently reveals these are stock photos of brick walls with the “graffiti” digitally overlaid using Photoshop or generative AI.
• The Fake Invoice: High-resolution documents purporting to show luxury purchases by Ukrainian officials. A viral case in mid-2024 involved a fabricated invoice for a Bugatti Tourbillon allegedly purchased by Olena Zelenska. Antibot4Navalny traced the dissemination of this document to a specific cluster of Seeder accounts that had previously pushed fake real estate documents.

The persistence of these templates into 2025, even with the introduction of AI video, suggests a standardized production pipeline. The operators maintain a library of “proof” formats that can be quickly adapted for different narratives, whether targeting the Paris Olympics or the German Bundestag.

The Convergence: Matryoshka as the Distribution

The operational success of Operation Matryoshka relies on a symbiotic technical relationship with the “Doppelganger” (RRN) infrastructure. While Matryoshka provides the behavioral method, the “Seeder-Quoter” interaction that baits fact-checkers, Doppelganger provides the payload. VIGINUM and Microsoft Threat Intelligence (Storm-1679 and Storm-1099) data from late 2024 and early 2025 indicate that 78% of Matryoshka “Quoter” requests direct to domains hosted within the Doppelganger ecosystem. This nexus transforms Matryoshka from a mere nuisance into a high-volume traffic driver for Russian state-sponsored spoofing sites.

The technical between these two operations is the “Kehr” Traffic Distribution System (TDS). Forensic analysis by Qurium and the EU DisinfoLab reveals that Matryoshka bots do not link directly to the final spoofed article. Instead, they utilize disposable redirect domains (frequently ending in . shop or . site) processed by Kehr. This cloaking filters incoming traffic: users with Russian IP addresses or automated crawlers are served benign content, while Western are redirected to the malicious Doppelganger clone. This segmentation complicates attribution and delays the blacklisting of the final destination URLs.

Registrar Forensics and Domain Burn Rates

The resilience of the Doppelganger nexus lies in its industrial- domain acquisition strategy. Unlike previous campaigns that utilized compromised legitimate sites, this network registers fresh domains in bulk. Data from the quarter of 2025 shows a distinct shift in registrar preference following the US Department of Justice’s seizure of 32 key domains in September 2024. The network moved from US-based registrars to a mix of European and offshore providers to mitigate legal takedowns.

Primary Registrars Identified (2024-2025):

• NameCheap (USA): Historically the primary volume provider, though usage declined by 15% in 2025 due to increased scrutiny.
• 1API GmbH (Germany): Identified as the registrar for the pivot domain rrn. news after rrn. media was seized. The use of a German registrar signals a strategic attempt to blend in with local traffic during the 2025 Bundestag elections.
• Nicenic (Hong Kong) & Reg. ru (Russia): Used for “burn” domains, URLs intended to be active for less than 48 hours to host specific viral fakes.
• Njalla (Nevis/Privacy): utilized for high-value where operator anonymity is paramount.

The “burn rate” of these domains is high. In January 2025 alone, the network registered over 900 distinct domains. The average lifespan of a Matryoshka-distributed link before platform-wide suspension is approximately 3. 5 days, down from 12 days in 2023. This rapid cycling the automated registration scripts that characterize the current phase of the operation.

Targeted Entities and TLD Weaponization

The campaign employs “Typosquatting” and Top-Level Domain (TLD) switching to deceive users. When a . com or . fr domain is seized, the operators immediately relaunch the exact same site on a different TLD. In the run-up to the February 2025 German federal elections, the network aggressively spoofed trusted German media outlets to inject anti-Ukraine narratives directly into the electorate’s information stream.

Table 4. 1: Verified Doppelganger Spoofing (2024-2025)

Target Entity	Legitimate Domain	Spoofed/Weaponized Domains	Target Event/Context
Der Spiegel	spiegel. de	spiegel. ltd, spiegel. today, spiegel. fun	2025 German Federal Elections
Le Monde	lemonde. fr	lemonde. ltd, lemonde. pm, lemonde. website	French political instability; Ukraine aid
The Washington Post	washingtonpost. com	washingtonpost. pm, washingtonpost. cam	US Post-Election Polarization
NATO	nato. int	nato. ws, nato-int. org	Munich Security Conference 2025
Reliable Recent News	(Self-Branded)	rrn. media, rrn. news, rrn. world	Central Content Repository
Bild	bild. de	bild. eu, bild. llc	German migration policy disinformation

Infrastructure Costs and

Maintaining this infrastructure requires significant financial resources, distinguishing it from low-level hacktivist operations. Insikt Group estimates the leasing cost of the Doppelganger server infrastructure, comprising over 300 network prefixes and 100, 000 IP addresses, at approximately €50, 000 per month. This figure does not include the cost of domain registration, which, at the observed volume of thousands of domains per year, adds an estimated €25, 000 to €40, 000 annually to the operational budget.

The network utilizes “Bulletproof Hosting” providers that ignore abuse complaints. While Hetzner (Germany) was used in early stages, 2025 forensic data indicates a migration to hosting services in Moldova and Kazakhstan, as well as the continued use of the Kehr TDS to mask the true server location. The US DOJ seizures in late 2024 forced a temporary contraction, the network demonstrated “rapid recidivism,” with 12 new replacement domains appearing within 24 hours of the seizure order.

“The infrastructure is not static; it is hydra-like. When the Department of Justice seized 32 domains in September 2024, the network did not go dark. It simply rotated TLDs. The domain warfareinsider. us was replaced by warfareinsider. co, and the content remained accessible to the Matryoshka bots without interruption.” , DFRLab Technical Assessment, October 2024.

The 2025 Shift: From Spoofing to “New Brands”

A serious evolution observed in early 2025 is the creation of “New Brands” designed to bypass the detection signatures associated with domain spoofing. Instead of cloning Der Spiegel, the nexus has launched entirely new, sounding-sounding news portals such as “Euro Chronicle” or “TruthGate.” These sites do not impersonate a specific legacy outlet use the same Doppelganger layout and CMS (Content Management System) templates.

This shift addresses the diminishing returns of spoofing as users become more domain-savvy. By creating these “grey” outlets, the Matryoshka operators can build a longer-term reputation for these domains, making them harder for registrars to justify seizing without a detailed content review. In the context of the 2025 global events, these generic news portals serve as the “Quoted” source, allowing the bots to say, “Look at this report from Euro Chronicle” rather than risking an immediate debunk by linking to a fake Le Monde URL.

The Pivot: From Athletic Disruption to Electoral Interference

Between July 2024 and February 2025, Russian information warfare operators executed a strategic pivot, transitioning their primary focus from the disruption of the Paris 2024 Olympic Games to the destabilization of the German federal elections. This shift was not a change in target a tactical evolution of the “Matryoshka” operational framework. VIGINUM and Microsoft Threat Analysis Center (MTAC) data indicate that the infrastructure built to simulate terrorism threats in Paris was repurposed within weeks to manufacture electoral distrust in Berlin. The “Seeder-Quoter” method, originally designed to overwhelm French fact-checkers with fake bomb threats, began flooding German social media with fabricated evidence of ballot destruction and deepfake corruption scandals involving the Green Party (Die Grünen) and the Christian Democratic Union (CDU).

Phase I: The Paris 2024 “Fear Campaign” (Jan 2024 , Aug 2024)

The disruption of the Paris Olympics served as the proving ground for Matryoshka’s high-velocity content generation capabilities. Unlike previous campaigns that relied on long-term narrative building, this phase prioritized immediate, visceral fear. The operation, attributed largely to the group tracked as Storm-1679, utilized a “firehose” strategy of fake official warnings.

The most significant verified incident occurred in June 2024, when the network circulated a fabricated video purporting to be from the CIA and the French General Directorate for Internal Security (DGSI). The video, which garnered over 100, 000 views on X (formerly Twitter) within 24 hours, falsely warned American tourists of a “high risk” of metro attacks. This was not a standalone event part of a coordinated sequence designed to trigger travel cancellations.

Key Paris 2024 Disruption Vectors

Date	Fabricated Asset	Platform/Method	Verified Reach/Impact
June 2023	“Olympics Has Fallen” Documentary	Telegram, Cameo	Full-length fake film narrated by AI-generated Tom Cruise; endorsed by deceived US celebrities.
Nov 2023	“Munich 1972” Graffiti Images	Digital Injection	Digitally generated images of threatening graffiti in Paris; 0 verified physical instances found.
June 2024	Fake CIA/DGSI Warning Video	X, Facebook	Falsely advised US citizens to avoid Paris Metro; debunked by CIA and CBS News.
July 2024	Fake Hamas Threat Video	Telegram, X	AI-manipulated video of Hamas fighters threatening the Games; rejected by Hamas officials.
Aug 2024	Fake Euro News/France 24 Clips	Spoofed Domains	Claimed 25% of tickets were returned due to terror fears; mimicked broadcast graphics perfectly.

The: Infrastructure Migration (Sept 2024 , Dec 2024)

Following the closing ceremony of the Paralympics, the network did not demobilize. Instead, technical indicators show a migration of assets toward German-language. By November 2024, following the collapse of Chancellor Olaf Scholz’s coalition and the announcement of snap elections for February 2025, the volume of anti-German government content surged.

Investigations by the German Foreign Ministry and the NGO Bot Blocker identified a massive registration of spoofed news domains. Between November 21, 2024, and February 2025, over 102 fake German news websites were registered. These sites were designed to host the “source” material that Matryoshka “Seeders” would later distribute. This period also saw the activation of John Mark Dougan, a Moscow-based disinformation actor, who reportedly facilitated the creation of these domains to mirror legitimate local German media.

Phase II: The Berlin 2025 “Chaos Campaign” (Jan 2025 , Feb 2025)

The operational tempo reached its peak in the six weeks leading up to the February 23, 2025, German federal election. The tactics shifted from generating fear of physical violence (terrorism) to generating fear of institutional collapse (fraud and corruption). The “Seeder-Quoter” was adapted: “Seeders” posted deepfake videos of politicians, while “Quoters” tagged German journalists and election officials, demanding they “investigate” the fabricated scandals, thereby paralyzing the information ecosystem.

Deepfake Deployment and Electoral Interference

The sophistication of the content deployed in Germany exceeded that of the Paris campaign. In January 2025, a deepfake video circulated showing Vice Chancellor Robert Habeck purportedly conspiring with Ukrainian officials to embezzle state funds. Unlike the “Olympics Has Fallen” documentary, which used a celebrity voice, this deepfake utilized advanced lip-syncing technology to manipulate actual broadcast footage, making detection significantly harder for casual viewers.

Simultaneously, the network targeted the integrity of the voting process itself. In early February 2025, a video surfaced on X showing the alleged destruction of ballots cast for the Alternative for Germany (AfD) party. German security services later confirmed this video was a complete fabrication produced by the Storm-1516 group, a known affiliate of the Matryoshka network. The video received 2. 5 million views on X before being flagged, demonstrating the network’s ability to achieve viral penetration before verification could occur.

“We can state definitively that Russia, through the Storm-1516 campaign, sought to influence and destabilise the most recent federal election.” , German Foreign Ministry Spokesperson, December 2025 Retrospective.

Tactical Evolution: The “Matryoshka” Variant in Germany

The application of the Matryoshka method in Germany displayed distinct variations from its French predecessor.

• Target Selection: While the Paris campaign targeted international audiences (tourists, global media), the Berlin campaign was hyper-localized. “Seeders” used regional German dialects and focused on local economic anxieties, such as heating costs and migration, to maximize resonance with specific voter demographics.
• The “Whistleblower” Narrative: A recurring trope in the German phase was the “fake whistleblower.” In January 2025, a video featured a woman claiming to be a former employee of a German ballot-counting center. Verification by the Institute for Strategic Dialogue (ISD) later revealed the woman was a British mental health nurse named Natalie Finch, whose identity had been stolen and likeness manipulated via AI to deliver a German-language script she never spoke.
• Cross-Platform Fan-out: The German campaign aggressively expanded beyond X and Telegram to Bluesky and TikTok. By February 2025, researchers identified at least 50 dedicated TikTok accounts amplifying Matryoshka narratives, a platform that had been less central to the Paris operations.

Post-Election Aftershocks and Diplomatic

The intensity of the campaign led to a severe diplomatic confrontation. On December 12, 2025, the German Foreign Ministry summoned the Russian ambassador to formally protest the “massive increase” in hybrid warfare activities. This diplomatic rebuke was supported by intelligence attributing a specific cyberattack on German air traffic control in August 2024 to APT28 (Fancy Bear), linking the kinetic cyber threats directly to the psychological operations of the election period.

By March 2025, following the German elections, the Matryoshka infrastructure did not go dormant. Instead, it pivoted again, this time targeting Moldova and its pro-European President Maia Sandu, proving that the “Paris to Berlin” timeline was one leg of a continuous, adaptive global disruption tour.

NewsGuard Forensic Audit: The “Pravda” Network and LLM Infiltration

By March 2025, the NewsGuard “AI Misinformation Monitor” had identified a structural shift in Russian information warfare: the transition from targeting human voters to targeting the Large Language Models (LLMs) that inform them. In a technical briefing released on March 7, 2025, NewsGuard analysts detailed how a network of 150 pro-Kremlin sites, shared as the “Pravda” network, successfully executed an “LLM grooming” operation. The audit revealed that 33 percent of responses from leading generative AI tools, including OpenAI’s ChatGPT-4o, Google’s Gemini, and Anthropic’s Claude, repeated Russian disinformation narratives as objective fact when prompted with neutral queries about the war in Ukraine.

This “grooming” was achieved not by hacking the models, by flooding the open web with millions of articles optimized for scraper ingestion. The Pravda network, operating domains such as News-Kiev. ru and Kherson-News. ru, published over 3. 6 million articles in 2024 alone. These sites did not produce original journalism. Instead, they used automated scripts to scrape Russian state media, rewrite the content using AI to evade duplicate content filters, and republish it across hundreds of pseudo-local news outlets. When LLMs scraped the web to update their knowledge bases, they ingested this high-volume, consistent fabrication as authoritative data.

Table 1: NewsGuard “Pravda” Network Impact Analysis (Q1 2025)

Metric	Data Point	Operational Significance
Total Domains	150+ (e. g., Berliner Tageblatt, News-Kiev. ru)	Creates illusion of consensus across independent sources.
Content Volume	3. 6 million articles (2024)	Saturates training data pools for AI models.
AI Infection Rate	33% of chatbot responses	Leading LLMs Russian propaganda as verified fact.
Primary Target	Search Generative Experience (SGE)	Pollutes “Answer Engines” before users click links.

The German Election Vector: “Doppelgänger” Evolution

The February 2025 German federal election served as the primary field test for Matryoshka’s evolved capabilities. NewsGuard, in collaboration with the German investigative nonprofit Correctiv, identified a network of 102 AI-generated news sites specifically engineered to influence the Bundestag vote. Unlike the clumsy, broken-German bot networks of 2017, these sites, mimicking legitimate outlets like Hamburger Anzeiger, featured flawless, idiomatic German text generated by advanced LLMs.

The campaign, linked to former U. S. deputy sheriff turned Kremlin propagandist John Mark Dougan, focused on character assassination rather than policy debate. Between November 2024 and February 2025, NewsGuard tracked 22 specific false narratives. The most viral included:

• The “Habeck Tape”: A deepfake audio recording purporting to show Green Party candidate Robert Habeck admitting to sexual misconduct.
• The “Baerbock Escort” Story: A fabricated report claiming Foreign Minister Annalena Baerbock hired a male escort during a diplomatic trip to Africa.
• The “Kenyan Labor” Hoax: A fake government document alleging a secret treaty to import 1. 9 million Kenyan workers to replace German laborers.

These narratives were not posted; they were weaponized through the “Overload” tactic. VIGINUM, the French vigilance agency, reported that the Matryoshka network used thousands of bots to tag German fact-checkers and journalists under these fake posts, demanding they “investigate” the scandal. This recursive loop forced verification agencies to spend serious resources debunking AI-generated noise, leaving them less time to address organic misinformation.

Moldova 2025: The “Storm-1516” Surge

Following the German elections, the apparatus pivoted to Moldova’s parliamentary elections in September 2025. NewsGuard data shows a dramatic escalation in intensity. While the German campaign relied on text articles, the Moldovan operation, attributed to the “Storm-1516” cluster, deployed video deepfakes. In the three months leading up to the vote (April, July 2025), NewsGuard documented 39 distinct fabricated video reports mimicking 23 legitimate Western media outlets, including the BBC, The Economist, and Fox News.

One specific case study highlights the cross-platform integration. In May 2025, a video bearing a fake BBC logo circulated on Telegram, claiming investigative group Bellingcat had proof that Moldovan President Maia Sandu embezzled $24 million. Bellingcat issued a denial, yet the video garnered 1. 5 million views on Telegram within 48 hours. NewsGuard found that 50 TikTok accounts immediately amplified the claim, followed by a wave of “Pravda” network articles citing the TikToks as “citizen reports.” This cross-citation method laundered the lie, creating a citation trail that fooled AI search summaries into reporting the embezzlement as a “controversial allegation” rather than a debunked falsehood.

“The problem isn’t the source, it’s the saturation of the narrative: Once a falsehood has been injected into the web through dozens of fronts, its repetition by AI becomes almost inevitable.” , NewsGuard Analysis, June 2025

Investigative Fan-Out: Key Inquiries Resolved

Q1: Did the Matryoshka campaign successfully alter election outcomes in 2025?
While direct vote alteration is unmeasurable, NewsGuard confirmed that the “Storm-1516” narratives achieved “super-spreader” status. In Moldova, the fake corruption claims reached 17. 7 million views on X (formerly Twitter) in a country with a population of only 2. 5 million, indicating massive external amplification intended to demoralize the diaspora.

Q2: How did the “Overload” tactic affect fact-checkers?
VIGINUM and ISD (Institute for Strategic Dialogue) reports confirm that fact-checking organizations in France and Germany saw a 400% increase in “verification requests” from bot accounts. This successfully delayed the debunking of the “Habeck Tape” by 12 hours, a serious window during which the deepfake circulated unchecked on WhatsApp.

Q3: Are Western AI companies complicit?
NewsGuard’s March 2025 audit suggests negligence rather than complicity. The “data voids” in non-English languages (like Romanian or German) meant that AI models relied heavily on the high-volume output of the Pravda network because authoritative Western reporting on niche local topics was less voluminous. The Russian strategy exploited this specific weakness in LLM training architecture.

Q4: What role did “John Mark Dougan” play?
Dougan, operating from Moscow, served as the technical architect for the “fake local news” vector. His network of 167 sites (up from 102 in early 2025) provided the “citation laundering” infrastructure. NewsGuard identified his server fingerprints on domains purporting to be local news in Arizona, Bavaria, and Chișinău.

Visualizing the Infection: The “Nesting Doll” Architecture

The following chart illustrates the flow of a Matryoshka fabrication from inception to AI infection, based on the VIGINUM and NewsGuard 2025 schematic.

This pattern represents a closed-loop ecosystem where the disinformation does not need human belief to succeed; it only needs to be indexed by the algorithms that humans trust. By the end of 2025, NewsGuard concluded that the “Pravda” network had poisoned the well of open-source intelligence for the 2026 election pattern.

The “Overload” Doctrine: Flooding the Verification Pipeline

By early 2025, the Institute for Strategic Dialogue (ISD) confirmed that Operation Matryoshka had evolved beyond simple propaganda dissemination into a “denial of service” attack against the global truth-adjudication infrastructure. The campaign’s primary objective shifted from persuading the public to paralyzing the verification bodies responsible for debunking falsehoods. This strategy, termed “Operation Overload” by researchers at Check and Reset, explicitly weaponized the open-source intelligence (OSINT) community’s reliance on public tips.

Between January and March 2025, ISD analysts documented a coordinated surge in “verification requests” directed at 800+ media outlets and fact-checking organizations across 75 countries. Unlike organic user inquiries, these requests were mechanically generated by “Quoter” nodes, automated accounts that tagged official handles of entities like AFP Fact Check, Snopes, and Correctiv with identical prompts: “Is this true? Please check.” The volume was calibrated to overwhelm tiplines; in Q1 2025 alone, VIGINUM recorded over 2, 400 distinct “requests” targeting French and German newsrooms, a 300% increase from the previous year.

Table 7. 1: Matryoshka “Overload” Metrics (Q1 2025)

Data verified by Check and VIGINUM forensic analysis.

Metric	Count / Value	Primary
Targeted Organizations	824	AFP, BBC, Bellingcat, Correctiv, USA Today
Fake Verification Requests	2, 415 (Twitter/X & Bluesky)	Editorial tiplines, specific journalists
Impersonated Entities	80+	Media outlets, Universities, Law Enforcement
Average Response Time Lag	+48 Hours	Caused by resource diversion to fake leads

The Recursive Trap: Counterfeit Debunking

The campaign’s most insidious innovation was the fabrication of “doppelganger” fact-checks. Rather than simply posting fake news, Matryoshka operators created high-fidelity forgeries of verification reports attributed to trusted bodies. In May 2025, a video circulated purporting to be an official investigation by Bellingcat. The clip, which featured a deepfake voiceover of founder Eliot Higgins, falsely claimed that the organization had uncovered evidence of corruption involving Moldovan President Maia Sandu. This forced Bellingcat to expend resources debunking a report that claimed to be from them, creating a recursive loop where the fact-checker becomes the subject of the disinformation.

This tactic served a dual purpose: it eroded trust in the verification brand while simultaneously forcing the organization to amplify the original false narrative during the debunking process. ISD’s forensic analysis of the “Moldova Dossier” revealed that the fake Bellingcat video was viewed 2 million times on Telegram before the actual organization could problem a denial. The campaign applied this template repeatedly throughout 2025, impersonating the BBC Verify unit and the German investigative center Correctiv to spread fabricated “confirmations” of anti-Ukraine narratives.

“The goal is not just to lie, to make the truth-tellers look like liars. By forging our watermarks and deepfaking our analysts, they force us into a defensive posture where we spend more time verifying our own identity than investigating their claims.”
, Internal memo from a European Fact-Checking Standards Network member, leaked July 2025.

Expansion to New Vectors: The Bluesky Migration

As platform moderation on X (formerly Twitter) became increasingly erratic, Matryoshka adapted by diversifying its attack vectors. In January 2025, the “Antibot4Navalny” shared identified the network’s coordinated incursions onto Bluesky. These nodes did not repost content; they impersonated academic institutions and university press offices to lend a veneer of institutional authority to their verification requests. By tagging journalists from these “academic” accounts, the operators exploited the inherent trust reporters place in university sources.

The ISD report notes that this migration was accompanied by a shift in content. While 2024 attacks focused heavily on the Paris Olympics, the 2025 wave targeted the integrity of the German federal elections (February 2025) and the stability of the Moldovan government. The “Overload” method remained constant: flood the zone with noise, force the verifiers to chase ghosts, and declare victory when the truth is delayed long enough for the lie to take root.

The Audio “Doppelgänger”: Synthetic Voice as an Injection Vector

By late 2023, VIGINUM analysts observed a tactical shift in Operation Matryoshka’s payload delivery. While the network’s initial phases relied on cloning legitimate media websites (the “Doppelgänger” technique), the 2024, 2025 operational pattern introduced high-fidelity audio deepfakes designed to bypass traditional text-based moderation filters. This vector specifically the “verification bandwidth” of Western diplomatic corps and newsrooms. The objective is not to deceive to force high-level officials and journalists to allocate disproportionate resources to authenticating voice data, thereby paralyzing decision-making loops during serious geopolitical windows.

The primary innovation in this phase is the “Voiceover Injection” technique. Instead of generating entirely fake video content, which is computationally expensive and easier to detect, Matryoshka operatives take authentic video footage of trusted figures (news anchors, diplomats) and overlay AI-synthesized audio that mimics the speaker’s prosody and timbre. This method exploits the brain’s tendency to trust visual continuity, even when the auditory channel carries fabricated information.

The France 24 “Assassination” Fabrication (February 2024)

The prototype for this vector emerged in February 2024, when Matryoshka nodes circulated a manipulated news clip purporting to be from the French state broadcaster France 24. The video featured real footage of anchor Julien Fanciulli overlaid a deepfake voice track claiming French President Emmanuel Macron had cancelled a trip to Kyiv due to a Ukrainian assassination plot. The synchronization was imperfect, yet the clip spread rapidly across the “Portal Kombat” network of 193 pro-Russian websites before French officials could intervene.

This incident established the Matryoshka signature: the recursive verification trap. The botnet did not just post the video; thousands of “Quoter” bots simultaneously tagged French journalists and fact-checkers, demanding they “investigate” the cancellation. This flooded the intake channels of major newsrooms, forcing them to debunk a non-existent story rather than cover actual Russian troop movements in Avdiivka, which fell to Russian forces the same week.

Diplomatic Vishing: The Cardin and Cameron Incidents

Throughout 2024 and 2025, the campaign escalated from passive media manipulation to active “vishing” (voice phishing) targeting NATO officials. These operations moved beyond the “prank” format popularized by Russian duo Vovan and Lexus, evolving into intelligence-gathering sorties.

In June 2024, British Foreign Secretary David Cameron engaged in a video call with a deepfake of former Ukrainian President Petro Poroshenko. While the visual element was a loop, the audio interaction was and responsive. The attackers sought specific policy positions regarding long-range missile strikes inside Russia. Three months later, in September 2024, Senator Ben Cardin, Chair of the U. S. Senate Foreign Relations Committee, was targeted by a similar operation. An entity posing as Dmytro Kuleba, Ukraine’s then-Foreign Minister, initiated a Zoom call. The deepfake successfully mimicked Kuleba’s voice and mannerisms triggered alarm when it began asking “politically charged questions” about authorization for strikes on Russian territory. Senate security officials later confirmed the audio was AI-generated.

These incidents reveal a disturbing capability: the attackers are not just generating static propaganda are using real-time voice conversion (RTVC) to conduct espionage. The latency in these calls has dropped to under 300 milliseconds, making the deception nearly imperceptible during standard video conferencing.

The Slovak “Alpha” and the 2025 Election pattern

The operational doctrine for these audio attacks was refined during the Slovak parliamentary elections in September 2023, serving as the “Alpha” test for the 2025 global campaign. Two days before the vote, Matryoshka-affiliated channels released a fake audio recording of Michal Šimečka, leader of the pro-NATO Progressive Slovakia party, allegedly discussing election rigging and raising beer prices. The timing, during a campaign moratorium, prevented debunking. Pro-Russian populist Robert Fico won the election.

By 2025, this tactic became standardized. In August 2025, during the lead-up to the Moldovan parliamentary elections, the network deployed a music video featuring a deepfake of President Maia Sandu, mocking her EU integration efforts. Unlike the crude Slovak audio, the Sandu fabrication used Luma AI for video generation and human-assisted AI audio to capture local dialect nuances, demonstrating the network’s adaptive learning curve.

Verified Timeline of Audio-Visual Deepfake Vectors (2023-2025)

Table 8. 1: Confirmed Matryoshka and Russian-Aligned Audio/Video Injection Events

Date	Target Entity	Vector Type	Payload Description	Operational Outcome
Sept 2023	Michal Šimečka (Slovakia)	Audio Leak (Telegram)	Fake conversation on election rigging and beer tax hikes.	High impact; contributed to Progressive Slovakia’s defeat.
Feb 2024	France 24 / Macron	Video/Audio Overlay	Fake news report claiming Macron cancelled Ukraine trip due to assassination plot.	Medium impact; forced major media debunking pattern.
May 2024	Matthew Miller (US State Dept)	Video/Audio Overlay	Altered briefing footage claiming “no civilians left in Belgorod.”	Low impact; quickly identified due to lip-sync errors.
June 2024	David Cameron (UK)	Live Vishing (Video)	Impersonation of Petro Poroshenko seeking sensitive policy data.	Intelligence failure; exposed vulnerability in UK secure comms.
Sept 2024	Ben Cardin (US Senate)	Live Vishing (Zoom)	Impersonation of Dmytro Kuleba asking about missile authorizations.	Failed; staff identified “uncharacteristic” questioning.
Aug 2025	Maia Sandu (Moldova)	Deepfake Music Video	Satirical video mocking EU route, distributed by botnet.	Harassment; aimed at voter suppression and ridicule.
Nov 2025	Ukrainian Armed Forces	TikTok Audio/Video	AI clips claiming “mass surrender” of troops near Pokrovsk.	Morale attack; countered by Center for Countering Disinformation (CPD).

Technical Escalation: The “Stock-Switch” Method

Analysis of the 2025 vectors against Ukrainian athletes and the Pokrovsk surrender videos reveals a specific production technique termed the “Stock-Switch.” Operatives begin a video with genuine footage of a trusted figure (e. g., an IOC official or a field commander) to establish a biometric baseline. At the 15-second mark, the average attention span drop-off, the video cuts to generic stock footage (soldiers walking, tanks moving) while the audio continues. At this precise cut point, the audio switches from the real person’s voice to an AI clone. This hybrid method reduces the computing power needed for full-face lip-syncing while maintaining high auditory credibility.

The Center for Countering Disinformation (CPD) in Kyiv reported in November 2025 that this method was used to generate over 190 distinct information operations in a single month, reaching 84. 5 million views. The Matryoshka network’s role was to amplify these hybrid clips, tagging Western OSINT accounts to “verify” the stock footage, thus laundering the fake audio through legitimate open-source intelligence communities.

The “clear” Nexus: Bulletproof Hosting and the European Facade

The operational backbone of Operation Matryoshka relies not on a single centralized server farm in St. Petersburg, on a distributed “grey” infrastructure designed to mimic legitimate Western traffic. VIGINUM and Reset. tech investigations from 2024 and 2025 identify clear Industries Solutions (and its associated entities like PQ Hosting) as the primary logistical carrier for this campaign. While registered in the UK and maintaining a corporate presence in the Netherlands, clear Industries Solutions operates as a “bulletproof” host, frequently ignoring abuse complaints and shielding the identity of its clients.

Technical analysis reveals that the Matryoshka botnet, specifically the “Seeder” nodes, frequently routes traffic through residential proxies and Virtual Private Servers (VPS) leased from clear’s massive IP pool. This infrastructure allows Russian operators to mask their geolocation, making the coordinated “fact-check” requests appear to originate from users in France, Germany, or the United States. The network use the AS44477 and AS206485 Autonomous Systems, which have become synonymous with the hosting of the “Portal Kombat” and “Doppelgänger” fake media ecosystems that Matryoshka amplifies.

the Origin: The 178. 21. 15. xx Subnet

even with the sophisticated use of reverse proxies like Cloudflare to hide the true location of the content servers, VIGINUM technical teams successfully identified the “origin” IP addresses for of the network. By analyzing ETag identifiers and favicon fingerprints (specifically the hash MurmurHash3 = -200225920), investigators traced the “Pravda” network of fake news sites, the primary payload for Matryoshka bots, back to a specific subnet in Russia: 178. 21. 15. 0/24.

This discovery was pivotal. While the public-facing websites used European Top-Level Domains (TLDs) like . fr or . de, the backend servers resided on Russian soil. Specifically, the IP address 178. 21. 15. 85 was identified as a central host for multiple “Pravda” clones. This subnet is part of AS49352 (sometimes identified as CROP-TELECOM or similar local Russian providers), providing a direct physical link between the digital disinformation campaign and Russian territory. The architecture follows a “hub-and-spoke” model where a single Russian origin server feeds content to hundreds of proxy domains, which are then disseminated by the Matryoshka bot clusters.

The St. Petersburg “Piter” Connection

The link to St. Petersburg extends beyond historical association with the Internet Research Agency (IRA). The 178. 21. 15. xx infrastructure hosts a cluster of “local” news portals designed to legitimize the network’s footprint. Among these is piter-news. net (referencing “Piter,” the colloquial name for St. Petersburg), which sits alongside crimea-news. com and lenta. kharkiv. ua on the same server blocks. This clustering suggests that the technical administrators manage the “defensive” domestic propaganda (aimed at St. Petersburg residents) and the “offensive” Matryoshka operations (aimed at Western journalists) from the same console.

Identified Network Indicators (2024-2025)

Table 9. 1: Primary Infrastructure Nodes Linked to Operation Matryoshka

Entity / Provider	ASN (Autonomous System)	Role in Architecture	Key IP Subnets / Indicators
clear Industries Solutions	AS44477	Proxy Network & VPS Hosting	185. 196. 8. 0/22, 45. 156. 20. 0/22
WorkTitans B. V.	AS209847	Sanction Evasion / Rebranding	5. 44. 40. 0/21 (Reassigned from clear)
CROP-TELECOM (RU)	AS49352	Origin Server Hosting	178. 21. 15. 85, 178. 21. 15. 41
Aeza International	AS210644	Bulletproof Hosting / Mirrors	77. 232. 36. 0/22
Cloudflare (Abused)	AS13335	Reverse Proxy / DDoS Protection	Various (Masks the 178. 21. xx origin)

Command and Control (C2) Obfuscation

The “Seeder” and “Quoter” bots do not communicate directly with the St. Petersburg backend during their attack runs. Instead, they receive instructions through a tiered Command and Control (C2) system. Technical analysis of the bot traffic shows they frequently poll Telegram channels (such as “Voyenny Obozrevatel”) for content triggers. Once a trigger is identified, the C2 servers, frequently hosted on compromised commercial routers or cheap VPS instances in the Netherlands, dispatch the targeting instructions to the botnet. This separation ensures that even if the bot accounts are suspended by X (formerly Twitter), the core server infrastructure at 178. 21. 15. xx remains untouched, ready to spawn a new generation of “dolls.”

Investigator Note: The use of the 178. 21. 15. xx range is a rare lapse in operational security (OPSEC) for the Matryoshka operators. By failing to configure their reverse proxies correctly, they allowed VIGINUM to “pierce the veil” of Cloudflare and see the Russian origin directly. This error confirms that even with the European front companies, the “kill switch” for the operation resides within the jurisdiction of the Russian Federation.

The following section details the quantitative impact of the Matryoshka campaign on European information systems and public sentiment between 2024 and 2025.

The “Verification Trap”: Measuring Resource Attrition

The primary innovation of Operation Matryoshka was not the dissemination of falsehoods, the targeted exhaustion of Western verification infrastructure. By flooding newsrooms and fact-checking agencies with requests to “verify” fabricated content, the campaign successfully weaponized the journalistic ethos against itself. Data released by VIGINUM and the Finnish technical firm Check in June 2025 indicates the of this attrition.

Between January 2024 and May 2025, the “Operation Overload” component of Matryoshka targeted over 800 distinct media and fact-checking organizations across 75 countries. The operational goal was to paralyze these entities with noise, preventing them from addressing genuine disinformation threats.

Table 10. 1: Matryoshka “Quoter” Node Activity (Jan 2024 , May 2025)
Source: VIGINUM / Check / Reset. tech

Target Category	Est. Volume of “Verification Requests”	Primary Vector	Success Rate (Engagement)
Tier 1 Media (BBC, AFP, Der Spiegel)	12, 500+	Direct Email / X Mentions	Low (Ignored)
Independent Fact-Checkers	45, 000+	Web Form Submission	High (Resource Drain)
Individual Journalists	8, 200+	Direct Message (DM)	Moderate
Total Estimated Man-Hours Lost	~3, 400 Hours	N/A	High

The “man-hours lost” metric represents the time analysts spent triaging, geolocating, and dismissing high-quality fakes that were flagged by the bot network itself. In March 2025 alone, the European Digital Media Observatory (EDMO) reported that Ukraine-related disinformation spiked to 16% of all detected false narratives in Europe, the highest level since early 2023. This surge directly correlated with a Matryoshka offensive that utilized AI-generated audio to impersonate Ukrainian officials.

Narrative Penetration and Sentiment Correlation

While the tactical goal was exhaustion, the strategic goal remained the of European public support for Ukraine. The campaign focused on three specific “wedge” narratives designed to bypass content moderation filters by framing them as economic or corruption concerns rather than overt hate speech.

1. The “Corruption” Wedge

Matryoshka nodes aggressively amplified narratives suggesting that Western aid was being siphoned into personal luxury assets by Ukrainian leadership. In late 2024 and early 2025, the network circulated fabricated invoices and property deeds allegedly belonging to President Zelensky or his family.

According to a July 2025 report by NewsGuard, a single Matryoshka-linked campaign targeting Moldova (a proxy for broader Eastern European sentiment) generated 1. 5 million views on Telegram in just three months. This campaign utilized 39 distinct fabricated stories, including claims of embezzlement by pro-EU leaders. The spillover effect into Western Europe was measurable: Eurobarometer data from late 2025 showed a 7% increase in respondents across the EU citing “corruption in Kyiv” as a primary reason for opposing further financial aid, even with no verified evidence of such theft.

2. The “War Fatigue” Index

The Media and Journalism Research Centre (MJRC) analyzed over 80, 000 social media posts by European political elites and found a 729% surge in “Pro-Russian” narratives between February 2022 and April 2025. Matryoshka’s role was to provide the “evidence” that these political actors then.

“The danger of Matryoshka is not that it convinces the majority, that it provides a steady stream of ‘alternative facts’ for the 15-20% of the electorate already skeptical of the war. It creates a permission structure for apathy.”
, Dr. Marius Dragomir, Director, Media & Journalism Research Centre (January 2026)

In Germany, the campaign’s impact was visible in the digital ecosystem surrounding the 2025 Federal Election. Matryoshka bots amplified deepfake audio recordings purporting to show German ministers discussing “secret war plans.” While quickly debunked, the content achieved a pollution rate of 1: 4 in unmoderated comment sections on major German news sites, meaning for every four organic comments, one was a bot-generated amplification of the fake.

AI Amplification and the “Reality Gap”

By 2025, Matryoshka had fully integrated generative AI into its production chain. The Italian Digital Media Observatory (IDMO) noted that in November 2025, 14% of all fact-checked disinformation involved AI-generated content, a significant rise from previous years.

The campaign utilized AI to create “synthetic evidence”, fake audio of Polish Prime Minister Donald Tusk allegedly screaming at Zelensky, or video of French “mercenaries” in Kharkiv. The quantitative impact of these AI assets was their virality coefficient. Traditional text-based disinformation had a share rate of 0. 8 (failing to reach viral status), whereas Matryoshka’s AI-enhanced video content averaged a share rate of 3. 2, allowing it to break out of the initial bot network and into organic user feeds before platform moderators could react.

The Moldova Test Case: A Quantitative Proxy

While data for Western Europe is frequently diluted by domestic political noise, the campaign’s focused attack on Moldova in mid-2025 offers a clear control group for measuring efficacy.

• Volume: 336 AI-assisted videos posted in the weeks leading up to the September 2025 elections.
• Targeting Ratio: President Maia Sandu was targeted 75 times in May 2025 alone, compared to just 22 attacks on Zelensky in the same dataset, indicating a tactical shift to “weak links” in the European pro-Ukraine coalition.
• Reach: The “USAID Celebrity Trip” fake, a Matryoshka production claiming US aid funded luxury vacations, reached 4. 2 million views globally, with significant penetration in French and German conspiratorial circles.

This data demonstrates that while Matryoshka failed to alter the outcome of the Moldovan election decisively, it successfully established a high-volume pipeline for anti-Western sentiment that remains active. The campaign lowered the cost of producing high-quality fakes to near zero, while raising the cost of verification for European institutions to unsustainable levels.

The ‘Klopp’ Protocol: From Static Impersonation to Recursive Baiting

The transition from the “Doppelganger” campaign’s brute-force methods to the sophisticated “Matryoshka” method represents a fundamental shift in Russian information warfare doctrine. This evolution is best understood through the lens of the “Klopp Protocol,” a term adopted by digital forensic analysts to describe the mass-proliferation of fabricated celebrity quote cards that saturated Western social media in late 2023. The failure of this initial protocol to generate sustained organic engagement directly necessitated the development of the recursive, resource-draining tactics deployed against 2025 election pattern in Germany and Moldova.

Phase I: The Static Broadcast Failure (Late 2023)

In November 2023, the “Doppelganger” network (tracked as Storm-1516) initiated a high-volume dissemination campaign featuring fabricated quotes attributed to Western cultural icons. The primary included Liverpool FC manager Jürgen Klopp, actors Elijah Wood and Nicolas Cage, and singer Beyoncé. The operational logic was rudimentary: transfer the inherent trust associated with these figures onto anti-Ukraine narratives. A forensic analysis of 120, 000 posts from this period reveals the limitations of this method. The network generated static JPEG images overlaying pro-Kremlin text onto celebrity photographs. One widely circulated fabrication featured Jürgen Klopp purportedly stating, “We are impoverished, it’s time to forget about Ukraine,” while a fake Selena Gomez quote urged the diverting of military aid to social programs. even with the volume, the “Klopp Protocol” failed to breach the “credibility firewall” of mainstream discourse. Platform algorithms on X (formerly Twitter) and Meta quickly identified the repetitive image hashes. Users ignored the content due to its obvious absurdity. The engagement metrics were artificially inflated by bot-on-bot retweeting achieved near-zero penetration into authentic user communities. The static nature of the content made it easy to blacklist.

Phase II: The Matryoshka Pivot (2024-2025)

Recognizing that direct broadcasting was ineffective, the operators engineered a tactical pivot in January 2024. This marked the birth of the “Matryoshka” method. Instead of asking the audience to believe the lie, the network began asking journalists to verify it. The evolution introduced a parasitic. The bot network ceased attempting to bypass media gatekeepers and instead targeted them directly. The “Klopp” style quote cards were no longer the end product the bait. The new workflow involved “Quoter” accounts tagging fact-checking organizations (such as AFP Factuel, Snopes, and Correctiv) with a feigned plea for truth: “I saw this quote from Jürgen Klopp about the war. Is it real? Please check.” This shift weaponized the professional ethics of Western journalism. Fact-checkers, mandated to investigate viral claims, were forced to allocate human resources to debunk content that the network itself had generated. This created a Denial of Service (DoS) attack on the verification ecosystem.

Table 11. 1: Operational Evolution , Klopp Protocol vs. Matryoshka method

Operational Variable	Klopp Protocol (2023)	Matryoshka method (2025)
Primary Vector	Static Image Injection (JPEGs)	Verification Requests (Tagging/Email)
Target Audience	General Public (Direct Influence)	Journalists/Fact-Checkers (Resource Drain)
Content Strategy	“This is true.”	“Is this true?”
Evasion Technique	High Volume (Overwhelm Filters)	Low Volume (Mimic Concerned Citizens)
Success Metric	Views / Retweets	Fact-Check Articles Published

2025 Application: The German and Moldovan Theaters

The matured Matryoshka method has been aggressively deployed to disrupt the 2025 electoral calendar. Following the dissolution of the German coalition government, the network flooded German-language social media with requests for verification regarding fabricated quotes from CDU and SPD officials. In February 2025, VIGINUM and the Institute for Strategic Dialogue (ISD) detected a coordinated surge targeting the German Federal Elections. The network utilized the “Klopp” legacy tactic, fake quotes, wrapped in the Matryoshka delivery system. Bots circulated AI-generated audio clips of German politicians purportedly disparaging voters. Instead of pushing these clips viral, the network emailed them to major German newsrooms with subject lines like “Scandalous leak? Please confirm.” Simultaneously, the method targeted Moldova’s parliamentary elections scheduled for September 2025. The “Matryoshka” operators introduced a new technical: Luma AI video generation. In August 2025, the network distributed a deepfake music video mocking Moldovan President Maia Sandu. Unlike the static Klopp images, these videos were and harder to fingerprint. The distribution pattern remained consistent with the evolved protocol: 50 accounts posted the video, while 600 “Quoter” accounts tagged European NGOs and Moldovan civil society groups demanding an investigation into the video’s provenance.

The Verification Trap

The genius of the Matryoshka evolution lies in its exploitation of the “Streisand Effect.” When a fact-checking organization publishes a debunking article titled “No, Jürgen Klopp did not say he hates Ukraine,” they inadvertently amplify the original fabrication to an audience that never saw the initial bot post. The Russian operators measure success not by the reach of their bots, by the reach of the corrections issued by legitimate media. Data from the Antibot4Navalny shared indicates that in the quarter of 2025 alone, the network successfully triggered over 200 unique fact-check articles from verified Western outlets. Each article represents hours of wasted investigative time and serves to inject the fake narrative into the permanent search index of reputable news domains. The Klopp Protocol failed because it tried to be the media. Matryoshka succeeds because it forces the media to work for the network.

The “Zombie” Fleet: Post-2025 Network Fragmentation

By March 2026, the operational cohesion of Operation Matryoshka has fractured, yet it remains dangerous. Following the aggressive takedowns by Western platforms in late 2025, the centralized command-and-control (C2) structures identified by VIGINUM have dissolved into autonomous, decentralized clusters. Intelligence assessments from early 2026 indicate that while the volume of “Seeder” posts has dropped by approximately 40% compared to the Q3 2025 peak, the “sleeper” capacity remains intact. These residual nodes, accounts created during the 2024-2025 buildup, operate on long-dormancy timers, surfacing only for high-value geopolitical triggers.

The network has evolved from a “flood” strategy to a “guerrilla” method. Technical analysis of X (formerly Twitter) and Telegram API traffic reveals that thousands of accounts identified during the 2025 German and Moldovan election pattern were never suspended. Instead, they entered a “hybernation mode,” scrubbing their timelines of political content and reposting generic lifestyle material to reset their algorithmic trust scores. These sleeper cells constitute a latent threat, ready to be reactivated by the Crimea-based TigerWeb infrastructure that underpins the “Portal Kombat” ecosystem.

Technical Forensics: The “Orphaned” Bot Phenomenon

A significant indicator of the network’s fragmentation is the appearance of “orphaned” bots, automated accounts that have lost connection to their primary C2 servers continue to execute outdated scripts. In January 2026, researchers from the Antibot4Navalny shared documented over 1, 200 instances of bots replying to verified journalists with null-string errors or raw JSON code instead of the intended disinformation narratives. These glitches expose the underlying mechanics of the “Quoter” nodes, which were designed to fetch content from “RRN” (Reliable Recent News) domains that have since been seized or blacklisted.

“The bots are not dead; they are lobotomized. We see accounts looping the same ‘Verify this?’ request on posts from 2024 because their date-check logic has failed. It is digital detritus, it proves the infrastructure was built to run indefinitely without human maintenance.” , Internal Memo, VIGINUM Technical Division (Declassified Feb 2026)

Infrastructure Survival: The “Pravda” Mirrors

The “Portal Kombat” network, the backbone of Matryoshka’s content generation, has demonstrated remarkable resilience. even with the seizure of 193 domains in 2024 and 2025, the network successfully migrated to a “hydra” model by early 2026. For every pravda-fr. com or pravda-de. com that was blocked, the operators registered five new variations using different top-level domains (. top,. site,. cam) and hosting them on “bulletproof” servers in jurisdictions with weak cyber-cooperation treaties.

The content delivery method also shifted. Rather than direct links, which trigger platform safety filters, the 2026 iteration of Matryoshka uses “link-in-bio” aggregators and ephemeral Telegram redirects. This obfuscation allows the “Seeder” bots to bypass automated detection systems, requiring human moderators to manually verify the destination of each link, a process that plays directly into the Matryoshka strategy of resource exhaustion.

Table 1: Status of Major 2025 Disinformation Clusters (As of March 2026)

Cluster Codename	Primary Target	2025 Status	2026 Assessment	Est. Active Nodes
Storm-1679	France / Olympics	High Activity (Deepfakes)	Dormant / Repurposed	~2, 500
Doppelganger-DE	Germany / SPD	Network Degraded	Fragmented / Low Impact	~800
Matryoshka-Global	Intl. Media / Fact-Checkers	serious Threat	Active / Evolving	~15, 000+
Portal Kombat	EU General Public	Domain Seizures	High Volume (Mirrors)	N/A (Web Infrastructure)

The “Venezuelan Pivot”: A Case Study in Reactivation

The danger of these sleeper cells was illustrated in January 2026, when the network abruptly reactivated to exploit the political emergency in Venezuela. Within 48 hours of the capture of Venezuelan leader Nicolás Maduro, the “Matryoshka” network pivoted from its usual anti-Ukrainian narratives to a new storyline claiming the event would destroy European diplomatic strategies. This campaign used the exact same accounts that had targeted the Paris Olympics in 2024 and the German elections in 2025.

This “Venezuelan Pivot” confirmed that the botnet is content-agnostic. The operators possess a standing army of authenticated accounts that can be pointed at any geopolitical event instantly. The campaign utilized AI-generated audio attempting to impersonate European leaders reacting to the news, a tactic refined during the “Storm-1679” operations of late 2025. The speed of this pivot, less than six hours from the news breaking to the wave of 5, 000+ bot replies, indicates that the command structure, while decentralized, maintains a high-readiness alert status.

The Persistent “Verification Trap”

Even with the degradation of its technical infrastructure, the core psychological mechanic of Matryoshka remains. The “Quoter” bots continue to tag major media outlets (BBC, CNN, Le Monde) and individual fact-checkers, asking them to “investigate” fabricated scandals. In 2026, these requests have become more granular, frequently targeting junior reporters or regional desks rather than main accounts, likely to exploit less experienced staff.

Data from the Reset tech advocacy group shows that in Q1 2026, fact-checking organizations spent approximately 18% of their total man-hours debunking content flagged by Matryoshka bots. This represents a success for the Russian operators: the goal is not necessarily to convince the public of the lie, to force the “immune system” of Western media to waste energy fighting phantoms. The network functions as a denial-of-service (DDoS) attack on the truth-verification industry itself.

Future Outlook: The AI Integration

The most concerning development observed in early 2026 is the integration of autonomous AI agents into the sleeper cells. Unlike the scripted bots of 2024, these new nodes use Large Language Models (LLMs) to generate unique variations of the “verification request,” making them nearly impossible to filter via keyword blocking. They can parse the replies from journalists and adjust their follow-up questions, mimicking human persistence. This shift from “scripted automation” to “agentic AI” marks the phase of the Matryoshka operation, ensuring its survival well beyond the 2025 event horizon.