The Matryoshka disinformation network, linked to the Russian authorities, has begun spreading fakes about the shooting in Kraków, in which six people were killed. This was reported by the Bot Blocker project. Fake videos passed off as reports by Western media claim that Ukraine was involved in the attack and that Ukrainians are rejoicing at the deaths of Polish citizens.
In brief
- On Monday, fake videos about the Kraków shooting began circulating on X and Tumblr
- The videos claim that the gunman allegedly acted on the orders of the SBU and used weapons resold by Ukraine, and that Ukrainians are celebrating the deaths of Poles
- The fakes were made from genuine news reports to which fabricated segments were added
Fake videos about the Kraków shooting began spreading on X and Tumblr on Monday. In total, researchers from the Bot Blocker project found five such videos.
Bot Blocker (Antibot4Navalny) is an independent research project that identifies organised bot networks and disinformation campaigns on social media. Among other things, it tracks the activity of the pro-Kremlin Matryoshka network, which spreads fakes disguised as material from well-known international media.
The authors of the fakes push two main narratives. According to the first, Ukraine was allegedly involved in the attack. The second aims to convince Europeans that supporting Kyiv threatens the security of their own countries.
To spread these claims, the Matryoshka network used fake video reports passed off as material from well-known international media.
A video styled as a Euronews report claims that the Kraków gunman bought his weapon on the black market. Its authors link the case to Ukraine, claiming that for several years the country has allegedly been reselling weapons received from Western partners as military aid.
A video passed off as a Deutsche Welle report claims that the Kraków gunman acted on the orders of the Security Service of Ukraine (SBU). His target was allegedly a Ukrainian citizen who was slightly injured and managed to escape. The authors compare the incident to the attack on Ukrainian businessman Vadym Yermolaiev, founder of the Alef corporation, who was injured in an explosion in Monaco in June 2026. The video also claims that the Kraków attack was disguised as a mass shooting. At the end, citing unnamed experts, it predicts a rise in similar attacks allegedly organised by Ukrainian intelligence services.
A video bearing the logo of The Times claims that the Polish police are short of funding because of spending on aid to Ukraine and Ukrainian refugees. According to the authors of the fake, the same is happening in other European countries, above all France, Germany and Italy.
The authors of a video distributed under the CNN brand claim that a wave of posts mocking the Kraków attack, with the hashtag “A good Pole is a dead Pole”, has allegedly appeared in the Ukrainian segment of the internet.
As the Bot Blocker researchers note, a distinctive feature of this campaign was the use of what were probably genuine news reports by these outlets. The authors of the fakes kept the original headlines and openings of the reports, but added fabricated segments at the end presenting the pro-Kremlin version of events.
At the same time, the real reach of such posts remains small. According to Bot Blocker, the network’s participants artificially inflate view counts, while videos aimed at European audiences usually get no more than a thousand organic views, and often only a few hundred.
