Matryoshka attacks Democrats ahead of the US midterm elections

The Russian disinformation network Matryoshka is attacking almost exclusively Democratic candidates ahead of the US midterm elections: Bloomberg analysed 130 of its fake videos and doctored newspaper front pages, and their view counts on X were inflated by bots. The operation is well documented, no one has measured its impact on voters, and US intelligence – according to The New York Times – believes that ahead of the 3 November vote chaos matters more to Moscow than victory for one party.

In brief

• Bloomberg analysed 130 fakes produced by the Russian Matryoshka network between 10 September and 9 October; they targeted Democrats in 20 of the 35 Senate races and in 29 of the 36 gubernatorial elections.
• According to an estimate by the Antibot4Navalny group, a campaign post on X gained an average of 56,000 views, of which only around 2,100 (3.8%) may have been organic, that is, not generated by bots.
• Graphika links these materials “with high confidence” to the Russian Operation Overload, but no one has publicly identified who approved a specific attack.
• According to The New York Times, US intelligence agencies believe that the Kremlin has approved a campaign aimed at creating chaos, and they see no attempts to attack voting machines.
• There is no evidence that the fakes have changed voters’ views; the risk grows where they overlap with the domestic dispute over the integrity of the elections.

The video looks like an ABC News report: James Talarico, the Democratic candidate for the Senate in Texas, allegedly paid OnlyFans models. Another video, bearing the CBS News logo, reports that the IRS has found eight undeclared properties belonging to Senator Jon Ossoff of Georgia. Talarico denied the allegation through his spokesperson, and the allegation against Ossoff is not supported by public records. Both videos come from a collection which Bloomberg reported on 16 October.

The collection is based on the findings of Antibot4Navalny, an anonymous group of volunteers who track Russian bot networks; they were confirmed and supplemented by analysts from dTeam and the US company Graphika. According to Bloomberg (review on TVP World), the campaign targeted Democrats in 20 of the 35 Senate races and in 29 of the 36 gubernatorial elections. This is why the collection features Senator Amy Klobuchar, who this year is running for governor of Minnesota.

The first wave, which ran from 10 to 14 September, was described by Graphika. Among the nine targets were Ossoff, Talarico and the Senate candidates Sherrod Brown of Ohio and Roy Cooper of North Carolina, who were collectively accused of corruption, antisemitism and misconduct. As the independent Russian outlet The Insider established, the network attributed to Cooper a fabricated statement about admitting another 12–15 million immigrants to the United States.

The second pillar is celebrities. AFP documented videos in which, among others, Alyson Hannigan and Eric Roberts “expose” the Democrats’ crimes, while Sarah Jessica Parker calls Volodymyr Zelensky and the Democrats Nazis. The actors contacted by the agency distanced themselves from the recordings.

The third storyline is the most interesting. Graphika recorded videos passed off as BBC, CNN and Politico material, according to which it is the Democrats who are conducting “false-flag” operations, that is, posing as the adversary. To make them more convincing, the videos cited the French agency VIGINUM and Brandy Zadrozny, an MS NOW (formerly MSNBC) journalist who researches disinformation. This is an inoculation for the future: every subsequent exposure of a Russian influence operation is meant to look like part of a partisan game.

The name Matryoshka was given to the network by Antibot4Navalny. In June 2024, VIGINUM, the French service for countering foreign digital interference, described it as a campaign conducted since at least September 2023 and aimed at media outlets, politicians and fact-checkers from more than 60 countries. Most of the material had previously circulated on Russian Telegram channels. VIGINUM concluded that the campaign met the criteria for such interference.

The names are not fully interchangeable. Graphika and the Finnish company CheckFirst speak of Operation Overload, Microsoft of Storm-1679, while the London-based Institute for Strategic Dialogue (ISD) treats the terms as synonyms. VIGINUM is more cautious: in a methodological document from January 2026 it treats Matryoshka and Storm-1679 as separate sets of activity, sometimes grouped together under the name Overload, because it has found no technical trace linking them. Also distinct are Storm-1516, which Microsoft tracks separately, and Doppelgänger, a network of clones of genuine news websites attributed to the Russian Social Design Agency and the company Structura. The figures from the Alethea report on the October wave of Doppelgänger therefore do not concern Matryoshka.

Attribution has to be broken down into rungs. The first is the most solid: Russian infrastructure. In 2024, CheckFirst and Reset Tech identified a residential IP address in Russia from which the operation’s emails were sent, and ISD spotted in a Spanish-language post the abbreviation “SvDP” – a calque of the Russian translation of the name of the German FDP party. The second rung is the perpetrator: Graphika believes “with high confidence” that the narratives against the Democrats were created by Operation Overload and the Foundation to Battle Injustice, founded by Yevgeny Prigozhin. The third rung – approval by the Kremlin – rests on a report by The New York Times of 18 September: according to classified US intelligence assessments, the Kremlin has “again authorized” a digital influence campaign. However, this information comes from anonymous officials, not from a declassified document. The fourth rung remains empty: no one has publicly shown who approved a specific video against a specific candidate. Attribution reaches the ecosystem, not the order.

Matryoshka does not earn trust in itself; it merely borrows other people’s: a newsroom’s logo, a star’s face, the tone of a news report. Incidentally, not every one of its videos is a deepfake, that is, a recording with a synthesised face or voice: Graphika describes authentic footage of Parker and Julia Roberts with added captions, while AFP describes Alyson Hannigan’s cloned voice and reworked greetings from Cameo, a service where celebrities record them for fans for a fee. Generative AI speeds up voice forgery, but the essence of the method is older: it is about falsifying the origin of a message, not about the perfection of the image.

Distribution has several tiers. Some accounts publish the file, others quote it and tag newsrooms, and the operators email fact-checkers asking them to “investigate” the fake; between January and September 2024, CheckFirst counted around 71,000 such emails. Bloomberg also describes the work rhythm: 5–10 narratives every working day, usually before noon, and weekends off. This is consistent with the work of a salaried team, but it does not prove who exactly is sitting at the keyboard, or where.

The most convincing evidence of manipulation concerns the counters. The Klobuchar video had 155,300 views, two likes and no shares. The Talarico item, published from an account that had 35 followers and had previously posted exclusively in Japanese, gathered 35,000 views. According to Antibot4Navalny, Matryoshka posts can gain up to 200,000 views in the first hour and then stall. The group also estimates that the average number of views of twenty campaign posts was 56,000, of which around 2,100 may have been organic. These are its own calculations, not a platform audit.

Spectacular conclusions should be treated with caution here. According to X’s definition, a view is every instance of a post being viewed by a logged-in user, including repeat viewings, not a unique viewer. The counter does not show whether the post was seen by an American, let alone a voter. A small number of likes does not prove the absence of an audience, since most viewers do not click, and the reach of an account without followers may be the result of algorithmic recommendations. Only a combination of signs provides solid grounds for suspecting automation: dormant accounts, near-zero engagement and a graph that rises vertically and then breaks off as if cut with a knife. 155,300 views are not 155,300 persuaded voters.

Why inflate the figures? The simplest explanation: apparent popularity is meant to attract real users. The reporting hypothesis is also tempting: according to it, those carrying out the work use this to show their superiors “reach”. We know such reporting from other operations: the indictment against the St Petersburg-based Internet Research Agency, the so-called “troll factory”, describes reports with metrics, and the leak from the Social Design Agency, which we wrote about in June, revealed performance metrics and a reporting hierarchy. No such documents exist for Matryoshka.

Moderation reduces resources, not capabilities. According to Bloomberg, X suspended around 80% of the accounts tracked by researchers, but new ones appear in their place. The suspension of more than 13,000 accounts announced on 14 October covered three operations, linked to Iran, Russia and China, so it does not reflect the scale of Matryoshka itself.

AFP writes that such campaigns often have minimal impact, and David Corn of Mother Jones believes that this one has not yet achieved significant reach. It was different in February 2025, when Elon Musk shared a fabricated video styled as an E! News report about alleged USAID payments to celebrities visiting Ukraine, and The Insider identified Matryoshka as its likely source. The real multiplier is not bots but genuine accounts with millions of followers.

Does the one-sidedness of this campaign contradict the thesis that Russia always plays both sides? The documents show that one does not exclude the other. In the February 2018 indictment, Special Counsel Robert Mueller’s team quotes “troll factory” instructions from February 2016: “use any opportunity to criticize Hillary and the rest (except Sanders and Trump – we support them)”. Yet the 2014 strategy already envisaged “spread[ing] distrust towards the candidates and the political system in general”. In the summer of 2016, the trolls accused the Democrats of election fraud, and on 12 November, after the vote, they organised in New York both a rally in support of Trump and a protest under the slogan “Trump is NOT my President”.

Four years later, the situation was similar. According to the US intelligence assessment declassified in 2021, Putin authorised operations aimed at denigrating Joe Biden and the Democratic Party, supporting Trump, undermining public confidence in the electoral process and deepening divisions in society. During the primaries, Russian accounts backed “outsiders” from both parties so that they could later claim that “establishment” candidates had been helped by fraud. There was no symmetry then either.

The 2026 campaign fits this pattern: a strike directed against one party and a parallel play on distrust of the system. According to some of the officials who spoke to The New York Times, the main goal is to “sow chaos rather than aid one particular party”, although the examples cited by independent researchers “have exclusively attacked Democratic candidates in swing states”. The officials also assessed the campaign as less extensive or less coordinated than some previous ones.

Races in which the candidates have roughly equal chances explain the attacks on Ossoff or Cooper, but not the coverage of 29 of the 36 gubernatorial elections – that looks more like blanketing the whole map. The conclusions are, however, limited by the sample: one network, one month, material selected by researchers. X claims that the networks it removed targeted politicians “across the political spectrum”, but it has not broken this down by individual operation. The asymmetry is a fact for this sample, not a law of nature.

The Ukrainian theme features directly in the material: besides the fake “Parker”, celebrities in the recordings described by The Insider also accuse the Democrats of supporting “the Zelensky regime”. According to the 2021 intelligence assessment, Russia sought, among other things, to reduce the Trump administration’s support for Ukraine and, more broadly, to weaken Washington, since a weaker United States would be “more open to geopolitical bargains with Russia”.

But a motif in propaganda is not the same as its outcome. A survey by the Chicago Council on Global Affairs and Ipsos, conducted on 6–8 February 2026, showed that 57% of Americans support military aid to Ukraine: 72% of Democrats, 58% of independents and 43% of Republicans. Matryoshka is thus striking the camp in which support for Kyiv is strongest. This is consistent with an intention to weaken the pro-Ukrainian coalition, but there is no evidence that these fakes have changed the figures.

Meanwhile, decisions favourable to Moscow were being taken in Washington. On 9 October, after a conversation with Putin, Trump announced a deal on supplies of Russian diesel, and the Treasury Department exempted from sanctions fuel already loaded onto tankers. We described the market context in our article on diesel prices. While pressing Kyiv over its strikes on Russian oil refineries, Washington also temporarily restricted the sharing of intelligence with it; on 18 October, Zelensky said that the exchange had resumed.

It is tempting to add a Russian script to this, but the sources point to simpler explanations: Trump justified the deal by fuel prices for farmers and truckers – that is, by electoral calculation, even if a flawed one. There is no public evidence that the Kremlin directed these decisions, and a convergence of interests does not prove coordination. The Kremlin is, however, adept at picking up other people’s narratives. On 24 January 2025, Putin said on state television that he could not help but agree with Trump that “if he had been president, if his victory hadn’t been stolen from him in 2020, then perhaps the crisis that arose in Ukraine in 2022 would never have taken place”.

For trust in elections, however, it is the American context that is key. On 4 February 2026, Tom Llamas of NBC News asked Trump about the idea of “nationalizing” elections, which in the United States are run by the states. The president spoke about corruption in Detroit, Philadelphia and Atlanta and about voter identification, and then added:

“If we need to put in federal controls as opposed to state controls – remember this, they’re [the states] really an agent. They’re really […] accumulating the votes for who wins an election. If they can’t do it honestly and it can’t be done properly and timely, then something else has to happen.”

Llamas: “Will you trust the results of the midterms if Republicans lose control of Congress?”

Trump: “I will if the elections are honest.”

– Donald Trump speaking to NBC News, 4 February 2026 (interview transcript)

In the same interview, Trump claimed that there had been cheating even in the 2024 election, which he won – it was just that his victory was “too big to rig”. He called the Russian storyline a “hoax” and pointed to China. The paradox is obvious: a politician who makes recognition of the result conditional on the elections being “honest” disregards Russian interference, while his own agencies, according to the NYT, described yet another Russian campaign this autumn.

Matryoshka supplies ready-made building blocks for this dispute. The narrative about a Democratic “false-flag operation” undermines future findings on Russian interference in advance. The documentation of the autumn campaign does not yet include material about a “rigged” 2026 election, but the precedents of 2016 and 2020 show that such narratives appeared both before and after the vote.

Sometimes the building blocks are handed to it by the opposing side itself. Between 8 and 11 October, Ukrainian drones struck three Yandex data centres. On 12 October, Zelensky said at the Warsaw Security Forum that online “it suddenly became a little easier to breathe” because there were “fewer bots”. The data do not confirm this. According to Cloudflare, a company that handles a significant share of internet traffic, it was mainly the traffic of the Yandex search engine’s indexing crawlers that fell, while malicious automated activity from its cloud moved to other Russian providers. In traffic to the posting, reply and like functions of one social platform, the company sees no unexpected changes, although it notes that it has only its own data at its disposal. Nor did Antibot4Navalny record any drop; on 15 October it warned that Matryoshka bots were already rehearsing how to use this exaggeration against pro-Ukrainian politicians and media. An ally’s exaggeration becomes ammunition for the adversary.

The escalation threshold should be described by criteria, not metaphors. Polarisation, in which the camps trust neither each other nor institutions, is the starting point. The first threshold is a constitutional crisis: institutions dispute who has the right to determine the result, state bodies refuse to approve (certify) it, the federal authorities try to take control of the vote count, or someone ignores court rulings. One can speak of civil war only in the case of organised, armed and sustained violence, usually combined with a split in the security forces. As of 20 October, only harbingers of the first threshold are visible: conditional statements about recognising the results. Nor does the available material contain any studies linking exposure to fakes with declining trust or with readiness for political violence.

Technical threats are a separate category. On 16 October, the FBI and the cybersecurity agency CISA warned election officials about phishing, smishing (fraud via SMS and messaging apps) and deepfake videos, without naming the perpetrators. According to the NYT, intelligence agencies found no attempts to attack voting machines. An influence operation and a hack of the vote-counting system are different phenomena. Russian digital propaganda can supply narratives, but decisions on certification, the courts and street protests will be taken by Americans. Matryoshka may pour fuel on the fire. Someone else is holding the matches.

Are Russian influence operations deepening polarisation and undermining Americans’ willingness to accept the results? They are trying to, and the evidence of intent and action is strong. The hypothesis that short-term attacks on candidates go hand in hand with a long-term undermining of trust in institutions is grounded in documents from 2016, 2020 and 2026. By contrast, the thesis that the Kremlin seeks civil war in America finds no evidence whatsoever in the available material. Nor do we know how many Americans saw the fakes, how many of them believed them, or whether anyone changed their choice because of them. A fake without an American loudspeaker stays within the bot network. With a loudspeaker, it becomes part of the dispute over who really won.

Author: Artur Żak