Executive summary

Matryoshka, also known as Operation Overload or Storm-1679, is a Russian influence operation (IO) aligned with the Kremlin that uses fabricated and manipulated content to target political audiences. Ahead of Germany’s 2026 state and municipal elections taking place in September 2026, ISD identified 269 Matryoshka posts across 21 days, targeting the federal government as well as regional and local candidates from the Christian Democratic Union (CDU), the Sozialdemokratische Partei Deutschlands (SPD; Social Democratic Party), Alliance 90/The Greens, Die Linke and the Free Democratic Party (FDP) with a broad range of fabricated allegations. As of 2 September 2026, Matryoshka’s campaign targeting Germany’s elections is still ongoing.

Rather than demonstrating Matryoshka’s impact, this activity shows how the operation can be anticipated, identified and countered. Despite its volume (269 posts), Matryoshka displayed highly predictable patterns and significant operational weaknesses, including recycled narratives and formats, limited local adaptation and basic production errors. Its engagement also showed signs consistent with inauthentic amplification, while direct reach appeared limited outside amplification by media or other actors. This ISD Investigation therefore examines Matryoshka’s current priorities, recurring tactics and limitations to help those monitoring future elections anticipate and respond to its activity.

Key findings

• Matryoshka (or Operation Overload, Storm-1670), a Russian IO aligned with the Kremlin that is active on X, BlueSky and TikTok, is targeting multiple upcoming state elections across Germany. This confirms warnings from German domestic intelligence in early 2026 that Russian influence operations could increasingly turn towards local contexts. As of 2 September 2026, Matryoshka’s activity targeting Germany’s elections is still ongoing.
• Matryoshka has targeted Germany’s upcoming state and municipal elections at a scale comparable to its activity during recent national elections. ISD’s Information Operations Monitoring Team identified 269 posts across 21 days between 24 June and 1 September 2026 on X, targeting the Saxony Anhalt and Mecklenburg Vorpommern state elections, as well as the municipal elections in Lower Saxony and Berlin. All posts targeted the federal government and candidates from parties including the CDU, SPD, Alliance 90/The Greens, Die Linke (The Left) and FDP. With the German elections only weeks away, the volume of activity already rivals that observed during Matryoshka’s campaigns targeting the Hungarian parliamentary and Armenian elections.
• Matryoshka targets regional and local candidates with a broad range of fabricated allegations, while showing limited adaptation to the local contexts it targets. The claims include accusations of abuse and violent conduct, discrimination against East Germans, hate crimes, illicit activities, political misconduct and electoral malpractice. While some narratives reflect Germany’s specific political environment, most replicate narratives used in previous campaigns and are simply repackaged for new targets. The claims are often presented through fabricated news content impersonating legitimate media outlets, mainly from Germany, though posts are largely in English. Meanwhile, linguistic inconsistencies, incorrect party affiliations and other production errors further expose the operation’s limited adaptation and lack of quality control.
• Matryoshka’s recurring tactics and operational patterns provide opportunities for detection, prioritisation and proactive response. Our analysis reveals a regimented posting schedule and suspicious account behaviour. It also analyses the mass tagging of media organisations, the use of fabricated media branding and a repetition of formats and narratives from earlier campaigns in Hungary and Armenia. This is evident in the repeated use of the same doctored videos taken from celebrities’ Cameo profiles. Such a combination of indicators can help identify the campaign’s activity and distinguish it from organic political content.
• Understanding these recurring patterns can help local stakeholders with:
  • Detection, by identifying content or accounts that warrant scrutiny;
  • Prioritisation, by helping observers decide when and where to allocate limited monitoring resources; and
  • Proactive response, by using recurring tactics and narratives to prepare before similar campaigns appear.

Going local: Matryoshka targets regional and local elections in Germany

Of the 269 posts collected between 24 June 2026 and 1 September 2026 that targeted local elections in Germany, 103 posts (38%) referred broadly to the “September Elections”, targeting elections taking place across the country, rarely specifying the regions or candidates. These posts mostly targeted the federal government, formed by CDU/CSU (90 posts) and SPD (18 posts), as well as the Greens (20 posts), with generic fabricated claims about calls to renew the divide of East and West Germany, the alleged discrimination of East Germans by government officials, and claims about the likelihood of a conflict between East and West Germany. These posts did not target individual candidates but instead sought to discredit parties governing at the federal level, presumably in the hope that these narratives would resonate in the local context.

 

The picture changes when posts refer to specific state or municipal elections: most of these claims targeted specific, identifiable candidates. For example, 94 posts were directed at the Saxony Anhalt elections, mostly targeting identifiable candidates from the region across nine different days between 30 June and 28 August. Posts not only targeted the CDU (30 mentions), the Greens (27 mentions) and the SPD (22 mentions), but also sought to defame candidates from Die Linke (18 mentions) and the Free Democratic Party (FDP; 13 mentions). At a smaller scale and across fewer days, the same parties (excluding the FDP) were targeted for the municipal elections in Lower Saxony (30 mentions across four days) and the Berlin House of Representatives Election (25 mentions across four days), as well as the state elections in Mecklenburg-Vorpommern (20 mentions across two days). These posts likewise targeted specific candidates in the respective regions. The exclusion of the FDP in all regions except Saxony-Anhalt is likely due to the party co-governing in the region, as opposed to its more negligible role in the Mecklenburg-Vorpommern parliament and the fact that it is currently not represented in Berlin.

The elephant in the room: Omitting the AfD and the BSW

Considering the data above, the absence of populist parties such as the far-right AfD and far-left BSW is particularly salient. This suggests Matryoshka’s goal is to attack established parties with a track record of governing at federal or state level with false claims, potentially seeking to strengthen anti-establishment parties that oppose the EU’s military and financial support of Ukraine in the context of Russia’s war of aggression. Both the AfD and BSW have called for an end of the EU’s sanctions against Russia and advocated for closer ties between the Bundestag and the Kremlin/State Duma. This, alongside tactics and narratives resembling those used by Russian-linked IOs, further strengthens expert’s suspicions attributing Matryoshka to the Kremlin.

Old habits die hard: Matryoshka’s impersonation of media and public figures

When it first came online in 2023, Matryoshka’s main objective appeared to be to overwhelm newsrooms and fact-checking organisations with fabricated claims. Since then, campaigns have flooded journalists and fact-checkers with fake verification requests via email while simultaneously drawing attention to such claims on X by tagging well-known organisations (usually media).^[1] As the operation developed, ISD analysts observed that it appeared to pursue a broader set of objectives, including generating media headlines that overstate Matryoshka’s actual influence and, in turn, sow division, confusion and distrust among its target audiences.

 

 

Posts follow an easily identifiable format: they contain a single sentence introducing a false claim followed by the tagging of news or fact-checking organisations en masse. Attached to the post is usually a fabricated news video or image that imitates the visual identity of an existing media outlet by copying elements of its brand identity.

Impersonating German media…with English posts

Of the 269 posts collected targeting the upcoming elections in Germany, only seven were in German. Despite mainly impersonating German media outlets (20 of the 31 outlets targeted were German), most posts were in English. Matryoshka’s limited adaptation to the contexts they target is a recurrent feature of their campaigns. In this case, the use of English in content supposedly produced by German media outlets creates a clear and often incongruous mismatch between the outlet being impersonated and the language of the content, which should raise questions about the content’s authenticity and the audience it is intended to reach. Furthermore, a smaller number of posts were also published in Spanish (7 posts), Portuguese (6), French (2), Italian (2), Polish (1 post), Dutch (1) and Korean (1). This lack of linguistic and contextual adaptation is a recurring feature of Matryoshka’s campaigns and can help local stakeholders and online users identify potentially manipulated content.

 

 

Matryoshka has also used doctored newspaper covers to impersonate legitimate media. These fakes combine authentic news elements with fabricated claims. On 1 September, for example, Matryoshka published covers depicting prominent actors allegedly opposing Friedrich Merz, Germany’s Federal Chancellor, and the CDU ahead of the elections. The operation also circulated images of alleged graffiti in public spaces calling for the renewed division of Germany.

 

Impersonating public figures with AI-generated voiceovers

Based on the latest campaign targeting the German elections, about 40 percent of Matryoshka’s videos seem to use AI voiceovers on these faux news posts. The tone and cadence of such AI voiceovers is designed to impersonate the voices of real public figures or generally resemble news presenters, presumably intended to add an additional layer of credibility.

 

For example, on 1 September, Matryoshka’s #StopMerzToday campaign framed Chancellor Merz as a warmonger and called on voters not to support the CDU in the upcoming elections. To make these claims appear to come from well-known public figures, the campaign used real clips of celebrities such as Sarah Jessica Parker and Mike Tyson taken from their Cameo profiles. The videos then switched to stock footage or images, while an AI-generated voice mimicking the celebrity delivered Matryoshka’s fake claims. In Sarah Jessica Parker’s case, AI was used to create the impression that the actress was offering to send her used underwear to anyone who donated €100,000 to the fake #StopMerzToday campaign. The fabricated message reflects Matryoshka’s broader pattern of targeting women, the LGBTQ+ community and migrants with particularly harassing and degrading content.

 

Matryoshka’s shift plan: A Monday to Friday job

The operation follows a strictly regimented, office-like posting schedule. ISD’s monitoring efforts for Matryoshka’s campaign targeting Germany has documented how the operation exclusively posts on weekdays, from Monday to Friday, with posts surfacing between 09:00 AM and 9:00 PM CEST. However, most activity is concentrated in the afternoon and evening, with 61.2 percent of the 269 posts collected being published between 3:00 PM and 6:59 PM CEST.

 

 

However, Matryoshka’s median time between posts on a single day lasts 3:09 hours, with posts mostly being published in sustained bursts spread eight minutes from each other. These findings are consistent with previous Matryoshka campaigns monitored by ISD and indicates a coordinated and disciplined workflow as opposed to organic online activity.

For election observers, journalists, fact-checkers, and local authorities, these insights offer a practical advantage. A predictable posting schedule does not make detection automatic, but it allows scarce monitoring capacity to be concentrated during periods when activity is more likely to occur. Combined with other indicators, this can shift monitoring from a purely reactive model towards a more proactive approach, enabling observers to identify and investigate Matryoshka activity as campaigns unfold rather than only after content has gained traction.

Rinse and repeat: New election, same story?

Analysts identified five different narrative clusters used by Matryoshka to attack candidates running in the different local elections taking place across Germany with fabricated claims.

These were:

• Abuse and violent conduct: Claims falsely accusing candidates of different forms of abuse and violent conduct, such as elder, animal, sexual, or child abuse, as well as domestic and political violence, murder or sharing non-consensual synthetic intimate imagery;
• Discrimination and hate crimes: False claims targeting the federal government or local candidates for discriminating against people from East Germany, thereby allegedly fuelling a fictitious social movement for the renewed partition of Germany or even an East-West conflict;
• Illegal activity and addiction: False, defamatory claims accusing candidates of drug abuse, sex addiction or use of sexual services, as well as the illegal harvesting of organs;
• Political misconduct and electoral integrity: Posts targeting local candidates with unfounded claims of political misconduct and a lack of electoral integrity. Examples range from false accusations of corruption, illegal party funding or real estate fraud to posts spreading fabricated news around candidates’ deliberate efforts to buy votes, spread misleading election information and interfere with the election;
• Other: Disinformation about the health of candidates or policymaker’s alleged policies seeking to damage the environment or the forcibly conscript civilians to the military.

 

While some of Matryoshka’s narratives are tailored to the targeted region—such as claims about a renewed East-West divide, discrimination against East Germans, or the threat of an East-West conflict—these represent only limited variations in the narratives used across the operation’s campaign. The vast majority of its fabricated claims replicated narratives used in previous elections, including in Hungary and Armenia, and are simply recycled for new electoral contexts. This limited adaptation can help local observers anticipate the political themes and vulnerabilities that Matryoshka may seek to exploit ahead of an election.

Furthermore, by mapping narratives from past elections and monitoring Matryoshka’s ongoing activity, ISD has identified cases where the operation repackages the exact same posts used in previous elections for new electoral contexts. Manipulated videos that use AI to imitate the voices of celebrities, often based on publicly available Cameo videos, have proven particularly effective for this type of content recycling. This does not mean that observers can predict which narrative will gain traction, but it does suggest that previous campaigns provide a finite repertoire of narratives, formats and production techniques that can be incorporated into pre-election monitoring and preparedness.

Analysts also noted Matryoshka’s use of a wide range of defamatory and sensationalist narratives to maximise reach, reflecting a ‘seeing what sticks’ approach in which different claims are tested for their ability to gain traction. For example, one Matryoshka account accused the same Die Linke candidate of four substantially different allegations over a three-week period. According to publicly available information, there is no evidence that these allegations resulted in official proceedings. A ZDF Heute Stream also reported that it had contacted the relevant authorities, which confirmed that no proceedings relating to Matryoshka’s claims were underway.

Beyond overwhelming fact-checking organisations with fabricated requests, Matryoshka’s posts appear designed to drive viral engagement through extreme, ‘clickbaitable’ content, including incitement to violence. On 31 August, the operation circulated fake videos falsely portraying German celebrities campaigning against Chancellor Merz. One falsely depicted actor Daniel Brühl, misquoting him threatening to shoot and kill Merz, while another attributed to German celebrity Heidi Klum a desire for the leaders of CDU, SPD, Greens and Die Linke to die in a plane crash, using images of the parties’ leading candidates in Saxony-Anhalt superimposed on a plane. The increasingly extreme nature of these claims suggests a desperate effort to break into the political and media spotlight and maximise the operation’s visibility.

A toothless tiger? Matryoshka’s artificial engagement and revealing mistakes

Regarding its impact, Matryoshka posts exhibit observable signals consistent with inauthentic amplification of reach/engagement. Relevant signals include:

• Disproportionately high engagement spikes relative to other metrics such as likes, reshares, or account followers;
• Disproportionately high engagement spikes with little to no signs of organic discussion (comments);
• The entirety or a vast majority of engagement activity is concentrated in a single spike within an hour from publishing.

The figure below exhibits a Matryoshka post with a disproportionately high number in views relative to other engagement metrics such as likes, shares or followers. A skewed ratio between total views and other engagement metrics can be a signal of coordinated inauthentic behaviour (CIB). The absence of organic discussion (0 comments) despite such a disproportionately high view count provides an additional potential indicator of CIB.

To demonstrate Matryoshka’s inauthentic amplification reach, analysts used Brandwatch, a social listening tool, to examine how likes developed over time. The graph (figure 20) shows how the entirety of one Matryoshka post’s likes came within a single spike within the hour following publication. This would be extremely unlikely to happen organically, as this measure strongly hints towards the inauthentic amplification of reach; a distinct CIB indicator typical for Matryoshka content.

 

The analysis above points to an important finding: Matryoshka’s engagement appears to be largely inauthentic, with seemingly little organic interaction. While its narratives are designed to harm candidates, polarise public debate and undermine confidence in elections, their direct reach appears limited outside of amplification by media or other actors. This effectively shows that platform measures, including reducing the visibility of suspicious content in search results and suspending accounts involved in these campaigns, could play a crucial role in limiting Matryoshka’s ability to reach wider audiences.

Mistakes

Further evidence of Matryoshka’s limited effort and potential use of automation in generating and translating its posts can be seen in occasional mistakes. For example, the names of candidates and organisations are misspelled (figure 21), the caption and attached video of a post target different candidates (figure 21), or candidates are linked to the wrong party (figure 22).

Another example provides insight into Matryoshka’s potential Russian-language production workflow and use of automated translation. ISD identified a Spanish-language post targeting an FDP candidate from Saxony Anhalt (figure 22). The post incorrectly identified the candidate as a member of the “SvDP” rather than the FDP. Analysts found that translating “Free Democratic Party” into Russian produces “Svobodnaya demokratischeskaya partiya”, abbreviated as “SvDP”. The unusual abbreviation is consistent with the content having passed through a Russian-language translation process before being produced in Spanish.

Taken together, these findings point to a broader operational weakness: the same standardisation that allows Matryoshka to reuse content across electoral contexts also creates observable patterns that monitoring parties can exploit. While repeated narratives and formats indicate what to look for, predictable account and posting behaviour indicate where and when to look. Meanwhile, production inconsistencies provide additional signals for assessing authenticity. These indicators are most useful when combined, rather than treated as standalone proof.

Conclusion: limitations and looking ahead

While this investigation shows that Matryoshka content can be anticipated and, when multiple indicators are considered together, attributed and pre-bunked, an important question remains over when such findings should enter the public domain. Publicly exposing the operation can help inoculate audiences against its tactics, but it can also increase the visibility and notoriety of its narratives. This potentially provides further media attention and demonstrates the operation’s continued relevance to those funding it.

These findings create a strategic choice for those monitoring Matryoshka. They can either closely track and expose its activity when content shows signs of gaining traction, or they can proactively demonstrate the operation’s weaknesses and limitations. The latter can serve as a ‘show of strength’ but should be carefully calibrated to avoid amplifying the narratives it seeks to counter.

With several German elections imminent and Matryoshka already beginning to target France’s 2027 presidential election, understanding these patterns will be essential to anticipating its activity, calibrating responses, and limiting the impact of future campaigns.

Recommendations

The findings above suggest that the most useful response is not simply to increase monitoring volume, but to make monitoring more targeted and anticipatory, while better connecting to response efforts. Local actors can use recurring indicators to decide what to monitor, when to concentrate resources, when to escalate suspicious material, and how to prepare responses before campaigns gain traction.

Based on these findings: ISD recommends German authorities and relevant stakeholders to:

Strengthen local monitoring capacity. Invest in and facilitate cross-stakeholder monitoring efforts at the local level, rather than concentrating resources primarily at the federal level. This should address existing gaps in local awareness, skills and funding for countering foreign interference.

• Invest in local capacity building. Provide local authorities, civil society organisations and relevant media actors with the training, tools and resources needed to identify, monitor and respond to foreign information manipulation and interference.
• Establish clear escalation and information sharing mechanisms. Develop transparent protocols for sharing relevant information between government and law enforcement agencies, civil society organisations and media outlets, including defined pathways for escalating emerging threats.
• Develop crisis response frameworks for Foreign Information Manipulation and Interference (FIMI) campaigns. Establish coordinated response frameworks that enable relevant stakeholders to assess, communicate and respond to FIMI campaigns in a timely manner.
• Intelligence services should initiate proceedings in order to attribute Matryoshka. Encourage the relevant German authorities to establish procedures for publicly attributing foreign influence operations such as Matryoshka when sufficient evidence is available. Public attribution, as demonstrated by previous cases such as Storm 1516’s fake videos purportedly showing election ballots being manipulated during the 2025 federal election, can help raise awareness and establish a shared understanding of the threat.
• Invest in strategic communication and develop innovative response strategies. Strengthen strategic communication capacity and develop approaches that publicly expose the tactics and limitations of influence operations without inadvertently amplifying their narratives. These efforts should help the public recognise and understand the potential for FIMI, particularly in the context of elections, while providing clear and actionable information about how to assess suspicious content. Effective responses should be designed to reach audiences in ways that are credible, accessible and likely to resonate with the public.

End notes

[1] To a lesser degree, Matryoshka is also known to be active on Bluesky and TikTok.