Russia's Matryoshka bot network has launched disinformation campaigns targeting elections in Sweden, Germany, and France this month, fabricating video clips branded with the logos of trusted European media outlets, Sweden's national public broadcaster SVT reported. Analysts in multiple countries found the campaign aims not to reach mass audiences but to overwhelm newsrooms' fact-checking capacity.

Fake clips target Swedish PM weeks before the vote

Seven fabricated video clips appeared on the social media platform X within a single hour on 18 August. Among them were clips branded with the logos of SVT and the Swedish newspaper Dagens Nyheter. Others hijacked the visual branding of Euronews and Germany's Der Spiegel. None were ever produced by these outlets.

The fake videos spread lies about election fraud in Sweden and directed false accusations at Prime Minister Ulf Kristersson personally. Sweden holds general elections on 13 September.

"We see this all over Europe. Russians target countries that support Ukraine," Kristersson told SVT.

Russian opposition analysis group Antibot4navalny linked the posts to Matryoshka, a pro-Russian influence campaign named after the Russian nesting doll.

Also known as Operation Overload and Storm-1679, Matryoshka was first exposed by Antibot4navalny in 2024 and is one of several Kremlin-linked disinformation networks alongside the Doppelgänger campaign and Storm-1516. A previous SVT review found the majority of Matryoshka's posts aimed to influence Western support for Ukraine.

Explore further

Sweden says it stopped Russian operation to discredit country and EU. But no one will be prosecuted

Campaign targets newsrooms, not audiences

The fabricated posts rarely get more than a few hundred or a few thousand genuine views, Antibot4navalny told SVT. Analysts say the campaign is not primarily designed to reach a large audience. Matryoshka operators actively push fabricated posts to journalists and fact-checkers, often disguising them as verification requests. A 2024 report by France's state anti-disinformation body Viginum suggested the campaign aims to distract and overload newsrooms' fact-checking resources through large volumes of targeted requests. In posts targeting Sweden, the network tagged the social media accounts of several outlets, including SVT and Dagens Nyheter.

The campaign may also seek to generate media coverage that amplifies its message or makes it appear more influential than it is, the think tank ISD assessed.

Explore further

Sweden detains Russians who “camped” near home of CEO of Gripen jets Ukraine is buying

Germany and France targeted the same month

On 12 August, Germany's domestic intelligence agency, the Federal Office for the Protection of the Constitution (BfV), warned that Matryoshka is targeting local and regional elections in Germany scheduled for September. In early August, France's Viginum detected a Matryoshka operation directed at presidential candidate Gabriel Attal ahead of the 2027 vote. French prosecutors opened a probe into the campaign on 18 August.

In April, the network promoted false claims of Ukraine's involvement in the assassination attempt on US President Donald Trump.

German security services believe Russia was preparing to assassinate the head of a company that supplies drones to Ukraine, according to Die Zeit. Two suspected agents who surveilled him have been arrested, and officials warn the case marks a deadlier turn in Russian operations inside Germany.

Surveillance of a drone-maker

Investigators say the target is Stefan Thumann, head of the Bavarian startup Donaustahl, which makes reconnaissance and kamikaze drones for Ukraine. In December 2025, a recruit filmed his home and photographed the nameplate, focusing on the man rather than the company, security services believe. Thumann has been outspoken against Moscow, posting that "Russia doesn't want peace. It wants the destruction of the West."

Two arrests

A foreign intelligence service flagged Thumann as high-risk in December 2025. Bavarian police arrested Serhii N., a former bricklayer from Kharkiv with no intelligence training, then released him before analyzing his phones. The devices later showed contact with Russian intelligence and attempts to trail his father, investigators found. He fled to Spain, and a Romanian woman, Alla S., continued the surveillance. Both were arrested in March 2026, in Spain and North Rhine-Westphalia.

Explore further

Fourth suspect arrested in arson attack on Czech factory that made drones and thermal optics for Ukraine

Russia recruits such disposable agents online, paying people from precarious backgrounds for surveillance, arson, and sabotage, and discarding them afterward. Ukraine's own SBU security service has reported dozens of cases in 2026 of Russia recruiting Ukrainians at home for arson and sabotage, often by forging Ukrainian security summonses to pose as their own government.

The BfV, Germany's domestic intelligence service, classifies the case as a suspected planned assassination. A federal investigating judge was not convinced, so the arrest warrant cites only suspected intelligence-agent activity. Lawyers for both suspects declined to comment.

Explore further

A French factory that makes drones for Ukraine was firebombed with Molotov cocktails

A widening threat

A second German arms company is reportedly in Russian intelligence's sights, investigators say. On 11 June, Serbian officers stopped a truck of concealed explosives apparently bound for Bavaria, home to Donaustahl, Quantum Systems, and Helsing. 

The threat has precedent: agents had Rheinmetall chief Armin Papperger watched in 2024, and an FSB killing struck a Georgian exile in Berlin in 2019. It fits a broader Russian sabotage campaign across Europe. 

Thumann, now under guard, still taunts Moscow: 

"You won't break me."