Matryoshka Returns, Targeting US Midterm Candidates With AI-Generated Fake Claims
Key Takeaways
- Russia-aligned influence operation Matryoshka is adapting to target the 2026 U.S. midterms. Its operations rely on cheap text-over-video clips with impersonated logos of trusted outlets like CNN, ABC News, and The Washington Post, not costly deepfakes.
- Matryoshka prioritizes damaging the reputations of candidates and news brands over reaching large audiences. Its false accusations of sexual misconduct, corruption, and violence target candidates across swing and battleground states, and its posts earn little organic engagement.
- The campaign’s volume depends on disposable accounts. TrendAI™ Research found over 800 profiles across X, TikTok, Bluesky, and Telegram in a 94-day window, and the platforms suspended most of them quickly.
TrendAI™ Research’s new report, “Matryoshka Returns, Targeting U.S. Midterm Candidates with AI-Generated Fake Claims,” monitored Matryoshka, also known as Operation Overload and Storm-1679, from July 6 to Oct. 7, 2026, and found activity designed to spread disinformation surrounding the upcoming U.S. midterm elections.
Matryoshka is a Russia-aligned Foreign Information Manipulation and Interference campaign active since at least September 2023. Its operations have targeted legal entities, media outlets, universities, international organizations, government agencies, churches, and individuals, and it has previously used public events such as the Paris Olympics and the Moldovan election to amplify its messages. Ukraine has been a long-term target.
For our full findings and analysis, read our technical brief here.
False accusations against 2026 midterm candidates
TrendAI™ Research sampled 155 emails sent to newsrooms that linked to more than 800 profiles and channels. The emails averaged 5.5 links each, and the links included 545 X profiles (91% since suspended), 261 TikTok profiles (all suspended), 20 Bluesky profiles (9 suspended, 11 legitimate accounts), and 10 Telegram URLs leading to 7 channels.
During the observation period, the campaign spread false accusations against candidates in several 2026 midterm races. Accusations fell into five groups:
- Sexual misconduct or child abuse
- Financial corruption, tax evasion, or education misrepresentation
- Violence or criminal activity
- Conspiracy theories
- Other categories
Table 1 lists victims who have been falsely accused of financial corruption, tax evasion, or education misrepresentation, along with the impersonated source organizations, and the X account(s) that spread the disinformation. A full list of the types of disinformation and false accusations is available in the technical brief.
| Victim | Impersonated source | Spread by |
|---|---|---|
| John Hickenlooper (CO) | POLITICO | @farjul10 |
| Hallie Shoffner (AR) | MS Now | @eBou2017 |
| Cory Booker (NJ) | Washington Post | @JaiPrak79912531 |
| Chris Pappas (NH) | Mother Jones | @goutamghosh_ecl |
| James Talarico (TX) | ABC News | @GanpadharA |
| Jon Ossoff (GA) | CBS News | @HimanchalChaud1 |
| Peggy Flanagan (MN) | Mother Jones | @faizan_aadil |
| Roy Cooper (NC) | MS Now | @Duragsingh7 |
| Mark Warner (VA) | ABC News | @FROZEN844848 |
| David Corn (bureau chief of Mother Jones) | CNN | @dhrub_sudhanshu |
| Ed Markey (MA) | The New York Times | @GiselaLeite1 |
Targeted states included battlegrounds such as Georgia, North Carolina, Michigan, Ohio, Texas, Maine, Alaska, and Iowa, along with three swing states from the 2024 presidential election. The operation also targeted family members, friends, media outlets, and sponsors. Some accusations were picked up and amplified by local media, which is the kind of unintended spread the campaign relies on. The report withholds the specific claims to avoid repeating them.
Tactics and techniques
Matryoshka’s 2026 operations avoid expensive deepfakes in favor of cheap formats. These include text over recycled video clips, AI-generated images styled as breaking-news graphics, fake news articles and magazine covers, and forged official documents. Most content carries the logos of Western outlets and non-governmental organizations (NGOs) such as CNN, ABC News, The Washington Post, and Mother Jones, which borrow their credibility and force those brands to spend time denying content they never published.
The operation also uses dormant accounts bought from marketplaces, which have older creation dates and post histories that help them avoid blocking. A distinctive tactic is sending emails and tags to newsrooms and factcheckers with “fact-check requests” that point to fabricated content. It is unclear whether the aim is to overload recipients, reach the public, or both.
Recommendations
Matryoshka is persistent and adaptive, and its real purpose, whether spreading falsehoods or overloading factcheckers, cannot be determined from the data. Defense depends on denying it attention: checking before sharing, reserving public rebuttals for content that gains real traction, and holding platforms accountable for detecting and labeling the content quickly. TrendAI™ Research expects Matryoshka to shift to the French presidential election in April 2027 and will continue monitoring it.
Voters should treat videos bearing news logos with caution, especially when shared by unfamiliar accounts, and should check whether the original story appears on the outlet’s official site or verified accounts. Newsrooms and factcheckers should avoid responding to fact-check requests that match known Matryoshka patterns and should not treat view counts as a reason to respond, since artificial amplification can inflate them. Governments and election authorities should share information quickly with platforms, researchers, and the press, and should maintain accessible channels for correcting false claims and verifying official notices, including forged documents attributed to election offices.
For our full findings and analysis, read our technical brief here.