Russian "Matryoshka" Operation underway

Erich Ster was unsure what to think when he first saw the fake videos about himself. On the one hand, he found the outrageous falsehoods almost amusing, but at the same time they deeply concerned him.

"I don't want things like this to be on the internet. But at the same time, I know there's nothing I can do about it," Ster said.

The student is a candidate for the Left Party in the Saxony-Anhalt state election and hopes to win a seat in the state parliament on September 6 thanks to his second-place position on the party's electoral list.

Social media posts falsely claim that he:

• murdered his grandmother to inherit her apartment;
• killed an online model out of jealousy;
• organized secret LGBTQ sex parties at a German university; and
• helped the Bauhaus University Weimar give better grades to students from western Germany.

 

All of the videos also falsely claim that major German media outlets, including Frankfurter Allgemeine Zeitung (FAZ), Stern TV, ARD, and Spiegel TV, reported on these alleged "crimes."

None of these claims is true, however, and none of the media organizations mentioned ever reported such stories. Even their logos and branding were forged to make the fabricated reports appear authentic.

EPA/TOMS KALNINS

A spokesperson for the Burgenland district police confirmed to DW that Ster had not committed any murder and is not under investigation. A spokesperson for Bauhaus University Weimar also confirmed that there were no reports of the alleged sexual parties or the purported grading scandal at the university.

More than 180 fake posts ahead of the elections

According to DW, the videos are part of the Russian Matryoshka operation, also known as Overload.

Ahead of the state elections, DW has so far identified more than 180 fake posts on X, Bluesky and TikTok.

The findings are based on a detailed database compiled by the anonymous research collective Antibot4Navalny, which was originally established to expose disinformation campaigns targeting Russian opposition leader Alexei Navalny, who died in a penal colony in Siberia. Today, the group monitors Russian online influence operations.

DW reviewed the fake posts published since June 24. Notably, the disinformation appears only on weekdays, suggesting that the operators behind the campaign suspend their activities on weekends.

Many of these posts are specifically designed to discredit candidates ahead of the upcoming state elections in Saxony-Anhalt and Mecklenburg–Western Pomerania, the election for Berlin's House of Representatives, and local elections in Lower Saxony, all scheduled for September.

These elections are widely seen as an important barometer of the political mood in Germany and as a test for the country's restructured federal government.

Everyone targeted except AfD and Sahra Wagenknecht's Alliance

Observers are not surprised that the Matryoshka operation has focused on Germany, but they are surprised by its scale.

"The campaign has been active across multiple platforms since September 2023. It has already targeted Germany's federal election, elections in Moldova and Armenia, as well as the Olympic Games in France," said Julia Smirnova of the Berlin-based Center for Monitoring, Analysis and Strategy (CeMAS), which has been tracking the Matryoshka operation for years.

"What is new is that Russian actors are now targeting individual candidates in state elections," Smirnova said.

According to her observations, candidates from almost every political party have been targeted by the false claims, with the exception of the far-right Alternative for Germany (AfD) and the Sahra Wagenknecht Alliance (BSW).

"Even before the federal election, we observed that Russian influence campaigns consistently sought to discredit candidates from all democratic parties while simultaneously promoting AfD and BSW. What we are now seeing ahead of the state elections is a continuation of Russia's long-term strategy of supporting parties viewed as more sympathetic to the Kremlin while discrediting other parties and candidates."

Pablo Maristany de las Casas of the Institute for Strategic Dialogue (ISD), which analyzes influence and manipulation campaigns such as Matryoshka, reached a similar conclusion. He also sees clear parallels with previous Russian influence operations. The narratives and messaging remain "pro-Russian, anti-German, and hostile toward the European Union."

Who is behind the Matryoshka Operation?

Although it is not yet possible to conclusively prove a direct link to the Russian state, numerous indicators point to Russia, Maristany de las Casas said.

For example, one post on X written in Spanish inadvertently revealed a clue about its origin. In a fake story about Free Democratic Party (FDP) candidates Lydia Hiskens and Andreas Silbersack, the party was referred to by the abbreviation "SvDP," mirroring the Russian abbreviation for Svobodnaya Demokraticheskaya Partiya ("Free Democratic Party"), rather than the standard German acronym FDP.

Shutterstock, helloRuby

The Gnida Project, a group specializing in OSINT (open-source intelligence) investigations and analyses of Russian disinformation campaigns, says it has identified the Russian operators behind the Matryoshka campaign. According to its findings, the operation is technically and operationally linked to the notorious Storm-1516 unit, which is run by Russia's military intelligence agency, the GRU, and was also active ahead of Germany's federal election.

For Smirnova, there is little doubt: the current operation "is, with a very high degree of probability, a Russian campaign carried out on behalf of the Kremlin." According to her, the campaign is primarily executed by "private companies specializing in digital marketing and political influence operations."

Technically sophisticated, but the falsehoods are easy to expose

The fabricated videos are technically well produced, but minor inconsistencies compared with authentic news broadcasts reveal that they are fake. They are distributed through social media, and this form of digital impersonation—known as media spoofing—can often be detected by asking a few simple questions:

• Is the video also available on the official website of the media outlet?
• Do the design and typography match the outlet's usual style?
• Where does the footage come from, and does it actually depict the event being described?
• Does the video provide any verifiable evidence to support its claims?

 

In most cases, the answer to all of these questions is no. As a result, it quickly becomes clear that the videos are fabrications built from stolen footage, copied logos and poorly replicated visual designs.

However, on social media, first impressions are often what matter most, and many users do not take the time to verify the content they encounter.

What false narratives are being spread ahead of Germany's elections?

The narratives promoted by the current campaign fall into two main categories:

Discrediting Candidates

In one video featuring an AI-generated voice, Berlin Mayor Kai Wegner (CDU) is falsely accused of murdering a professional tennis player. No evidence is presented. A spokesperson for the Berlin police confirmed to DW that no professional tennis player has been murdered in Berlin recently and that Wegner is not under investigation.

Candidates from the CDU, SPD, the Greens, the Left Party and the FDP have also been falsely accused of corruption, drug use and, in dozens of cases, alleged sexual scandals.

Deepening the Divide Between East and West Germans

One fabricated video falsely presented as being from the European statistical office Eurostat claims that a large majority of West Germans consider German reunification to have been "a historic mistake."

In response to an inquiry from DW, Eurostat said: "This is a fake video. Eurostat did not produce it. Nor did Eurostat conduct the survey referred to in the video."

Do people believe these falsehoods?

The operation is still ongoing, with new fabricated content continuing to appear, making it too early for a definitive assessment. According to the experts interviewed by DW, however, its impact has so far been very limited.

"The consequences are not significant. That is also evident from the artificial inflation of the content's reach," Maristany de las Casas said.

He was referring to apparent manipulation of view counts: some videos reportedly have more than 100,000 views but almost no comments or other forms of engagement, making those figures appear highly implausible.

Research to date has shown that the impact of disinformation campaigns such as Matryoshka has generally been limited. One reason is that, unlike X, other platforms such as Bluesky and TikTok often remove such content relatively quickly.

Nevertheless, Left Party candidate Erich Ster does not want to rely solely on the platforms and their moderators. He plans to file criminal complaints over the fabricated content. He said he was unable to have one video about himself removed from X because, according to him, the platform's moderators "saw no reason to take it down."

As a result, the disinformation campaign targeting German politicians continues.