Loading threat actor…
Matryoshka is a Kremlin-linked Russian information operation active since at least 2024 that conducts coordinated online influence campaigns using fabricated media content, impersonation of legitimate news outlets, and inauthentic amplification across social platforms. The operation has been linked to the Moscow-based Social Design Agency and is associated with broader Russian state influence efforts. Its activity is designed to manipulate public discourse, inflame social and political divisions, undermine trust in democratic institutions and elections, and weaken support for Ukraine and other positions opposed by the Russian state. The operation is known for producing fake articles, manipulated social media posts, and synthetic audio or video content styled to resemble established Western and local media brands. Reported tradecraft includes AI-generated voice cloning, doctored broadcast segments, fake headlines, and coordinated dissemination through layered account infrastructure. In Germany, the campaign used seeder and amplifier accounts, including strategically created, purchased, or hijacked accounts, to spread polarizing narratives around regional elections and to discredit politicians at federal, regional, and municipal levels. On Bluesky, operators compromised hundreds of real user accounts and used them to publish fabricated news videos and articles, indicating a shift from simple fake personas to account hijacking of moderately influential users such as journalists and academics. Matryoshka has repeatedly targeted fact-checking and media ecosystems as part of its operating model. A characteristic tactic is to seed false narratives and then draw journalists or fact-checkers into responding, after which Russian propaganda channels cite the fabricated material and its debunking to create the false impression that the narrative originated organically in Western discourse. The operation has also expanded across multiple platforms including X, TikTok, Telegram, Facebook, Instagram, YouTube, and Bluesky, and has used stand-alone fake news sites and bot networks. Observed targeting includes Ukraine-related narratives, French and Armenian information environments, Moldova’s electoral environment, and German elections. In Moldova, the operation pushed dozens of fabricated narratives ahead of parliamentary elections. In Armenia, it has been identified as part of a broader Kremlin information offensive around the 2026 election period. During the Milano-Cortina 2026 Winter Olympics, the network used AI voice cloning to fabricate broadcast-style segments, including false claims involving Ukrainian athletes, demonstrating its use of synthetic media in high-visibility international events. Matryoshka is best characterized as a state-aligned influence actor rather than a conventional intrusion-focused threat group. Its core capabilities center on spoofing, reconnaissance of information environments, session hijacking through compromise of real social-media accounts, and coordinated post-exploitation abuse of those accounts for propaganda dissemination. Its dominant motivation is influence operations in support of Russian geopolitical objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information influence operation targeting German regional elections through falsified media-style videos, AI-generated content, social media seeding/amplification, and polarizing narratives intended to undermine trust in democratic processes and deepen East/West social tensions.
Referenced as part of a documented 2025–2026 Kremlin information offensive targeting Armenians ahead of Armenia’s 7 June 2026 election.
Influence operation using AI voice cloning and fabricated broadcast segments to spread false narratives during major sporting events.
Pro-Kremlin propaganda campaign that hijacked real Bluesky users' accounts to post fake content since 2024.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.