Loading threat actor…
Operation Overload, also known as Matryoshka and Storm-1679, is a Russia-aligned influence operation. The content describes it as a pro-Russia / pro-Kremlin disinformation campaign that manipulates public opinion and sows discord by impersonating trusted media organizations, creating fake news and fake fact-checking content, and using coordinated inauthentic behavior on social media. Reported tactics include copying the logos, fonts, and layouts of reputable outlets; falsely attributing content to real journalists; flooding media outlets, fact-checkers, and researchers with deceptive verification requests and fake leads; and using automated bots to amplify narratives. The operation has also been observed using AI-enabled techniques, including voice cloning to impersonate journalists, fabricated voiceovers spliced into legitimate video footage, audio deepfakes, and other AI-generated propaganda distributed across Telegram, X, Bluesky, TikTok, and Meta platforms. The content states that Operation Overload has targeted multiple democratic processes and European audiences. It is described as targeting the 2024 US presidential election, with objectives including laundering pro-Kremlin narratives into mainstream discourse, undermining trust in election integrity, stoking fears of political violence and civil unrest, and exploiting divisive issues. Reported themes included fabricated scandal narratives about Vice President Kamala Harris, vilification of Ukrainians to reduce support for Ukraine, and narratives targeting the LGBTQIA+ community. The operation also previously attempted to undermine the 2024 French elections and the Paris Olympics, and was identified among Russia-linked influence operations targeting Germany’s February 23, 2025 federal elections. In Germany, the content says it aimed to inflame domestic socio-political divisions, foster criticism of the US and EU integration, undermine NATO cohesion, and expanded onto Bluesky while continuing to pose as real news organizations. The content further describes Operation Overload as active against Moldova ahead of the September 28, 2025 parliamentary elections. Since at least April 2025, it almost certainly conducted a vilification campaign against President Maia Sandu and portrayed Moldova as incompatible with Europe. Reported activity included impersonating outlets such as the BBC, Deutsche Welle, Euronews, Agence France-Presse, La Tribune, and Statistica; spreading fabricated allegations that Sandu and aides held illicit cryptocurrency assets and corrupt wealth; producing deepfakes impersonating Moldovan government spokesperson Daniel Vodă beginning July 8, 2025; and circulating manipulated images suggesting violent unrest or assassination threats. The content also states Armenia ranks third, behind Ukraine and France, among Operation Overload targets, and links the operation to AI-generated fake media targeting Prime Minister Nikol Pashinyan ahead of Armenia’s parliamentary election. Across the reporting, Operation Overload is consistently characterized as a Russian or Russia-aligned influence operation focused on media impersonation, synthetic media, fake fact-checking, and amplification of divisive or anti-Western narratives. Known aliases directly mentioned in the content are Matryoshka and Storm-1679.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Russian-aligned information operation targeting Armenia as part of broader influence activity, including election-related disinformation.
Pro-Russia influence operation using AI voice cloning and manipulated media to impersonate journalists and spread fabricated content.
A pro-Russia influence operation using AI voice cloning and fabricated voiceovers inserted into legitimate footage to impersonate journalists and spread disinformation.
Russia-linked influence operation targeting European audiences; described as part of a set of campaigns impersonating media outlets to spread Kremlin-aligned narratives.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.