Imagine sitting at a cluttered newsroom desk, coffee in hand, when an email pings in from a name you vaguely recognize. The subject line reads: “Exclusive tip — you need to see this.” Inside is a link to a story that looks professionally produced, complete with a familiar news logo and a headline shocking enough to make you sit up. The only problem? It never happened. The person who sent it may not exist. The outlet whose logo appears never published a word of it. This is the everyday reality exposed by a new study from the cybersecurity firm TrendAI, which spent 94 days — from July 6 to October 7 — shadowing a Russian-affiliated disinformation operation known as Matryoshka. Also called Operation Overload or Storm-1679, the campaign has been active since at least September 2023, but in recent months it turned its attention to the United States midterm elections. Over that period, researchers examined a sample of 155 emails sent directly to newsrooms, and from those messages they traced more than 800 accounts and channels spreading coordinated content across X, TikTok, and Telegram. Matryoshka is not a generic bot farm. It is a shape-shifting machine of influence, one that had previously aimed its fire at Ukraine, international organizations, the Paris Olympics, and Moldova’s elections. Now it had recalibrated its methods for the American political arena, and the people in its crosshairs were real candidates with real families, real reputations, and real voters who would have to sort truth from fiction.
What makes Matryoshka so unnerving is not its technical sophistication but its blunt, low-cost pragmatism. We tend to imagine Russian disinformation as a world of Hollywood-grade deepfakes, with AI-generated faces moving and speaking in eerily realistic videos. That is not what this campaign mostly did. Instead, it relied on simpler, cheaper tricks: taking existing footage and overlaying it with fabricated headlines, generating AI images designed to look like breaking-news graphics, writing fake articles, designing fabricated magazine covers, and forging official-looking documents. The goal was not to fool facial-recognition software or to pass a pixel-level inspection. The goal was to create something that could move fast, get screenshotted, and stir outrage before anyone had time to verify it. To give that content an air of legitimacy, the campaign systematically spoofed the logos, colors, and layout of recognized news organizations such as CNN, ABC, CBS, and The Washington Post. Imagine scrolling through social media and seeing what appears to be a breaking-news alert from one of these outlets. It looks credible. It carries the weight of trusted journalism. But it is counterfeit in every meaningful way. This method does a double injury. It hurts the candidates who are falsely accused, because a lie can travel around the world before the truth has laced up its shoes. But it also harms the media institutions themselves, which are forced to spend significant time and resources debunking stories they never published, chasing phantom sources, issuing denials, and trying to rebuild trust that they never broke. The disinformation operation weaponized the public’s belief in journalism to make journalism itself look helpless and unreliable.
The content of the campaign was as ugly as it was predictable. TrendAI found false allegations levelled at a range of prominent American political figures, including Senators Cory Booker, John Hickenlooper, Jon Ossoff, and Mark Warner, along with other candidates running in key contested states. The campaign targeted Georgia, North Carolina, Michigan, Ohio, Texas, Maine, Alaska, and Iowa — a map that reads like a battleground list for who controls the Senate, the House, and the broader narrative of American democracy. The false claims involved severe matters: sexual misconduct, financial corruption, tax evasion, violence, criminal activity, and conspiracy theories. These are not mild smears. They are reputation-ending accusations designed to trigger maximum emotional response. Researchers deliberately refrained from repeating the specific allegations, knowing that even debunking a lie can give it new life. But they noted a troubling side effect: local news outlets occasionally referenced the material, sometimes to fact-check it, sometimes just to dismiss it, and in doing so they inadvertently helped disseminate it. This is the cruel paradox of disinformation campaigns. A candidate can be damaged by a story that is completely false, not because people believe it, but because they hear about it, mention it, argue about it, and remember the name attached to it. The lie becomes a talking point, a vague sense of suspicion, a “where there’s smoke, there’s fire” feeling that no correction can fully extinguish. The campaign understood this human flaw deeply. Its architects knew that the most effective falsehoods are not the ones that convince everyone, but the ones that make everyone wonder, even just for a moment, whether something might be wrong.
Digging into the mechanics, the scale of the operation becomes clearer. TrendAI identified 545 accounts on X, 91 percent of which have since been suspended, along with 261 TikTok accounts, all of which were suspended, and ten Telegram links leading to seven channels. These were not all simple bots posting repetitive slogans. Many were dormant accounts purchased on commercial marketplaces, accounts with years of history, normal-looking usernames, profile photos, past posts, and the quiet appearance of real people. They were activated when needed, repurposed to amplify fake stories, and then sometimes discarded. The operation also used an especially clever form of harassment: it proactively contacted journalists and fact-checking organizations by email and social media tags, pretending to ask for help evaluating suspicious posts. The messages sounded like legitimate tips from concerned citizens. But they were traps. Every minute a journalist spent analyzing a fabricated graphic or verifying a fake quote was a minute of valuable time stolen from real reporting and absorbed into the campaign’s machinery. The tactic also gave the content additional exposure, because journalists would often mention the suspicious material in their debunks, creating another round of publicity. Interestingly, most of the posts achieved low organic reach, meaning they did not automatically explode into millions of views. This has led researchers to wonder whether the primary goal was actually to reach a broad general audience or to exhaust the people whose job it is to command public trust. In other words, the campaign may not have needed most people to see the fake content. It may have only needed journalists, fact-checkers, researchers, and political staffers to drown in it, to be overwhelmed by a constant tide of nonsense. That is the true meaning of the name Operation Overload. It is not just about what the public believes. It is about making the entire information ecosystem so noisy, so contradictory, and so exhausting that people simply give up trying to know what is real.
Matryoshka did not emerge from nowhere, and it will not disappear after the midterms. The operation has been active since at least September 2023, and its history reads like a tour of global flashpoints. It targeted Ukraine, seeking to destabilize a country already under physical attack. It aimed at international organizations, attempting to undermine their credibility and coordination. It turned its attention to major public events such as the Paris Olympics, weaponizing a moment of global unity to spread confusion. It tried to interfere in elections in Moldova, testing methods and refining playbooks in a smaller, less protected environment. Now it has applied those lessons to the United States, and it has already begun redirecting its resources toward the French presidential election scheduled for April 2027. This is not a one-off hack or a lone actor spreading rumors. It is a persistent, adaptive, professionalized network that learns as it goes. Each campaign is a training ground for the next. The tools improve, the fake accounts become more realistic, the stolen logos become harder to distinguish from the originals, and the targets become bolder. The deeper danger is not that a single candidate loses an election, although that is bad enough. The deeper danger is a slow, corrosive erosion of public confidence in everything. When false stories wear the logos of real news organizations, and real news organizations spend their days trying to prove that they did not publish those stories, the public eventually begins to doubt all reporting. People start to feel that no source can be trusted, no fact is solid, and no election can be trusted. That atmosphere of cynicism and confusion is exactly what the campaign wants. You do not need to make everyone believe a lie. You only need to make enough people believe that the truth is unknowable.
So what does a human, not a security analyst, do inside this fog of war? The recommendations from TrendAI are practical and almost refreshingly simple. Media organizations and ordinary citizens should exercise great caution when encountering shocking content, especially if it comes from an unfamiliar account or is presented through a screenshot rather than a link to the original website. Verify information against official websites, candidate pages, and mainstream sources before sharing anything. Avoid responding automatically to suspicious inquiries or emails, because even a polite reply can confirm that your attention is being captured. For journalists, this means developing stronger protocols for validating tips and resisting the urge to report on viral falsehoods without doing serious verification first. For the rest of us, it means learning to pause. That pause, that moment of skepticism before we hit share, is one of the most powerful defenses we have. Matryoshka, after all, is named after those nested Russian dolls. You open one and find another inside, and another, and another. The disinformation campaign works the same way. You debunk one story, and another appears. You suspend one account, and it was already replaced. You correct one fake headline, and the corrected version begins circulating as if it were another headline. But the deepest layer of the doll is not a secret foreign agent. It is a reflection of our own attention, our own fear, our own willingness to believe the worst about people we already disagree with. The campaign cannot force us to click, or to share, or to feel outrage. It can only create the conditions. The rest is up to us. If we are careful, patient, and determined to protect the truth, we can make these tools less effective. We can verify before we share. We can trust reliable sources while still questioning them. We can remind ourselves that information is a shared public resource, and every act of sharing is a small act of citizenship. Matryoshka will keep building its dolls. But we are not powerless against it. We are the ones who decide what gets heard, what gets amplified, and what eventually fades away.