Search

Russia’s influence operation arrives ahead of the US midterms With weeks remaining before America's November midterm elections, a familiar type of content has begun appearing online. Videos resembling reports from CNN, the BBC and The New York Times accuse candidates of corruption, antisemitism and misconduct. Hollywood actors appear to denounce Democrats. Other clips claim that warnings about Russian interference are themselves a Democratic disinformation campaign. The reports are fabricated. Graphika, which tracks online influence operations, says it has identified a coordinated campaign targeting candidates in competitive US Senate races. It assesses with high confidence that the material was produced by Operation Overload, also known as Matryoshka – a long-running Russia-aligned influence operation previously active against elections and political debates in Europe and the United States. The activity coincides with a broader warning from American intelligence officials. Classified assessments reported by The New York Times conclude that the Kremlin has authorised another digital influence campaign ahead of the 2026 midterms, aimed primarily at exploiting existing divisions and undermining confidence in American democracy. There is an important distinction. US officials have not reported evidence that Russia is attempting to manipulate voting machines or alter the counting of votes. The operation is about influencing the information environment surrounding the election. Fake scandals for competitive Senate races Graphika traced a concentrated wave of activity between 10 and 14 September. Likely inauthentic or repurposed accounts distributed videos accusing Democratic politicians of corruption, antisemitism and other misconduct. The targets included Senator Jon Ossoff in Georgia, Representative Chris Pappas in New Hampshire and Texas state representative James Talarico, as well as Senate candidates Sherrod Brown in Ohio, Roy Cooper in North Carolina, Mary Peltola in Alaska, Abdul El-Sayed in Michigan, Joshua Turek in Iowa and Troy Jackson in Maine. The selection was not random. These were politicians involved in Senate contests where the result could matter to control of the chamber. The campaign did not rely on a single political narrative. Instead, it attached different accusations to different candidates – corruption, social issues, antisemitism or personal misconduct – while maintaining a consistent production and distribution model. That model is characteristic of Matryoshka: create apparently independent pieces of evidence, disguise them as journalism and distribute them through networks of disposable accounts. Hollywood celebrities who never said what the videos claimed One of the campaign's more distinctive techniques involved genuine footage of American actors. Videos featuring celebrities including Sarah Jessica Parker and Julia Roberts were altered with captions and other material to suggest they were promoting the slogan #AllDemocratsAreCriminals. The technique continued in subsequent material. Fact-checkers identified fabricated New York Times-branded videos using footage of Alyssa Milano, Sean Astin, Rachael Harris, Leonardo DiCaprio, Eric Braeden, Annie Potts and Patrick Fabian. Some of the original footage came from Cameo, where actors record personalised video messages. Their authentic images were retained while fabricated audio, captions or surrounding material changed the meaning entirely. Lead Stories compared several of the clips with the originals and found that the supposed political statements did not appear in the genuine recordings. Eric Braeden's representative separately confirmed that the claim he had joined the anti-Democratic campaign was false. The advantage of the technique is straightforward. Generative AI does not need to create a convincing celebrity from nothing. The operator can begin with authentic footage of a recognisable person and manipulate only the elements necessary to manufacture a political statement. Stealing the authority of real newsrooms Celebrity impersonation was only one layer. The operation repeatedly borrowed the visual identity of established media organisations. Graphika identified material impersonating or falsely citing the BBC, CNN and Politico, alongside references to France's VIGINUM foreign-interference agency and journalist Brandy Zadrozny. Other material reproduced New York Times-style branding. Some fabricated reports made an unusual claim: that Democrats themselves were organising disinformation or “false-flag operations” and then blaming Russia. This creates a defensive layer around the influence operation. Instead of merely distributing false political allegations, the campaign also attempts to discredit future reporting about the manipulation itself. If successful, evidence exposing foreign interference can be reframed as part of the conspiracy. Graphika says it assesses with high confidence that Operation Overload produced these videos. The technique is well established. Earlier investigations by CheckFirst and Reset Tech documented hundreds of falsified pieces of content produced by Operation Overload, often impersonating journalists, institutions and major media brands. AI-generated or manipulated material has increasingly become part of that production system. What US intelligence says Russia is trying to achieve The broader strategic picture comes from American intelligence assessments reported on 18 September. According to US officials familiar with classified findings, the Kremlin has authorised a covert digital influence campaign aimed at Americans during the 2026 election season. Its apparent objective is to seed or amplify domestic divisions and weaken confidence in the political process. Some officials described the principal aim as creating disorder rather than helping a single political party. The publicly identified Matryoshka material examined so far, however, has targeted Democratic candidates. Those two findings should not be treated as contradictory. An operation can exploit partisan divisions while serving the broader objective of making the electoral system appear corrupt, chaotic or illegitimate. US officials also reportedly assess the current Russian campaign as less extensive or coordinated than some previous election operations. Moscow is considered less focused on congressional elections than presidential contests and remains heavily occupied by its war against Ukraine. Russia has denied previous US accusations of election interference. An operation with limited reach – so far There is another reason for caution: producing large quantities of disinformation is not the same as successfully influencing voters. Matryoshka has repeatedly demonstrated an ability to manufacture content at industrial speed, but much of its material receives little genuine engagement. Researchers monitoring the network have previously warned against confusing automated distribution and platform view counts with authentic audience penetration. There are exceptions. A fabricated New York Times-style video featuring Jamie Lee Curtis had accumulated nearly 200,000 views on X by the end of 17 September, according to reporting by The New York Times. Other pieces attracted considerably less attention. There is currently no public evidence demonstrating that the campaign has changed voting intentions or will affect election results. What the September activity demonstrates is something narrower but important: a Russia-aligned influence infrastructure previously used against European elections has now turned significant attention towards the American midterms. The basic method has changed little – impersonate trusted media, manufacture scandals and use networks of inauthentic accounts to distribute them. What has changed is the production technology. Authentic celebrity footage, synthetic voices, manipulated video and rapidly generated fake journalism allow the same operation to produce more tailored material for more candidates at lower cost. The objective does not require Americans to believe every fabrication. Creating uncertainty over which videos, news reports and public statements are authentic can itself degrade trust in the information environment surrounding an election. Sources - Graphika — Russia-Aligned Influence Operation Targets US Midterm Candidates, German State Elections https://www.graphika.com/insights/russia-aligned-influence-operation-targets-us-midterm-candidates-german-state-elections - The New York Times — Russia Aims to Inject Chaos Into Elections, U.S. Intelligence Finds https://www.nytimes.com/2026/09/18/us/politics/russia-election-disinformation-us-intelligence.html - Kathimerini / The New York Times — Russia Aims to Inject Chaos Into Elections https://www.ekathimerini.com/nytimes/1315792/russia-aims-to-inject-chaos-into-elections-us-intelligence-finds/ - CheckFirst — Operation Overload: An AI-fuelled escalation of the Kremlin-linked propaganda effort https://checkfirst.network/operation-overload-an-ai-fuelled-escalation-of-the-kremlin-linked-propaganda-effort/ - CheckFirst — Operation Overload targeting the US election https://checkfirst.network/operation-overload-a-growing-disinformation-threat-now-targeting-the-u-s-presidential-election/ - Lead Stories — Fake NYT videos: Alyssa Milano, Rachael Harris and Sean Astin https://leadstories.com/hoax-alert/2026/09/fact-check-fake-new-york-times-videos-of-alyssa-milano-rachael-harris-sean-astin-falsely-claim-they-support-all-democrats-are-criminals.html - Lead Stories — Fake NYT videos: Leonardo DiCaprio, Eric Braeden and other celebrities https://leadstories.com/hoax-alert/2026/09/fact-check-fake-new-york-times-videos-of-leonardo-dicaprio-eric-braeden-other-celebs-falsely-claim-they-support-all-democrats-are-criminals.html - Brennan Center for Justice — AI Is Changing Foreign Election Influence https://www.brennancenter.org/our-work/analysis-opinion/ai-changing-foreign-election-influence - ODNI — previous US intelligence assessment of foreign election information operations https://www.dni.gov/files/ODNI/documents/assessments/NICM-Declassified-Foreign-Threats-to-US-Elections-After-Voting-Ends-in-2024.pdf - FBI / ODNI / CISA — previous joint assessment of Russian election influence operations https://www.fbi.gov/news/press-releases/joint-odni-fbi-and-cisa-statement-110424 #DISINFORMED #Episode9 #Russia #UnitedStates #USMidterms #Midterms2026 #USElections #ElectionInterference #ForeignInterference #RussianInfluence #RussianDisinformation #OperationOverload #Matryoshka #Disinformation #InformationWarfare #InfluenceOperations #FIMI #ArtificialIntelligence #AI #AIPropaganda #Deepfakes #SyntheticMedia #MediaImpersonation #FakeMedia #FakeNews #PoliticalDisinformation #CelebrityDeepfakes #SocialMediaManipulation #DigitalInfluence #ElectionSecurity #CognitiveWarfare #Graphika #OSINT #Democracy #WRLD

Russia’s fake African newsrooms – propaganda designed to look local A Facebook user in Nairobi, Accra, Johannesburg or Luanda encounters what appears to be a local news page. It publishes stories about African politics, Western influence and relations with Russia. The language is tailored to an African audience and the page presents itself not as a foreign broadcaster, but as part of the local information landscape. Behind some of these outlets, however, Meta found operators based in Russia. In its 2026 threat research, the company disclosed a Coordinated Inauthentic Behaviour network targeting audiences in Angola, Ghana, Kenya and South Africa. Meta removed 37 Facebook accounts and 29 Pages connected to the operation. Around 30,000 users followed at least one of the Pages, while the operators spent approximately $7,000 on Facebook and Instagram advertising, mostly in euros and US dollars. The numbers are relatively modest. The method is considerably more important. Rather than openly distributing Russian state messaging, the network posed as local African news sources and grassroots organisations, promoting narratives about Western colonialism and political interference while presenting Russia as a credible economic and political alternative. It was an old geopolitical message delivered through a much more effective identity: not Moscow speaking to Africa, but Africans apparently speaking to one another. A news outlet that was actually an influence operation Meta's investigation found that the network attempted to conceal its Russian origin while creating media brands that appeared indigenous to the countries they targeted. Its content amplified historical grievances against former colonial powers, criticised Western involvement in Africa and promoted closer relations with Russia. One example helps illustrate how the infrastructure was assembled. A Facebook Page targeting Kenya was called Kenya Watchtower. According to OpenAI's subsequent investigation, Facebook transparency records showed that the Page had previously been named “Farmtown5”. It appears to have been acquired or repurposed rather than built from scratch as a Kenyan news organisation. Some Pages also exposed administrator locations in Russia and Ukraine. Other elements of the network had previously targeted audiences in Zambia and Namibia. This use of apparently local identities is particularly important in the African information environment. A story published by RT or another identifiable Russian outlet arrives with an obvious geopolitical provenance. The same narrative presented by something resembling an independent Kenyan, Ghanaian or South African newsroom carries a different kind of credibility. The source appears closer to the reader, and the geopolitical interest behind the message becomes less visible. Then investigators found Dr Manuel Godsin The Facebook operation was only one part of a broader information ecosystem. OpenAI investigated related activity after receiving information from Meta and subsequently banned a ChatGPT account it assessed as likely originating in Russia. OpenAI called the campaign Operation No Bell. The account was being used to generate long-form articles and social-media posts about African geopolitics. Prompts were primarily written in English, but OpenAI also observed Russian-language instructions that the user described as coming from a manager. The operator sometimes explicitly asked the model to make the material appear less AI-generated – including requests to avoid stylistic features associated with machine-generated text and to write more like a human journalist. Many articles appeared under the name “Dr Manuel Godsin”, presented as an academic with a PhD from the University of Bergen and an affiliation with an organisation called the International Centre for Political and Strategic Studies. OpenAI could find no credible evidence that Godsin existed. Searches of Norway's National Research Information Repository and the University of Bergen library produced no record of him. Investigators subsequently discovered that a photograph used to represent Godsin had appeared years earlier on a Russian professional networking site and apparently belonged to a law student in St Petersburg. The fabricated academic identity was nevertheless remarkably productive. OpenAI identified 53 online articles carrying the Godsin byline. The fiction had moved beyond fake social-media pages and into the real media ecosystem. When propaganda enters genuine newsrooms This is the most consequential aspect of the operation. The articles were not confined to websites controlled by the influence network. Some were published by genuine African news organisations, including established South African outlets. The content mixed local political issues with broader geopolitical narratives. Some pieces criticised the United States and Britain or defended Russia's role in Africa. One accused the British NGO Crisis Action of fomenting protests in South Africa. Another praised Russia's presence in the Central African Republic. Other material addressed Kenya, Angola and relations between African governments and Washington. The mechanism represents a significant evolution from the classic troll-farm model. Instead of building an audience entirely on its own platforms, an influence operator can manufacture an apparently credible expert, generate articles in his name and persuade genuine news organisations to publish them. Once this happens, the propaganda acquires something a fake Facebook Page cannot provide: the institutional credibility of a real newsroom. OpenAI assessed No Bell's social-media impact as limited. One Facebook Page had around 3,000 followers before Meta removed it, while several others had very small audiences. But the operation was more successful in placing material in established media. In OpenAI's impact framework, it approached the level at which an influence operation breaks into mainstream media. For information operators, a single article published by a recognised outlet can potentially be more valuable than thousands of impressions generated by an obviously artificial account. A much larger network of ghost journalists Subsequent research suggests that Manuel Godsin was not an isolated experiment. In August 2026, Graphika, working with Code for Africa and with support from Meta, published a much broader investigation into Russian ghostwriting operations across African media. Researchers identified 44 ghost writers and fake experts, 38 of them assessed as high-confidence fabricated personas, operating between 2021 and 2026. Their material appeared or was quoted across 138 websites and was subsequently republished through at least 113 Facebook accounts and Pages, including authentic users, coordinated inauthentic networks and official Russian communication channels. The narratives were strikingly consistent. They included criticism of France, Ukraine and the United States; attacks on organisations such as ECOWAS and the International Criminal Court; positive portrayals of Russian involvement in Africa; praise for Russian paramilitary forces; and support for sovereignty-oriented political projects such as the Alliance of Sahel States. The operation therefore extends beyond creating fake news websites. It attempts to insert Russian-aligned narratives into the legitimate African media ecosystem using identities that appear African, independent or academically authoritative. This also explains why measuring reach through the original Facebook network alone is misleading. A fabricated article may begin with an influence operator, appear in a genuine African publication, be republished elsewhere and eventually circulate without any visible connection to Russia. At that point, the provenance of the narrative has effectively been laundered. An old Russian strategy with increasingly local faces Russia's use of local intermediaries in Africa is not new. Meta documented Russian networks using African nationals as early as 2019. In 2020 it dismantled another operation involving people in Ghana and Nigeria working on behalf of individuals in Russia, with links to previous activity associated with the Internet Research Agency. More recent Meta investigations suggest that this model has continued to evolve. Networks have increasingly relied on local freelancers, social-media managers and authentic media outlets rather than exclusively operating armies of obviously fake Russian-controlled accounts. This decentralisation offers several advantages. Local operators understand language, political sensitivities and cultural references. Authentic accounts are harder to identify than newly created synthetic personas. Local media brands can also deliver narratives without immediately triggering the scepticism associated with Russian state outlets. There is no evidence that every African journalist, freelancer or publication carrying such material knowingly participates in Russian influence activity. Meta explicitly notes in its investigations that some local contractors may not know who ultimately commissioned their work. That distinction is essential. The operation's effectiveness partly depends on precisely this ambiguity between deliberate participation, commercial content placement and unwitting amplification. The objective is to make Russian narratives look African The significance of this network is therefore not its 30,000 Facebook followers or its $7,000 advertising budget. Those figures are small compared with the audiences of major African media organisations. What matters is the distribution model. Traditional foreign propaganda asks an audience to trust a foreign source. These operations attempt to remove the foreign source from the equation altogether. A Russian geopolitical narrative can be generated with AI, attributed to an expert who does not exist, published by a media organisation that does, amplified through a Facebook Page presenting itself as local, and then rediscovered elsewhere as apparently independent African analysis. By the time the reader encounters it, Moscow may have disappeared completely from the chain of attribution. The resulting information operation is therefore less about making Russian propaganda more persuasive than about making it look as though it is no longer Russian propaganda at all. In an increasingly fragmented African media environment, that may be the more important evolution to watch. SOURCES: Meta Threat Research https://threatresearch-team.github.io/indicators/meta-h1-2026-russia-based-cib-network-1/ OpenAI — Operation “No Bell” https://openai.com/index/disrupting-malicious-uses-of-ai-no-bell/ Graphika — Umbrae Ex Machina https://www.graphika.com/reports/umbrae-ex-machina News24 https://www.news24.com/southafrica/news/ai-expert-exposed-fake-kremlin-linked-analyst-planted-stories-in-african-media-20260318-0560 Vanguard https://www.vanguardngr.com/2026/03/ai-expert-exposed-fake-kremlin-linked-analyst-planted-stories-in-african-media/ Meta — Russian Coordinated Inauthentic Behaviour, 2019 https://about.fb.com/news/2019/10/removing-more-coordinated-inauthentic-behavior-from-russia/ Meta — Russian Coordinated Inauthentic Behaviour, 2020 https://about.fb.com/news/2020/03/removing-coordinated-inauthentic-behavior-from-russia/ Meta Threat Research — Russian Use of Authentic Operators in Sub-Saharan Africa https://threatresearch-team.github.io/indicators/meta-h2-2025-russia-based-cib-network-2/ KEYWORDS: #DISINFORMED #Episode7 #Russia #Africa #RussianDisinformation #RussianInfluence #Disinformation #InformationWarfare #InfluenceOperations #ForeignInterference #FIMI #CoordinatedInauthenticBehaviour #CIB #FakeNews #FakeMedia #FakeNewsrooms #MediaImpersonation #GrassrootsManipulation #Astroturfing #ArtificialIntelligence #AI #AIPropaganda #SyntheticMedia #FakeInfluencers #SocialMediaManipulation #Facebook #Meta #OperationNoBell #AfricanMedia #MediaManipulation #Propaganda #DigitalInfluence #Angola #Ghana #Kenya #SouthAfrica #OSINT #WRLD