Operation Overload Impersonates Media to Influence the US Election
A Russia-aligned influence operation known as Operation Overload—also tracked as Matryoshka and Storm-1679—has used fake news sites, bogus fact-checking resources, AI-generated audio, and impersonation of trusted media brands to shape narratives around the US presidential election. Researchers said the campaign has heavily targeted journalists, fact-checkers, and researchers with deceptive verification requests designed to draw false claims into mainstream reporting, while coordinated inauthentic social media activity amplified the same narratives directly to the public.
The operation has sought to undermine trust in the election process, inflame fears of political violence, and exploit polarizing issues to deepen social divisions. Reported themes included fabricated scandal narratives aimed at Vice President Kamala Harris, attacks portraying Ukrainians and the LGBTQIA+ community negatively, and messaging intended to weaken support for Ukraine; the campaign had also previously attempted similar interference around the French elections and the Paris Olympics and was expected to intensify as the US vote approached.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Campaign pushes fabricated narratives targeting Kamala Harris
The operation reportedly focuses in particular on Vice President Kamala Harris with fabricated scandal narratives. It also vilifies Ukrainians and the LGBTQIA+ community to deepen social divisions and reduce support for Ukraine.
Operation Overload shifts focus to the 2024 US presidential election
Operation Overload, also known as Matryoshka and Storm-1679, is described as targeting the 2024 US election through fake news sites, false fact-checking resources, AI-generated audio, and impersonation of trusted media brands. The campaign heavily targets media outlets, fact-checkers, and researchers with deceptive verification requests while also spreading false narratives on social media.
Operation Overload targets the 2024 French elections and Paris Olympics
The influence operation previously attempted to affect the 2024 French elections and the Paris Olympics, though the source says those efforts had limited success. This establishes earlier activity before its focus on the US presidential election.
Sources
1 reference tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US Cyber Command Disrupted Russian Election Influence Operations as Federal Defenses Eroded
US Cyber Command secretly targeted at least two Russian companies involved in covert online influence activity ahead of the 2024 US election, according to reporting that said the operation was part of a wider federal effort with the FBI, DHS, and other agencies to expose and disrupt foreign meddling aimed at voters in key swing states. The campaign reportedly pushed anti-Ukraine and anti-politician narratives, and officials said the US action slowed the Russian operation even though propaganda content continued through Election Day. The activity fits a longer pattern of Russian interference in US politics, following earlier US government findings that Moscow targeted election systems in 2016 and subsequent Justice Department charges against Russian individuals and companies tied to interference operations. Officials and former officials warn that many of the structures built after the 2016 election to counter foreign influence have since been dismantled, reduced, or paused, including functions at ODNI, the FBI, the State Department, and CISA. The rollback comes despite continued threats from Russian, Chinese, and Iranian-linked actors using fake websites, AI-enabled propaganda, and cyber activity affecting election infrastructure, raising concerns that the United States has less visibility and fewer coordinated defenses in place for future elections.
May 25, 2026
Doppelgänger Disinformation Network Targeted German Audiences
Researchers reported that the suspected Russia-aligned **Doppelgänger** influence operation ran a coordinated propaganda campaign against German audiences from at least late 2023, using a large network of coordinated X accounts, impersonated media brands, and custom-built websites to push anti-government and anti-Ukraine narratives. The messaging focused on politically sensitive issues including strikes, immigration, inflation, and elections, with the activity assessed as part of a broader effort to shape public opinion in Germany. The operation relied on multi-stage redirection infrastructure and evasive technical measures, including Base64-obfuscated JavaScript, tracking identifiers, rotating first-stage and second-stage domains, geofencing on destination sites, and infrastructure linked to **Keitaro** traffic distribution systems. SentinelLABS and ClearSky said the campaign’s tactics and infrastructure overlap with findings previously reported by the German Ministry of Foreign Affairs, *Der Spiegel*, Recorded Future, and Meta, underscoring a persistent influence effort tied to upcoming European, municipal, state, and federal elections in Germany.
Apr 11, 2025
Mueller Indictment Exposed Internet Research Agency Election Interference Scheme
A U.S. grand jury charged **13 Russian nationals and three Russian entities**, including the St. Petersburg-based **Internet Research Agency (IRA)**, with conducting a long-running campaign to interfere in the U.S. political system. Prosecutors said the operation used stolen identities, fake social media personas, political ads, and the organization of real-world rallies to inflame divisions over race, religion, and immigration while denigrating Hillary Clinton and boosting Donald Trump. The indictment said the effort began in 2014, included intelligence-gathering trips inside the United States, and continued after Election Day, while not alleging that Trump campaign officials knowingly joined the conspiracy. Subsequent reporting and official findings reinforced the scope of the operation. Earlier investigations had described the IRA as a professionalized troll farm that used proxies, scripted talking points, and fabricated online identities across major platforms, while Senate investigators later unanimously backed the intelligence community's conclusion that Russia mounted a sweeping campaign to undermine confidence in American democracy and aid Trump. Experts warned the same bot-driven influence tactics persisted beyond 2016, and Kremlin-linked businessman **Yevgeny Prigozhin**, long tied to the IRA and sanctioned by Washington, later publicly admitted that Russia had interfered in U.S. elections and would continue doing so.
May 25, 2026