A short video, made to look like a news broadcast from a well-known German network, with English subtitles, calls for the country to be split into East and West. It bears the signature of no newsroom, but of a computer. Under the hashtag TimeToDivideGermany, “Time to Divide Germany,” automated accounts on the platform X spread the claim in August 2026 that a new division was a “historical necessity.” The sender was not sitting in Saxony or Berlin, but inside a Russian operation we have been tracking for weeks.
Now the Federal Office for the Protection of the Constitution has confirmed what our reporting on “Matryoshka” had already mapped out weeks ago. The agency is now finally officially warning about a disinformation campaign that Russia is said to have launched ahead of several state and local elections in September, and it explicitly links it to the “Matryoshka” network. The method keeps repeating itself: short English-language videos that imitate the look of well-known German media, paired with sensational headlines and one-sided claims. Their goal, according to the agency, is to pit East against West and fuel hostility toward the federal state. Politicians at the state and local level are also supposed to be discredited. The main targets are said to be parties whose positions run counter to Moscow’s interests.
The timing is deliberate. This fall, state elections will be held in Saxony-Anhalt and Mecklenburg-Western Pomerania, both on the territory of the former East Germany, along with the election for the Berlin House of Representatives and local elections in Lower Saxony. Anyone trying to split a society along its most sensitive seam looks for the weeks before votes like these. The old border, long gone, is being reopened like a wound. The story of the “historical necessity” of a new division is no accident. A federal state whose regions can be turned against each other loses the strength to act together, and an East that feels betrayed by the West becomes receptive to anyone promising rupture. The fact that the attacks are aimed especially at parties whose positions run against Moscow’s interests shows the political direction of the campaign. The division that seemed to have been overcome in 1990 returns as an image that becomes a little more real every day the more often it is shared.
But what exactly is “Matryoshka”? You have to understand the doll to understand the campaign. The name itself is an operating manual, given by the “Bot Blocker” project. One fake sits inside the next, one account hides behind another, and a message moves layer by layer through the networks until its origin can no longer be found. Open the outer doll and there is another one inside, and at the very center there is nothing. That is not a glitch, but the design: a message with no origin, a copy whose original never existed. The fake video shows a broadcast no one ever aired, the fabricated quote is attributed to someone who never said it. Where a lie once twisted a truth, here a sign takes the place of something that never existed at all.
The operation behind it works in two directions. On one side, dozens of fake profiles are created, some pretending to be ordinary citizens, others posing as independent media or research organizations, and all of them pump out posts every day in the tone of the local area so the foreign element goes unnoticed. On the other side, the same message moves in lockstep across multiple platforms, dressed up with borrowed logos from Western media and human rights organizations as a seal of authenticity. What emerges is not one big lie, but artificial chaos in which truth and falsehood become harder and harder to tell apart, both in Russia and abroad. And this is where the attack really begins. It is not aimed at this fact or that fact, but at the ability to judge. Old propaganda wanted to persuade, this one wants to exhaust. Anyone flooded with enough contradictory versions of the same event eventually believes none of them, not even the documented one, and a person who no longer holds anything to be certain is no longer free, only easier to steer.
As early as 2016 and 2017, public warnings were being issued about Russian “psychological operations,” disinformation, influence campaigns, propaganda and subversion. Under Maaßen, the BfV - yes, the same Mr. Maaßen shown in the image below this paragraph - was also dealing with APT28 and possible Russian cyberattacks surrounding the 2017 federal election. The problem was recognized, but Germany still failed at the time to build anything close to an adequate defense against the industrial-scale manipulation through bots, fake media and coordinated social networks that we are seeing today.
France shows what this machine looks like when it is turned against a single person. There, the same infrastructure is targeting Gabriel Attal, the leader of the Renaissance party and a presidential candidate from Emmanuel Macron’s camp. Attal has filed a complaint over suspected foreign interference. Before that, France’s General Secretariat for Defense and National Security and the oversight body Viginum had warned him. Viginum attributed the operation with a high degree of confidence to the “Matryoshka” network. One day before his first complaint, on August 4, we reported on eight fake videos designed to look like broadcasts and front pages from major French media outlets. The first complaint was filed on August 5, and the next operation followed one day later, on August 6.
The complaint concerns foreign interference and fake, manipulated content capable of undermining the integrity of the 2027 French presidential election. Accounts posed as media outlets, spread fabricated video reports and front pages, and put words into the mouths of Attal and his relatives that were never spoken.
The fakes follow a revealing method: they take a grain of truth and build invention around it. Attal was falsely said to have Parkinson’s disease, along with a drug addiction he supposedly inherited from his father, who died in 2015 and was alleged to have died of an overdose. He was also accused of making lenient comments about illegal immigration. On top of that came the claim that he had helped launder military aid money intended for Ukraine, as well as a fabricated multimillion-euro donation to the Israeli army. Real editors-in-chief of major publications were assigned fake quotes, some racist and some homophobic, to give the fabrications the weight of respectable voices. Every video ended with the same message: that the latest scandal would damage Attal’s chances.
Eight fake videos were designed to look as if they came from BFM, Le Monde, AFP, France 24 and four other major French media outlets. Every video ends the same way: “The scandal will weaken Attal’s standing ahead of 2027,” even though each clip invents a different scandal. Attal announced his presidential candidacy on May 22 and is widely seen as Macron’s political heir.
None of it stands up to scrutiny. Only the framework is true. Attal is openly gay and was in a registered civil partnership with politician Stéphane Séjourné. As education minister, he banned the Muslim abaya in schools in 2023. The anti-corruption organization Anticor did in fact lose its accreditation in 2023, but because of a court ruling and with no connection whatsoever to a “foundation run by his father.” Yves Attal, a film producer, died in 2015. There is no evidence for the overdose claim, just as there is none for Parkinson’s, addiction or the comments about migrants attributed to him. A false whole is built from a true fragment. That is how the doll works. The effect does not depend on the lie being believed. It is enough for it to remain in circulation. Once doubt is planted, it can grow without evidence, and a candidate who is constantly forced to deny accusations is weakened simply by having to do so. The fabricators rely on the laziness of memory, which keeps the accusation and forgets the correction.
The campaign against Attal was the first major operation of its kind aimed specifically at the 2027 election. France is targeted regularly. Earlier, the accounts spread alleged messages from the hacked government messenger Tchap and attributed to Defense Minister Catherine Vautrin a plan to turn Armenia into a staging ground against Russia. Attal himself announced his candidacy on May 22, 2026, in Mur-de-Barrez in the Aveyron region. As a former prime minister, he is seen as Macron’s political heir, while Macron is barred by the Constitution from running for a third term. Within his own camp, Attal faces Édouard Philippe, who had already entered the race in September 2024.
There is no coincidence between Berlin and Paris, but the same calculation. Where elections are taking place, an open society is at its most vulnerable because it depends on the very trust this campaign is trying to destroy. The German domestic intelligence service can issue warnings, Viginum can attribute operations, but both arrive only after the images are already circulating. The painstaking groundwork is done by small newsrooms and volunteer monitors whose resources are nowhere near the scale of the opponent they are facing.
First, check whether the supposed post actually exists on the website or official account of the media outlet it claims to come from. Look for fake logos, unfamiliar fonts, strange subtitles, bad edits or language that does not sound like that outlet. Do not assume a video is real just because it looks real, because images, audio, voices and subtitles can now be faked very convincingly. Search the specific claim separately and check whether other reputable sources confirm it. Look at the account spreading it too: When was it created, what did it post before, and does it publish an unusually large number of similar items? Especially outrageous or sensational posts should not be shared immediately, because that reaction is exactly what these campaigns are designed to trigger. If something looks suspicious, save a screenshot, the link, the date and the account, because such material often disappears quickly. And if a claim cannot be verified, “unconfirmed” is always better than passing it along unchecked. The most important sentence is this: Just because a video looks real today does not mean it is real.
There are two countries and the same doll. In Germany, a country is supposed to be cut open along the line of its old division; in France, a candidate is supposed to be smeared before an election, and in both cases the weapon is not the single lie but the sheer volume that eventually wears down all trust. The defense is unspectacular. It consists of naming the source before it hides inside the next doll and patiently separating what is true from what is invented. The fact that a newsroom recognized the operation earlier than the agency is not something to boast about, but a warning. Where the voices that check facts fall silent, the empty doll wins. It has no content, only a goal. The danger is not that people believe one particular lie, but that they begin treating truth and fabrication as equally valid and stop looking for the difference. In the end, the only thing standing between that exhaustion and independent judgment is whoever still asks questions.
Investigative work like this is extremely time-consuming because every claim, every video, every account and every supposed source has to be checked individually, traced back and compared with the others. That is why this report matters to anyone who reads, shares or gets news through social media. When fake posts made to look like they come from real media outlets can no longer be recognized as fake at first glance, the attack is not only on a candidate, but on the public’s confidence that it can still tell what is true from what is made up.
Warning for All WordPress Users
Several things are happening at the same time right now. New security vulnerabilities are being discovered, so WordPress has been pushing out core updates in quick succession, while automated bots and scanners are mass-searching websites for open login pages, outdated plugins, known vulnerabilities and misconfigured servers. Anyone using WordPress 7.0 should therefore update to the currently released version 7.0.4. These requests are often completely automated and do not only target large sites. If a vulnerable installation is found, attackers can, in the worst case, inject malicious code, create new users with administrator privileges, alter content, read data, redirect visitors to other websites or use the site for further attacks. Large numbers of 404 requests and failed login attempts do not necessarily mean an attack has succeeded, but they do show that websites are being probed constantly. Anyone using WordPress should keep the core, plugins and themes up to date, remove extensions they do not need and add extra protection to backend access.
Updates – Kaizen News Brief
All current curated daily updates can be found in the Kaizen News Brief.
To the Kaizen News Brief
