🧵 For Trump's admin, influencing its citizens with a bot network seems becoming an ordinary routine.
Today's US is one of the first G7 powers that uses bots domestically outside of an election cycle—what for a long time used to be exclusive to authoritarian states.
1/
2/
A bot network benefiting Trump; ex-DOGE Elon Musk and Vivek Ramaswamy is running in a likely collusion with an entity affiliated to Musk and/or Trump admin.
It attacks their critics, praises Trump's policies and appointees, targets swing states, affects Ukraine interests.
3/
Trump's personal "enemies" attacked by the bots:
⚔️ Judge Merchan (hush money conviction)
⚔️ @RepLizCheney (J6 Committee)
⚔️ @ABC and George Stephanopoulos ("Trump 'raped' a woman" claim)
⚔️ Rachel @Maddow (coverage of 100 days)
⚔️ Chris Wray (raid on Trump's home)
4/
Similarly, bots attacked:
⚔️ @Ilhan Omar and @AOC
(both criticized Elon MUSK and his DOGE for dismantling USAID, unlawful disruption of other national agencies)
⚔️ @TheLeoTerrell
(who was consistently calling RAMASWAMY an opportunist and a threat to the MAGA movement)
5/
Bots were blaming CA governor @GavinNewsom and LA mayor @KarenBassLA for poor response to the Los Angeles wildfire crisis in January 2025.
6/
Bots targeted ~20 Dem representatives who loudly criticized banning transgender athletes from women sports.
Many of those Dems belong to the Congressional @EqualityCaucus that denounced the ban, saying it is trying to distract the public to hide Trump govt’s corruption.
7/
Bots fiercely supported defunding Planned Parenthood—a populistic promise of the One Big Beautiful Bill (which most benefited to the rich, while generously increasing funding of ICE).
Inclusion of Defunding @PPFA could be a way for the narrow passage of OBBB through Congress
8/
Most of the Trump's appointees that bots praised are widely criticized for loyalty over qualification, unfit for their roles:
💼 Pete Hegset, Defense
💼 Kash Patel, FBI
👜 Karoline Leavitt, Press Secretary
👜 Kristi Noem, Homeland Security
💼 RFK Jr., Public Health
9/ Swing states:
🌰 OHIO
Bots advocated against iGaming bill (possibly as a favor for @GovMikeDeWine🟩); praised Frank LaRose🟪.
Both are members of the state's Redistricting Commission, a key to gerrymandering in favor of GOP.
Ramaswamy is running for Ohio governor.
10/ Swing states:
🦡 WISCONSIN
Bots interfered into elections of state's supreme court judge, largely in sync with a campaign generously funded by Elon Musk.
🌵 ARIZONA
Bots aimed at increasing the GOP turnout during presidential elections; later thanked for electing Trump.
11/
Trump's policies praised by the bots closely echo the 2024 GOP Platform:
Needless to say that bots were astroturfing around the key milestones of Trump's 2nd term:
👑 presidential election (incl smearing Kamala Harris) and its outcome
👑 inauguration
👑 upcoming 100 days
13/
Likewise, the network praised developments that could benefit to Elon Musk much more than to Trump:
🫅🏻 adoption of Community Notes from X by Facebook, Instagram (following the dismantling of their fact-checking programs)
🫅🏻 DOGE cutting govt waste spending
14/ The network impacted Ukraine:
🇺🇦 portrayed Trump as anti-war🕊️ and Harris as pro-war🪖 candidates; encouraging swing voters to stay home
🇺🇦 in response to mentions of Ukraine, was downplaying Ukraine's critical support, diverting focus to domestic issues, eg LA wildfires
15/
We reconstructed the above list of opponents, appointees and policies based on nearly 85% of bot replies, categorized unambiguously into 28+ distinct, clearly defined narratives.
Most likely there were no other narratives from the network within the scope that we analyzed.
16/
Totaling at least 1360 fake accounts, the network is powered by LLM and runs under a day-to-day human oversight for over 10 months now.
Its 123K replies gained 4.7M views overall; nearly every second reply on the average was liked or replied to.
17/ What makes them an inauthentic network?
🧩 ~80% accounts created on Sep..Oct 2024
🧩 25% replies posted at rate >200 wpm, impossible for a human typist
🧩 each bot waits ≥10s, typically 12s between its tweets
🧩 if 2 bots replied to the same tweet, a typical interval is 10s
18/ We started studying these bots in late Apr-2025, thanks to their anti-Ukraine narratives.
Our contribution to exposing this network includes:
🤲 attribution
🤲 full set of narratives, most w/background and a trigger event
🤲 archiving every piece of evidence
🤲 and more
19/
We will be likely covering more aspects of this network in separate thread(s), followed by a detailed technical report and a tool helping ordinary users to limit its impact.
What would you most like to hear about?
20/
MEDIA COVERAGE
We are most grateful to @MoharChat, @MagMill95 and their editors for covering our research for @Politico's @DigitalFuture newsletter, and to @ETBrooking for an independent assessment of our findings:
🧵 As pro-Kremlin disinfo network Matryoshka expanded to TikTok, it started to gain quite an engagement.
This is the first such a case that we encountered.
Fake video says: "Every third refugee from Ukraine intends to leave Poland after the presidential election, a poll shows"
2/4
While we can't validate authenticity of Views, Likes, Bookmarks or Reposts counts, the most popular replies look like the video has resonated with the audience
🧵 Russian state-aligned disinfo bot network codenamed Matryoshka has expanded to TikTok yesterday, complementing its regular X/Twitter presence.
On the same day the network has likely stopped its activity on BlueSky. 1/9
2/9
Matryoshka is infamous for posting only fake visuals: doctored photos of street art; videos and front pages impersonating media outlets, universities and public agencies.
So the very fact of a visual posted by the 🪆 network is on its own a strong indicator of a forgery.
@franceinter @le_Parisien 3/9
Why we believe they started TikTok only yesterday? We could not find similar TT posts / accounts related to Moldova / Sandu for 3 months to date.
While on X and BlueSky, 🪆 is for over 6 weeks now running a smear campaign targeting Maria Sandu:
🧵 Russian state is happy to manipulate public debate following the Pavel @Durov, @FranceDiplo / DGSE statements on Romanian elections.
These fake videos and covers impersonating 🇫🇷 state agencies and reputable media brands have been posted on May 20 by Matryoshka bot network.
2/ Most of the fake visuals amplify @Durov's claims and exploit the controversy to damage trust to 🇫🇷 government.
However, the bigger picture seems to be that Russian state accuses the West of its own crimes, following Kremlin's presumed earlier interference to 🇷🇴 elections.
3/ Fake 🎬 @EuroNews reinforces Durov's claim with an alleged note from Romanian MFA:
"🇷🇴 has sent a note of protest to the 🇫🇷 govt for interfering the elections with the help of Telegram.
🇷🇴 recommends 🇫🇷 to mind its own business: terrorism, illegal migration, unemployment"
🧵 Pro-Kremlin disinfo network "Matryoshka" this Friday targeted the Reporters Without Borders (@RSF_inter) with a special episode.
With hijacked RSF logo, they falsely labelled several genuine videos* as fake using a fraudulent 'INFOX' watermark.
1/7
2/7
As @_ColinGerard points out, this could be a direct response to RSF's recent report exposing how Matryoshka / Storm-1679 is repeatedly impersonating RSF to promote Kremlin's narratives:
"As a part of a corrupt scheme, Macron knowingly imposed COVID-19 vaccines that harmed French people's fertility, dramatically shifting birth rates in favor of immigrant populations."
🧵 1/4
2/4
As in many previous episodes across many campaigns, Matryoshka used AI-cloned voices here to repurpose pre-existing authentic videos from scholars to allegedly claim any talking points deemed useful to Kremlin at the moment.
3/4
This episode is a part of ongoing anti-Macron campaign.
Lasting for over a year now, its latest trigger was likely Macron's March 03 statement on extending the France’s nuclear umbrella to the European allies.
🧵 In 3 days, pro-Kremlin fake-video operation received 3 debunking statements from FBI, totaling 1.5M views and counting.
This operation is active since at least Sept 2023. My team was first to report this operation back in Jan 2024, we codenamed it Matryoshka 🪆 (Russian Doll)
2/
Never before has Matryoshka gained that much attention from a govt agency, in the US or overseas, at the low cost of a dozen fake videos, which is literally half of its daily(!) capacity.
These statements alone gave so much airtime that it could not possibly dream of.
3/ This is what will possibly happen next:
💡 Matryoshka will be more often impersonating govt agencies than it was doing before, for as long as that keep resulting in public statements from those agencies.