Matryoshka recycles Cameo celebrity clips and fake CNN…

Filed

September 11, 2026, 23:00 UTC

Actor

Russia-aligned Matryoshka / Operation Overload / Storm-1679 network (BfV named MATRYOSHKA on 12 August 2026; ISD, CeMAS and antibot4navalny treat the U.S. batch as the same operation)

Target

U.S. midterm voters and named Democratic candidates; secondary audience of newsrooms and fact-checkers the network historically pings so that a debunk becomes the distribution

Source

Impersonated Source falsified: fake personas, outlets or documents

Confidence

high Multiple independent open sources, low disagreement about the facts

Techniques

Synthetic media Transfer Name-calling Outrage bait Firehosing Accusation in a mirror

Where

United States, Germany

Campaign

Operation Matryoshka / Overload — German state elections 2026

Channels

X posts with stolen CNN branding
Bluesky accounts later suspended
TikTok copies of the same clips
Cameo personalized celebrity videos as source footage
Gucci 2023 Chime for Change Julia Roberts clip as source footage
hashtag AllDemocratsAreCriminals
direct seeding to researchers and newsrooms

Summary

On 11 September 2026 the researcher account antibot4navalny flagged a new Matryoshka / Operation Overload / Storm-1679 batch on X that impersonates CNN and names midterm Democrats including Chris Pappas, James Talarico, Jon Ossoff, Mary Peltola, Roy Cooper and Sherrod Brown. The same day Brandy Zadrozny at MS NOW reported a parallel set of doctored celebrity selfie videos, mostly cut from Cameo or a 2023 Gucci campaign, with cloned audio telling viewers to reject Democrats under the hashtag AllDemocratsAreCriminals. Bluesky suspended seven accounts; X had not, per the article. Organic reach this week is small. The method is the same factory already attributed to MATRYOSHKA by Germany's BfV on 12 August and measured by ISD and CeMAS against German state ballots. Confidence is high on method continuity and the U.S. targeting this week; the clips themselves have not gone viral.

Analysis

The load-bearing object this cycle is not a new German state-election dump. That wave is already in this vault. What is new on 11 September is the same factory pointed at a U.S. midterm list.

Primary surfaces are dated. Antibot4navalny posted on 11 September that the day's Matryoshka bot run was targeting named Democrats with fake CNN videos, listing Pappas in New Hampshire, Talarico in Texas, Ossoff in Georgia, Peltola in Alaska, Cooper in North Carolina and Brown in Ohio, then a second slate that included Abdul El-Sayed, Josh Turek, Troy Jackson and Graham Platner. The same account had already logged a first-day U.S. run under AllDemocratsAreCriminals using recycled Cameo footage. Zadrozny's MS NOW piece the same afternoon describes the celebrity layer: a Sarah Jessica Parker Cameo face with cloned audio attacking Democrats in slurs; a Julia Roberts clip lifted from Gucci's 2023 Chime for Change campaign recut into a conspiracy about Democrats and pharmaceutical firms; Emma Caulfield, Christopher Lloyd and Ed Begley Jr. clips in the same costume. Those wordings belong to the clips as transcribed by the reporter, not to the actors. Bluesky removed seven accounts. Zadrozny writes that X had not acted on the copies she saw and that the most-seen posts were still in the dozens of interactions.

The method is not new. Germany's BfV, on 12 August 2026, named the MATRYOSHKA campaign as English-language short videos that steal German mastheads, inflame East-West feeling, and smear state and municipal politicians ahead of September ballots. ISD's 4 September count was 269 X posts across 21 sampled days from 24 June to 1 September, still live on 2 September. CeMAS logged 141 distinct election-related videos from 30 June to 28 August. Both shops describe Cameo faces, AI voiceovers, weekday afternoon bursts, mass-tagging of newsrooms, and a targeting map that hits CDU, SPD, Greens, Die Linke and FDP while leaving AfD and BSW alone. The U.S. batch keeps the Cameo and stolen-logo layer and swaps the victim list.

Technique scoring is about the factory, not the party being hit. Synthetic-media is the production line: real faces, cloned audio, cut-away to stock. Transfer is the stolen CNN bug and the borrowed celebrity body; the warrant is the costume, not a correspondent or a Cameo contract. Name-calling and outrage-bait are the payload: slurs, blood libel, and a hashtag that does the sorting so a scroller never has to check a filing. Firehosing is the architecture: many clips, many names, many platforms, weak internal consistency, the point being to occupy the checker. Accusation-in-a-mirror is the campaign's older habit of mailing the same fakes to fact-checkers so that a newsroom's warning looks like a confession that the story is live.

Why this is propaganda rather than parody or organic meme culture: origin is concealed, institutional form is stolen, the named people did not say the lines, and the targeting list is a ballot. Why it is not proof of vote movement: Zadrozny, ISD and antibot4navalny all say reach is small. Dozens of likes are not a precinct. Score the method. Do not upgrade a bot swarm into a stolen election.

A same-method test applies in reverse. A factory that cloned Republican faces onto fake CNN packages and a hashtag AllRepublicansAreCriminals would be the same brief with the noun swapped. Technique IDs do not change with the faction on the thumbnail.

Literacy counter: if a celebrity appears to endorse a midterm smear in a selfie, find the original Cameo or brand campaign before sharing. If a CNN bug sits on a vertical clip with no correspondent, treat the bug as a costume. Do not quote the cloned line as the actor's view. Do not let a newsroom tag or a fact-check thumbnail become the distribution the operator wanted. Check BfV, ISD or a named researcher before treating a new country list as a new army. Volume is not verification. A midterm name on a stolen logo is a targeting marker, not evidence about the candidate.

Tells

Cameo or brand-campaign faces with a sudden political voiceover that the talent did not record
Stolen CNN or local-masthead bug on a vertical clip with no correspondent
Hashtag that is a verdict (AllDemocratsAreCriminals) instead of a topic
Same weekday-afternoon burst pattern previously measured on German ballots
Operator or sock tags newsrooms and fact-checkers with the clip
Named midterm candidates appear as a list, not as a reported event

Matryoshka recycles Cameo celebrity clips and fake CNN brands to smear named U.S. Democrats as its first documented midterm batch.

Summary

Analysis

Tells

Evidence

Related briefs