Matryoshka pasted CNN skins and celebrity Cameo…

Filed

September 15, 2026, 10:15 UTC

Actor

Operation Matryoshka / Overload / Storm-1679, assessed by Antibot4Navalny, Clemson Media Forensics Hub and ISD as a Russian-aligned information-manipulation line; Kremlin command of this specific drop is researcher attribution, not a signed order

Target

U.S. midterm voters and social-media users, especially audiences of named Senate and House Democrats, plus newsroom and fact-check desks meant to redistribute the clips

Source

Impersonated Source falsified: fake personas, outlets or documents

Confidence

high Multiple independent open sources, low disagreement about the facts

Techniques

Synthetic media Transfer Firehosing Outrage bait Astroturfing

Where

United States, Georgia, Texas, Ohio, North Carolina

Channels

X short videos with unauthorized CNN bugs
TikTok clip mirrors
Bluesky accounts later suspended as hijacked
Cameo celebrity selfies as source tape
2023 Gucci Chime for Change Julia Roberts clip
hashtags #AllDemocratsAreCriminals and #midterms2026
follow-on clips attacking the MS NOW debunk

Summary

On 11-15 September 2026, Antibot4Navalny, MS NOW, The Insider, AFP and Le Monde documented a new Matryoshka / Operation Overload / Storm-1679 wave aimed at the U.S. midterms. Operators overlaid cloned audio on Cameo selfies and a 2023 Gucci Julia Roberts clip, stamped unauthorized CNN bugs, and pushed #AllDemocratsAreCriminals plus candidate smears of Ossoff, Talarico, Pappas, Peltola, Cooper and Brown. A Monday follow-on claimed MS NOW's Brandy Zadrozny had retracted. CNN denied the branding. Named actors rejected the words. Reach on the sampled posts stayed in the dozens. This brief scores the method, not the underlying races.

Analysis

The last two briefs in this vault covered Iranian state propaganda shops on Claude and a Turkey-based commercial election stack aimed at Malaysia. This cycle rotates to a Russian-aligned video line that has opened a U.S. midterm file while the same family is still running German Landtag smears.

Primary open record is four dated layers that agree on method. On 11 September 2026, MS NOW's Brandy Zadrozny documented CNN-branded celebrity clips on X and TikTok, first flagged by Antibot4Navalny, urging viewers not to vote Democratic and to join #AllDemocratsAreCriminals. Source tape included a 2023 Gucci Chime for Change Julia Roberts clip and paid Cameo selfies. On 14 September The Insider, working from the same tracker, counted 16 videos and at least eight X posts on 11-12 September, each carrying two clips. Named faces included Alyson Hannigan, Sarah Jessica Parker, Emma Caulfield, Julia Roberts, Ed Begley Jr., Eric Roberts, Jeri Ryan, Lea Thompson, Melora Hardin and Christopher Lloyd. A second batch named Chris Pappas, James Talarico, Jon Ossoff, Mary Peltola, Roy Cooper and Sherrod Brown. AFP and Le Monde published the same file on 14-15 September and recorded a Monday follow-on: inauthentic CNN-style reports that claimed Zadrozny had retracted the debunk. A CNN spokesperson told AFP the branding was unauthorized and that the videos "are not CNN content and have no affiliation with CNN." AFP-family outlets recorded denials from Caulfield, Begley and Roberts. Bluesky's Aaron Rodericks said seven hacked accounts were removed for coordinated inauthentic activity. MS NOW found the most popular posts still in the dozens of interactions.

Mechanism is transfer plus synthetic media plus a firehose that treats fact-checking as a second channel. A stolen CNN bug does credibility work the claim cannot. A borrowed celebrity face does emotion work the argument cannot. Outrage-bait is the payload: blood-drinking, Nazis, pedophiles, "not a single child" safe from Democrats. Astroturf is the amplifier layer Antibot4Navalny and Clemson's Darren Linvill map to prior Matryoshka graphs. Flooding the zone is the calendar: party-level slurs late last week, candidate-level slurs by Friday, a strike at the first reporter by Monday, so the checker cannot finish one clip before the next arrives. ISD's Pablo Maristany de las Casas called the voiceovers and logo theft low-effort and consistent with the line. Linvill called the drop Russia's opening midterm salvo and, in the same interview, graded present audience as negligible.

This is propaganda where origin is a recurring named influence line, institutional form is impersonated U.S. television and borrowed Hollywood, and the design goal is to move midterm belief about Democrats and to occupy newsroom attention. It is not a finding that every anti-Democrat video is Matryoshka, that the November map will flip because of Cameo audio, or that organic Americans are watching at scale. Score the production line as documented. Score Kremlin desk command of this exact drop as the researcher attribution, not as a signed order in the open file. A Western contractor that stole RT skins and cloned Russian actors to smear United Russia candidates with invented sex crimes would be this brief with the nouns swapped.

Literacy counter: if a selfie in a CNN bug tells you a named senator drinks blood or a reporter has recanted, treat the logo and the face as costume. Check whether the same graph just ran a German Landtag smear, whether Bluesky already killed the account, and whether the celebrity will pick up a phone. A stolen masthead is not a source. Apply the same face-to-payer test when the clip points the other way.

Tells

A Cameo or campaign selfie wearing an unauthorized CNN bug
Hashtag pair #AllDemocratsAreCriminals and #midterms2026 on two clips per post
A follow-on clip that claims the first reporter recanted
Amplifier accounts that previously ran English Landtag smears
Named Hollywood faces accusing a Senate candidate of blood-drinking or sex crime

Evidence

Related briefs

Sep 14, 2026Impersonated
Operation Matryoshka seeded fake ARD and BBC skins plus celebrity deepfakes to smear 53 German candidates before the September Landtag votes.
Firehosing Flooding the zone Synthetic media Transfer Outrage bait