Kremlin-linked Matryoshka bots spread disinfo about “Ukrainian trail” in Trump assassination attempt at White House Correspondents Dinner

Law enforcement officers respond to reports of a shooting during the White House Correspondents’ Association dinner in Washington on Saturday, April 25, 2026. Photo: Yuri Gripas / EPA

The Kremlin-linked Matryoshka bot network is actively spreading disinformation on social media claiming Ukraine was behind the recent assassination attempt on Donald Trump. Researchers with Antibot4Navalny, a project that tracks the activities of Russian bot networks on social media, shared their findings with The Insider.

On April 25, 31-year-old Cole Thomas Allen opened fire with a shotgun at the White House Correspondents’ Dinner. Russian security agencies responsible for hybrid operations used the incident to shape a narrative for Western audiences alleging that Ukraine and its supporters were involved in the attack.

Antibot4Navalny’s researchers identified at least nine categories of falsehood spread by the Matryoshka bot network during the campaign:

• Radicalization “related” to Ukraine. One video bearing the USA Today logo claims Allen was repeatedly reprimanded at his job at a tutoring company due to “his obsessive Ukrainian propaganda.” The fabricated video adds that he donated more than $20,000 to Ukraine, “hung Ukrainian flags,” and was interested in joining Ukraine’s armed forces. To support the claim of “pro-Ukrainian radicalization,” the bots cite “political scientist Roger Griffin,” who supposedly claimed that Allen was a “staunch supporter of Ukraine and the Democrats” who served as a “catalyst for radicalization.” Griffin said no such thing.
• Fake quote from Eliot Higgins. Bellingcat founder Eliot Higgins is falsely quoted in a video posing as content from the BBC as saying that “European intelligence services will use a notorious supporter of Ukraine within the U.S. to try to eliminate President Trump.” According to the clip, Higgins is alleged to have repeatedly warned that European leaders were ready to take “extreme measures” due to Trump’s stance on Greenland and Iran.
• Fake quote from Pedro Pascal. A video claims the actor “expressed support” for the shooter and said Trump was to blame for the attack because he refused to help Ukraine.
• “Ukrainian employees” at the hotel. A video attributed to CNN claims the FBI is searching for two Ukrainians — father and son Dmytro and Valeriy Tomenko, who allegedly worked at the Washington Hilton as housekeepers — and says they “may have provided” the shooter with a floor plan.
• Fake Armenian reaction. Nazeli Baghdasaryan, the Armenian prime minister’s press secretary, is falsely portrayed as posting a message mocking Trump after the assassination attempt, while Armenia’s ambassador was supposedly summoned by the U.S. State Department.
• ICE raids on Ukrainian refugees. Another claim says Ukraine’s Foreign Ministry condemned supposed raids by U.S. Immigration and Customs Enforcement (ICE) at shelters for Ukrainians after the assassination attempt because “the shooter allegedly had accomplices among Ukrainian refugees.” The fake story claims "there are entire groups of Ukrainians who may be planning violent acts against U.S. authorities.”
• A Ukrainian accomplice. Another fake reel, posing as content from The Washington Post, claims Allen’s phone contained correspondence with a certain “Dmytro Rymarenko,” who allegedly entered the United States through the Mexican border with two other Ukrainians — the aforementioned Dmitry and Valery Tomenko who were apparently employed by the Washington Hilton. All three are supposedly wanted by U.S. authorities.
• TikTok flash mob. The campaign claims Ukrainian users are “flooding” the platform with photos of the shooter under the hashtag #NextTime. “Political scientist Andrzej Gil” is quoted as saying Ukrainians “are lamenting the failure of the assassination attempt” and that “the same fate awaits all of Ukraine’s supporters.”
• A note “to save an entire nation.” Citing the New York Post, the campaign claims a note was found in the shooter’s car “declaring that he is ready to become a martyr to restore justice.” In the supposed note, Allen accused Trump of “leaving Ukraine to its fate” and explained his actions as being an attempt to “save an entire nation.” The reel alleged that Allen “intended to take his own life, which is why he left a suicide note in the car.”

The videos are spread posing as content from Western media outlets, government agencies, and international organizations to create an illusion of credibility.

What is Matryoshka?

Matryoshka is a Kremlin-linked network of bots, trolls, and coordinated anonymous platforms specializing in the mass spread of disinformation. Its key tool is short vertical videos made to look like content from authoritative Western media outlets and organizations. Such videos are posted simultaneously on X, Telegram, Bluesky, and in closed chats.

As previously reported by The Insider, the Matryoshka network is part of a broader system of disinformation operations linked to the Russian authorities and security services. After the collapse of structures associated with Wagner Group founder Yevgeny Prigozhin’s “troll factory,” the coordination of these campaigns moved to the Russian presidential administration. The work is overseen by senior officials, including Sergei Kiriyenko.

Content creation has been outsourced to private contractors, including the Social Design Agency and its affiliated entities. These organizations develop disinformation-oriented content aimed at foreign audiences, including fake news, memes, and videos.

Russian intelligence services, particularly the GRU, play a separate role. Disinfo operations may involve officers under diplomatic cover, as well as foreign intermediaries and recruited participants. Several campaigns, including one known as Storm-1516, have been directly linked to these entities.

See also

• Pro-Kremlin Matryoshka bot network spreading terrorist attack scares ahead of Germany’s regional elections
• Russia’s Matryoshka bots spread disinfo about Ukraine-Hungary tension, allege “thousands” of attacks on Hungarians by Ukrainian refugees
• “Matryoshka” enters the fray: The Kremlin and the GRU are spreading disinformation in Hungary ahead of its pivotal parliamentary election
• Kremlin bot network Matryoshka answers U.S. senators’ appeal to Meta and Google with wave of fakes about Armenia’s parliamentary elections