
Cover image created with AI
The Russian bot network Matryoshka has launched a disinformation campaign in the wake of Armenia’s parliamentary elections, held on June 7. Researchers with the Antibot4Navalny project, which tracks pro-Russian bot activity on social media, provided The Insider with its latest findings about the new campaign.
The central storyline of the fake narrative is the real hacking of Tchap, a French government messaging app that the bots use as a “source” for fabricated leaks. Videos branded with the logos of Western media outlets spread several narratives:
Another element of the campaign involves fake covers and screenshots of Western media outlets. The bots are spreading fabricated Euronews screenshots with the headline “The battle of wills has been lost,” France 24 pages saying “Prime Minister Pashinyan has ceded the initiative to Armenia’s opposition forces,” DW pages saying “Pashinyan is passing off failure as victory,” and fake June 9 front pages of French newspapers, with Libération purportedly claiming “Pashinyan loses his advantage,” La Croix that “Election results destroy Pashinyan’s hopes,” and Le Parisien that the election was marked by “Corruption, blackmail, fraud.” All follow the theme that the elections were supposedly a failure for Pashinyan and a disappointment for his European partners.
Armenia’s elections and the Tchap hack
In reality, Civil Contract won the June 7 elections with 49.85% of the vote, taking 64 out of the 105 seats in parliament, enough to form a government on its own. However, the party does not have a two-thirds constitutional majority, and the bots exploit that real fact by portraying the result as a “failure.”
The Tchap hack that the bots use as the basis for the fakes was also real. On June 7, the day of Armenia’s elections, France’s cybersecurity agency ANSSI recorded a hack of the government messenger through a compromised account. The hackers claimed they had stolen 13.5 gigabytes of data, including more than 643,000 messages and information on 73,000 accounts. French authorities stressed that the attacker gained access only to public rooms, while private conversations protected by end-to-end encryption were not affected. There have been no confirmed leaks in the published data involving Armenia, nor have there been any credible reports of election fraud.
The Insider has links to the original posts and materials from Bot Blocker confirming that the accounts that published them belong to the Matryoshka network. The newsroom is not publishing direct links to avoid helping spread the disinformation.
What is Matryoshka?
Researchers use the name Matryoshka for a Russian operation that spreads fake stories on a massive scale using a coordinated infrastructure of bots, trolls and anonymous platforms. Its aim is to create artificial information noise and manipulate perceptions of events both in Russia and abroad. Antibot4Navalny named the operation “Matryoshka” after the Russian nesting doll, with the bots hiding behind one another, and disinformation being spread in layers across different platforms, making the original source harder to identify.
The mechanism works in two directions. The first is the creation of large numbers of fake profiles that pose as ordinary people, independent media outlets, or think tanks. These accounts generate dozens of posts a day, copying local speech patterns. The second is the simultaneous launch of identical content on X (formerly Twitter), Telegram, Bluesky, and closed chats. To appear convincing, the bots use the logos of well-known Western media outlets and human rights organizations.
We depend on contributions from readers like you
Sign up for regular contributions.