Matryoshka and the Armenian election: A year of fake videos targeting newsrooms and factcheckers

Ani Grigoryan, Andreas Sjöstedt

For about a year prior to Armenia’s 7 June 2026 parliamentary election, a group of accounts on X posted videos with purported “scandalous revelations” about Armenia. They claimed Cher had supposedly turned down $50 million to support Prime Minister Nikol Pashinyan’s election campaign, while tennis player Andre Agassi was said to have claimed that the prime minister was a drug addict. Some of the videos were made to look like reports by Western publications, while the accompanying posts tagged Nikol Pashinyan alongside the BBC, Reuters and Euronews.

For this investigation, we analysed 640 X accounts with behaviour matching the pattern of the Matryoshka operation. Most posted a single video, while 44 posted no video and only wrote replies. Not a single post we identified was published on a Saturday or Sunday. The accounts most often replied to posts by fact-checkers, researchers and newsrooms, including CivilNet.

The operation did not rely on a stable set of accounts: each account was used for a day or a few days and then abandoned. VIGINUM and CheckFirst have described this pattern as a feature typical of the Matryoshka operation.

What is Matryoshka?

Matryoshka is a pro-Russian influence operation that produces short fake videos, posing as reports from trusted newsrooms, or as statements by renowned experts. It often uses AI-generated voices or fake headlines (CheckFirst, June 2025). The videos are posted by accounts with very few followers, often minutes apart. These accounts typically reply  to newsrooms, public figures and fact-checkers, asking to check the authenticity of their posts (VIGINUM, section 2.1).

Supposedly, the aim is to trick a journalist or fact-checker into writing about this so as to amplify the disinformation operation. Another goal could be to waste the factcheckers’ and journalists’ time and divert their attention from other topics. This tactic was typical of a separate disinformation campaign known as Operation Overload (CheckFirst, 2024). CivilNet was one of the targeted accounts, and we traced most of the materials back to Russian-language Telegram channels. 

Scope and growth of the Armenia-focused operation

Analysis of data collected by CivilNet and partner organization dTeamUS has shown that the first video targeting Armenia was posted on June 12, 2025, while the last appeared on June 9, 2026, two days after the election. We have identified 620 posts linked to the operation, 612 of which we have managed to archive for record keeping. The same videos were sometimes posted by multiple accounts. After removing duplicates, we identified 287 distinct videos. Only eight of those were in Armenian, the rest were in English.

The first post was a video branded as a report by Vancouver Island University and tagged Pashinyan, the Armenian foreign ministry and Reuters. This account is what we describe as a typical take-over one. Its original owner last posted in August 2012, and then the account remained silent until it posted its Armenia video. Three more posts from that day came from accounts that followed the same pattern. This common tactic uses old social media accounts that appear to be genuine and have a history.

The first three months, June to August 2025, brought 25 posts, and 13 of them were videos posing as reports made by universities, NGOs or public bodies rather than news outlets. Some included a banner encouraging viewers to share the video with their friends and family in Armenia. Videos posing as news reports were there as well (7 of the 25) – however, names and logos of news outlets, including Armenian ones, were used more frequently later on. For example, 14 of the 15 fake videos claiming to be made by state news agency Armenpress were posted in May 2026.

Counting everything the accounts posted, not only the videos we identified, in the Meltwater index, the operation peaked in December 2025 (1,682 posts) and again in May 2026 (1,861), with October 2025 close behind (1,339). The videos we identified follow the same trend: 53 videos in December 2025 and 71 in May 2026, compared to just nine in January 2026. Most posts in the busiest months were made by accounts that have since been removed by X.

Most of the accounts show a single day of activity, with the remaining being active for no longer than a week.

Narratives over time

Many of the videos were based on genuine news stories, such as Pashinyan’s announcement of a “Fourth Republic” in September 2025, the TRIPP declaration of August 2025, Pashinyan’s announcement that he would lead his party’s electoral list, and the European Political Community summit of May 2026.

The typical narratives claimed that Pashinyan is erasing the memory of the 1915 Genocide and Armenia’s national symbols, that he and his family are corrupt, that Armenia is failing under him, and that he sold the country to Turkey and Azerbaijan. More than a quarter of the videos claimed he is unfit to govern: sick, addicted to drugs or hated by his own people.

As the vote came closer, new narratives emerged. Those posted in the autumn of 2025 said that Pashinyan must not win, that the West is pushing him to victory, that his “fourth republic” is a disaster, or that the vote will be rigged. December saw the first claims that he is leading Armenia into war with Russia – this claim had become more frequent in the last months before the vote. 

The methods also changed in 2026, with more videos repurposing genuine footage and adding entirely new captions and audio. On March 30, three videos used personalized greetings that musicians sell to fans. These included Twisted Sister’s Dee Snider and Marky Ramone of The Ramones, edited together with still images and fabricated voice-overs. The videos falsely suggested that the musicians had refused to perform at the Yerevan Rocks festival because it was “part of Prime Minister Pashinyan’s election campaign.” Each video begins with genuine footage of the artist introducing themselves, before switching to a fabricated voice-over presented as the artist’s voice, accompanied by still images.

Three frames from one of the videos posted on March 30, 2026. Left: Dee Snider appears on camera in the greeting, the only part of the video in which he is seen. Middle and right: still images that follow, accompanied by a fabricated voice-over and subtitles in which he appears to refuse the Yerevan Rocks festival and links it to Pashinyan’s election campaign. The frames are cropped; the left frame excludes the subtitle identifying the fan who received the greeting.

Attributes of the X accounts and their behaviors

The accounts used in the operation stand out sharply from authentic Armenian accounts on X. They typically have very few followers, and many have little or no profile information. This is a common pattern in this type of operation, which often relies on older, low-activity accounts. To put this in context, we compared them with 27 authentic Armenian accounts covering the same topics, ranging from news organizations such as Armenpress, Azatutyun, Aravot, Hetq, PanARMENIAN, FIP.am and CivilNet to individual journalists and media analysts, senior politicians, state bodies and two opposition parties. The authentic accounts had a median of 9,450 followers, and all had a bio. By contrast, the operation’s accounts had a median of just one follower. The share of those accounts with a bio also fell sharply, from about half in 2025 to just 10% by June 2026.

The videos were posted in batches, with each post followed by another from a different account a median of nine minutes later. None of the videos were posted on a Saturday or Sunday, whether measured in Yerevan time or UTC. The tagged videos were concentrated between 4 p.m. and 7 p.m. Yerevan time (12 p.m. to 4 p.m. UTC), while overall activity, including replies, peaked between 8 p.m. and 11 p.m. By comparison, the authentic Armenian accounts in our baseline sample did post on weekends and were most active around 5 p.m. Yerevan time. Some of the operation’s accounts appeared to be used primarily for posting replies.

The accounts posted almost 8,000 replies to around 2,300 other accounts, suggesting that the operation was broadly distributed rather than focused on a small number of targets. Some accounts received far more replies than others, with Bellingcat the most frequently targeted. CivilNet was also among the accounts receiving a comparatively large share of the replies.

Almost all of the 15 most frequently targeted accounts belong to fact-checkers, open-source researchers or newsrooms. Those are the very accounts that are likely to scrutinize and expose this type of content. Bellingcat received the most replies, with 53, followed by Christo Grozev with 51. @antibot4navalny, @afpfactcheck and @mythdetector each received 47. Taken together, the 15 accounts accounted for 8.5% of all replies. CivilNet ranked sixth with 46 replies, making it the only Armenian newsroom among the 15 most frequently targeted accounts.

Although this investigation focused on X, we also found 12 of the videos on Telegram channels. In nine cases, the video appeared on Telegram before it was posted on X. The operation also sought to draw its targets’ attention to the videos directly, emailing links to them. CivilNet received requests to fact-check 221 of the 620 posts we identified. In May 2026 alone, links to 90 of the 135 posts published that month were sent to CivilNet within a week of publication.

“Urgent: Please Verify.” How Coordinated Disinformation Networks Are Trying to Penetrate Armenia’s Media Space

One story shows the route. The claim that Macron is pushing Pashinyan towards war with Russia went up on seven Telegram channels on 11 March 2026, reached our inbox with those links the next morning (12 March 2026), was posted on X 12 days later (24 March 2026) as pictures of fake French front pages, and that post was in our inbox again on 26 March 2026.

Impact

We also checked the public Community Notes data released on September 11, 2026, against every tagged post in our dataset. None of the posts had a Community Note. Community Notes is X’s crowdsourced system for adding contextual information or corrections to posts: a note proposed by a contributor is displayed only after it receives enough approvals from contributors with different viewpoints. X has since suspended 493 of the 609 accounts we were able to check, so the available data can only show what happened to posts that remain accessible. Among those posts, we found no evidence that anyone had proposed a Community Note.

We then searched the same X index for the claims made in the videos, looking at the period before March 2026 as well as the months of the election campaign. In most cases, the same claims had been posted by two or more accounts before March. Overall, however, we found the claims repeated by only 39 accounts, which had a median of six followers. This suggests that the claims were largely being circulated within the operation itself rather than reaching a substantial audience through independent accounts.

Some of the claims did attract attention outside X. Armenian state institutions responded to several of them, while Armenian media outlets, including CivilNet, debunked others during the year. Our analysis did not systematically track those responses, so they are not included in the figures above.