“Matryoshka” attacks Moldova: how Russia is waging a hybrid war through fakes and cloned weapons
In mid-April 2025, the independent publication The Insider published the results of a journalistic investigation, which sheds light on a new large-scale Russian information operation, this time directed against Moldova. According to the data sources, a Russian disinformation network called “Matryoshka” launched an aggressive campaign on social networks such as X (formerly Twitter) and Bluesky, focusing its activity directly on the country’s domestic politics for the first time.
Since the independence of Moldova remains in the zone of constant informational pressure from Russia. The Kremlin consistently uses the entire arsenal of hybrid influences — from disinformation to political interference — to keep the country in the orbit of its own influence. Since the citizens of Moldova made a clear European choice by electing a pro-European president and government, the attacks only intensified. The status of candidate for accession to the EU, which Moldova obtained in 2022, became especially irritating for Moscow. Today, every step Chisinau takes to strengthen institutional stability and protect the information field is perceived by Russia as a challenge — and, accordingly, is met with new waves of destabilization efforts. A special role in these efforts is played by the “Matryoshka” disinformation network, which actively works in the Moldovan direction, fueling mistrust of the authorities, the EU and Western partners.
A campaign styled after Western sources
One of the troubling elements of the campaign is its misinformation style. Russian propagandists disguise videos as products of reputable world media or academic institutions. In these “materials”, in particular, it is said that the president of Moldova, Maia Sandu, allegedly won the elections thanks to mass propaganda, and also persecutes political opponents.
A separate video purportedly produced by the French civil service VIGINUM (a real anti-disinformation agency) claims that a million dollars a day was spent on the production and distribution of pro-government propaganda in favor of Sandu. This fake was obviously created with the aim of undermining the trust in democratic institutions and international partners of Moldova.
Kremlin classic: “LGBT threat” and “capture of the church”
Along with political insinuations, the Russian campaign does not neglect proven methods of disinformation: it talks about Sandu’s alleged “connections” with the LGBT community, the imposition of “non-traditional values” and oppression of the “traditional family”. Another common narrative is presented as the desire of the current authorities to take control of the Orthodox Church in Moldova, which, according to the authors of the fakes, should end in “the final merger with Romania.”
Such messages are carefully woven into emotionally charged topics that cause public unrest, fear, and hatred. This is a typical example of hybrid warfare, with its appeal to emotions and personal beliefs instead of facts, which is characteristic of a post-truth situation.
“Matryoshka” as a new generation of manipulative technologies
According to preliminary data, at least 10 videos have been released so far: four are styled as reputable media, and six are designed as speeches by university professors. In addition, a fake cover of the magazine, created to increase trust in the distributed content, is spreading in social networks.
This is not the first manifestation of “Matryoshka” activity: in June 2024, the network already launched a fake social video, which called for tolerance towards people with disabilities and the LGBT community – seemingly a noble topic, but covertly used with the aim of disturbing the conservative part of society and undermining the authority of the state authorities.
Director of the Information and Security Service of Moldova (SIS) Alexandru Mustiatse warned back in December 2024 that the risk of interference from Russia was increasing. The current “Matryoshka” attack is a confirmation of his words and a direct evidence that the Kremlin does not stop trying to destabilize the situation on the western flank of Ukraine.
How a hybrid attack works: Anatomy of an impact
Company “Matryoshka” against Moldova is only one fragment in a much wider mosaic of the Kremlin’s hybrid influences. In recent years, Russia has significantly improved its methods of information warfare, turning them into a multi-level system where each fake is not just “dropped in”, but carefully packaged, disguised and rebroadcast multiple times.
First, disinformation is often spread through fake “experts” — “university” pseudo-professors, fake think tanks or fictitious NGOs. Their videos are stylized as academic presentations, and their texts are styled as independent analytics. Such a discourse creates a sense of scientificity and objectivity, although behind the “speakers” stands the Russian propaganda machine.
Secondly, such campaigns skillfully exploit local sensitivities: the language issue, the status of the church, the topic of LGBT+, corruption, “traditional values”. In the case of Moldova, it is the accusation of Maia Sandu of trying to subordinate the Orthodox Church to herself, allegedly according to the Ukrainian scenario. This is a carbon copy of the Kremlin’s narrative about the “persecution of the UOC” in Ukraine, which is actively used to mobilize a religiously inclined audience. According to the NATO StratCom COE, religion has long been one of the key tools of the Russian information war. In Moldova, Russia traditionally uses the influence of the Moscow Patriarchate as a lever to promote anti-Western, anti-European and anti-government messages.
The third level is the dissemination ecosystem. First, fake information is published by a cloned site or “analytical center”, then it is picked up by bots in social networks, bloggers, and later by officials or pro-Russian politicians. This phenomenon received a name information laundering — “laundering of information”: a fake is “repackaged” several times to look legitimate.
More and more often, Russian campaigns go to new platforms, in particular Bluesky, X, Threads, in fact, to places where moderation is weaker, and the audience is looking for an alternative to traditional mass media. This allows you to penetrate the information field by less controlled routes.
An important tool is the simulation of social initiatives. For example, in June 2024, “Matryoshka” distributed a video that was stylized as a social advertisement about inclusion. In fact, it was a cynical ploy to reinforce anti-Western messages and fuel homophobic sentiments.
A separate strategy is Doppelgänger-campaigns, which IA “FACT” has already discussed wrote. This is the cloning of well-known media with minimal visual differences: fake versions of the sites Le Monde, The Guardian, Bild, where one letter in the URL is changed or the design is completely copied. These sites publish fabricated news, which are then distributed on social networks to an audience not sensitive to fakes. This format allows creating the illusion of “authority” of narratives beneficial to the Kremlin.
Finally, Russia systematically targets diaspora audiences and border communities, where it increases mistrust of the authorities, plays on the themes of ethnic identity or historical memory.
All these are parts of a complex puzzle, where the main goal is not only to misinform, but to destabilize from within, to cause discord, despair and doubts, even when objectively there is no reason for moral panic.
In general, the idea is clear: to take real social cracks and make a chasm out of them. An external message is launched under the guise of an “internal discussion”. And it works, because it hits not on logic, but on emotions, fears and personal ideas about “one’s own”.
Infographic: IA “FACT”
Why Bluesky?
After the victory of Donald Trump in the US presidential elections, the Bluesky social network, founded by Twitter developer Jack Dorsey, began to rapidly gain popularity. By the end of 2024, the number of its users has reached 25 million. As informs fact-checking resource Detector Media, the platform has become a haven for those who left X (formerly Twitter) due to controversial changes introduced by Elon Musk. Bluesky was joined by many famous American stars, including Barbra Streisand, Arnold Schwarzenegger, Jamie Lee Curtis, Guillermo del Toro and Rihanna.
However, the growth of the platform also attracted the attention of Russian disinformers. According to the Center for Strategic Communications and Information Security, the “Matryoshka” network began to actively use Bluesky to distribute fake videos, deepfake content and messages aimed at discrediting Ukraine. One example is a video of a supposed employee of a London science center criticizing the strikes on Russia – a fake created on the basis of a real image, but completely distorted.
Thus, Bluesky, which positions itself as a safe space, is faced with the challenge of either developing effective mechanisms to counter disinformation, or risk becoming a new platform for pro-Kremlin propaganda, especially after partially losing Russia’s audience on X.
Who guards the truth: the world’s key fact-checking initiatives
In response to the rise of disinformation attacks—from Doppelgänger campaigns to manipulation of domestic hot topics—a number of platforms have emerged around the world to systematically expose hybrid threats. They not only refute fakes, but also document methods of manipulation, expose pseudo-media networks and support local initiatives. Among them:
EUvsDisinfo — platform European External Action Service. It promptly responds to Russian disinformation operations, maintains a database of manipulations, including those related to the information space of Moldova.
International Fact-Checking Network (IFCN) — global chain of fact-checkers under the auspices of the Poynter Institute (USA), which sets standards for independent fact-checking, certifies initiatives from more than 100 countries.
EU DisinfoLab – disorderly organization, which exposes information operations, fake accounts, cloned sites and bot networks. She was the first to document large-scale Doppelgänger campaigns in Europe.
Global Disinformation Index (GDI) — independent analytical structure, which evaluates the media according to the degree of risk of disinformation. It evaluates the media according to the degree of risk of spreading misinformation – and passes this data to advertising platforms. The mechanism is simple: a site that spreads fiction does not receive advertising money. This encourages honest media to remain transparent and makes life difficult for manipulators. Thus, trust in the information space is gradually becoming economically beneficial.
The Insider – investigative media, which specializes in the study of information operations of the Kremlin. The Insider was the first to reveal the “Matryoshka” campaign against Moldova.
These institutions not only protect the information space, but also increase the general resistance to manipulation. Their activities should be systematically used as a source of analytics and evidence in exposing hybrid operations.
