# Operation Overload Operation Overload is a Russia-based influence operation, active since at least mid-2023, whose distinctive target is not the public directly but the people who check facts for the public. It fabricates videos, screenshots and "news reports" — usually wearing the logo of a real outlet such as [[CNN]], the BBC, Euronews or Deutsche Welle — and then emails or tags newsrooms and fact-checkers asking them to verify the fakes. Either outcome serves the operator: a newsroom that ignores the request has let a fake circulate, and a newsroom that debunks it has spent scarce time and, by writing about it, given the fake a second audience. The operation is the clearest working example in the vault of [[Information Overload]] used deliberately as a weapon against [[Fact-Checking]] itself. ## Names and attribution The same network is tracked under several names, which is why it can be hard to search for: - **Operation Overload** — the name given by [[CheckFirst]], a Finnish research firm, in a June 4, 2024 report written with [[Reset Tech]] and more than 20 fact-checking organizations that pooled the requests they had received. - **Matryoshka** — the name used by the anonymous research group [[Antibot4Navalny]] and by AFP for the part of the operation running on [[X (Twitter)]]; it refers to the nested, layered structure of accounts. France's [[VIGINUM]] agency published its own report under this name. - **Storm-1679** — Microsoft's designation. Microsoft's June 2024 report on the Paris Olympics described Storm-1679's fake graffiti, impersonated France 24 and Euronews reports, and a fake documentary, "Olympics Has Fallen," that used AI-generated audio resembling Tom Cruise's voice. The [[Institute for Strategic Dialogue]] (July 2025) and the [[Clemson Media Forensics Hub]] (March 2026) both treat the three names as one network. CheckFirst described the operators as based in Russia. Clemson's 2026 report describes the campaign as connected to the [[Social Design Agency]] — the Moscow firm behind [[Doppelganger]] — and lists Matryoshka as "reportedly" one of the agency's wings. That operator-level link rests on the research record, not on a published government attribution. ## How it works 1. **Fabricate.** Fake graffiti, fake screenshots, and short videos branded with a real outlet's logo. Since late 2024 the content increasingly uses generative AI: images from the Flux text-to-image model, and [[Voice Cloning]] that puts invented statements in the mouths of real academics and journalists. 2. **Seed and amplify.** Coordinated accounts on [[Telegram]], [[X (Twitter)]], and later [[Bluesky]] and [[TikTok]] post the material and tag the outlets and the people featured in it, creating the impression that a story is already spreading. Clemson documented cloned and AI-generated personas, accounts "backstopped" with mundane copied posts, and calls to "share via messengers" to move the conversation off-platform. 3. **Bait the checkers.** Emails to newsrooms and fact-checkers ask them to verify the fakes. CheckFirst counted 200+ such emails in its first report; by mid-2025 the reported count was up to 170,000 emails to more than 240 recipients since September 2024. 4. **Harvest the debunk.** A published fact-check that reproduces the fake — even stamped "FAKE" — extends its reach and is evidence of impact for whoever commissioned the campaign. CheckFirst counted 250+ fact-checks or debunks of the operation's assets in its first months alone. ## Timeline | Date | Event | |---|---| | Summer 2023 | Microsoft dates Storm-1679's focus on the Paris Olympics to at least summer 2023; CheckFirst's earliest emails date to August 2023 | | Fall 2023 | Images of supposed Paris graffiti threatening Israelis circulate; Microsoft found no independent confirmation the graffiti physically existed | | June 2024 | CheckFirst and Reset.Tech publish *Operation Overload* (June 4); Microsoft publishes its Olympics report on Storm-1679 (June) | | Sept 2024 | CheckFirst reports the operation has turned toward the U.S. presidential election | | Jan 2025 | SEECheck reports the operation still active but having much less effect on Southeast European fact-checkers, with a new focus on [[United States Agency for International Development]] | | Feb 2025 | A fake E! News video claiming USAID paid celebrities to visit Ukraine is shared by [[Elon Musk]] and [[Donald Trump Jr.]]; E! News called it "not authentic" | | Feb 2025 | Heavy targeting of Germany's federal election, including content favoring the [[AfD]] (ISD; Clemson) | | Q2 2025 | ISD finds ~300 linked accounts, a pivot to [[Moldova]] and [[Maia Sandu]], and 70% of X posts impersonating media outlets | | Sept 2026 | A wave of fake celebrity videos and fake [[CNN]]-branded reports targets Democratic candidates in the [[2026 Midterm Elections]] | ## The USAID video: how a weak operation gets reach The best-documented case of the operation reaching a mass American audience came through domestic amplifiers rather than its own accounts. In early February 2025, during the administration's dismantling of USAID, a video styled as an E! News segment claimed USAID had paid Angelina Jolie $20 million, Orlando Bloom $8 million, Sean Penn $5 million, Ben Stiller $4 million and Jean-Claude Van Damme $1.5 million to visit Ukraine. Meduza, citing Agentstvo, Holod and Antibot4Navalny, traced it to the Matryoshka network. AAP FactCheck found it first on Russian Telegram channels and pro-Kremlin sites. E! News said the clip did not come from E! News, and Stiller called it "lies coming from Russian media." [[Elon Musk]] and [[Donald Trump Jr.]] reposted it anyway, Trump Jr. writing that USAID "might turn out to be the biggest fraud ever committed against the American people." Reported view counts differ widely by outlet and are not asserted here. The lesson the vault draws: the operation's own accounts rarely move audiences, but its products are shaped to fit narratives that powerful domestic accounts are already pushing. When those accounts pick a fake up, it gets the reach the operation can't get by itself. ## Does it work? The research record is unusually candid that the operation mostly fails on its own terms: - ISD's July 2025 review found "no notable organic engagement" on the posts that survived moderation. Engagement on X appeared to come from two bot networks, and some TikTok accounts had more likes than views. ISD judged that the operation delivered limited geopolitical value. - Platforms removed much of it in that period: X removed 73% of ISD's sampled posts (up from 20% the quarter before), and TikTok and Bluesky removed more than 90%. Earlier, WIRED's mid-2025 reporting described X as taking "minimal action despite numerous reports," while 13 TikTok accounts drew about 3 million views before they were demoted. - SEECheck reported in January 2025 that Southeast European fact-checkers had learned to recognize the pattern and were no longer being "overloaded." The output keeps growing anyway. WIRED, reporting research shared by Reset Tech, counted 587 unique pieces of content from September 2024 to May 2025, against 230 from July 2023 to June 2024. Reading the volume as a measure of success is the mistake the operation invites. Reading the low engagement as proof of harmlessness ignores the USAID pattern above. ## The 2026 midterm wave On September 11–12, 2026, accounts that The Insider confirmed as part of the Matryoshka network posted at least eight X posts, each carrying two videos, with the hashtags #midterms2026 and #AllDemocratsAreCriminals. The clips reuse real footage of actors including Sarah Jessica Parker, Christopher Lloyd, Ed Begley Jr. and Julia Roberts, carry a CNN logo, and follow one formula: the celebrity has "learned something" and can no longer vote Democratic. One clip names North Carolina Senate candidate [[Roy Cooper]]. Mother Jones (September 24) reported that Antibot4Navalny also found fake CNN reports aimed at Texas Senate candidate [[James Talarico]]. It also reported dozens of fakes branded as the NYT, Washington Post, NPR, Politico, PBS, ABC, NBC, CBS and MS NOW, and one branded as Mother Jones itself, which X removed under its trademark policy. Both outlets reported limited reach so far. Mother Jones noted that researchers suspected inflated impression counts. ## Reception on the right The right-wing response to the midterm reporting followed the established script for Russian-interference stories. At FrontPage Magazine, Daniel Greenfield (September 12, 2026) called the coverage an attempt to "reboot Russiagate." He mocked the videos' engagement — "Dozens of interactions. Dozens." — and asserted that Russian operations in the 2016 cycle were "NOT TRYING TO INFLUENCE ELECTION RESULTS." The engagement point is consistent with what researchers themselves report. The 2016 claim is contradicted by the documented record in [[Russian Election Interference]]. And the rebuttal skips the operation's demonstrated route to reach — amplification by prominent American accounts, as with the USAID video — which is exactly what low engagement on its own accounts doesn't measure. ## Relationship to other operations - **[[Doppelganger]]** clones whole news websites. Overload borrows outlets' logos for short clips and posts. Both are linked in the research record to the Social Design Agency. - **[[Storm-1516]]** stages longer "whistleblower" videos and launders them through fake local-news sites and influencers. Overload produces short, high-volume fakes and spends its effort on journalists and fact-checkers. Analysts treat the two as separate operations that sometimes push the same narratives. - **[[Firehose of Falsehood]]** is the doctrine behind both: volume and repetition over consistency. Overload aims the firehose at the people whose job is to check what comes out of it. ## Connection to the KB Ecosystem - **[[Fact-Checking]]** / **[[Information Overload]]**: Overload is the foreign, operational counterpart to the domestic campaign against fact-checking infrastructure documented on the Fact-Checking page. One drains fact-checkers' capacity from outside; the other defunds and delegitimizes it from inside. - **[[Kremlin Disinformation]]** / **[[Active Measures]]**: the institutional tradition it belongs to. - **[[Election Interference]]** / **[[2026 Midterm Elections]]**: the September 2026 wave puts the operation inside the current cycle. - **[[Deep Fakes]]** / **[[Voice Cloning]]**: the AI techniques it adopted from late 2024. ## See Also - [[Doppelganger]] - [[Storm-1516]] - [[Kremlin Disinformation]] - [[Russian Influence]] - [[Fact-Checking]] - [[Information Overload]] - [[Firehose of Falsehood]] - [[Prebunking]] - [[Disinformation Hub]] - [[Operation Undercut]] - [[Social Design Agency]] - [[Pravda Network]]