A NATO study by Repsense times the Kremlin's weak spot, Matryoshka gets assignments in Paris and Berlin, and the EU's Ceuta hotline

Fake BBC clips target every German party but the AfD – and leaked files show what comes next

German authorities have put a name on the Russian disinformation campaign running before September's state elections in Berlin, Saxony-Anhalt and Mecklenburg-Western Pomerania: Matryoshka, the same network Viginum flagged in France. Four security sources told Reuters the operation is centrally coordinated from Russia through a web of companies. Its output is mostly English-language videos carrying BBC and ARD logos, accusing local politicians of offences from embezzlement to sexual harassment. The targets span every major party except two: the far-right AfD, polling close to an absolute majority in Saxony-Anhalt on September 6, and the left-wing BSW. Germany's interior ministry confirmed it is monitoring the campaign but is not taking active countermeasures, saying the content is not achieving significant reach.

Internal documents from the Social Design Agency (SDA) – a Moscow IT firm that works as a Kremlin influence contractor, financed by the Russian state with support and strategic guidance from GRU Unit 29155 – show how the wider apparatus plans its work. The papers, obtained by Euractiv and assessed as authentic by authorities in Berlin, list objectives that include “deepening internal rifts within ruling elites” in NATO countries. Among the projects German authorities have identified: a Wikipedia clone whose pages already outrank the original in some search results, and a think tank planned for 2026 whose experts would appear in Western media, its English-language website already live. One document sets a French target too: monitoring the 100 most prominent opposition voices and republishing 30–40 of their posts daily.

Three French candidates hit by Russian fakes in ten days

France's 2027 presidential campaign has not formally started, but within ten days three likely candidates announced Russian-linked disinformation operations against them. Édouard Philippe came first, at the end of July: false claims about his health, spread by Storm-1516, a network French authorities link to Russian military intelligence. In early August the same network went after Raphaël Glucksmann: it built a fake copy of the French news site Blast and faked a voice recording of the veteran journalist Edwy Plenel, using both to spread an invented story that Glucksmann's partner, television journalist Léa Salamé, was bribing reporters to promote him. Paris prosecutors have opened a criminal investigation, AFP reported.

Gabriel Attal's turn came a day later: Viginum, France's anti-interference agency, attributed posts impersonating French media outlets – falsely claiming the former prime minister has Parkinson's disease – to the pro-Russian Matryoshka network with high confidence. The reach was a few thousand views, according to a security source. On Friday government services notified Attal of a second operation, which his lawyers say was built to suggest he had orchestrated the disinformation against himself; that evening he filed a legal complaint in Paris.

The response has turned into its own debate: Le Monde notes the SGDSN – the French government's defence and national security secretariat, which oversees Viginum – usually advises victims not to communicate publicly, since leaked Russian documents show operators count every article about a fabrication – including debunks – as a win. Cyber-threat researcher Rayna Stamboliyska told Mediapart the shift is that this time the politicians, not Viginum, went public. The first round is on April 18, 2027.

Brussels drafts Meta and TikTok before the next Ceuta rush

“Platforms must act decisively in keeping the integrity of the digital space,” EU tech commissioner Henna Virkkunen said after the Ceuta surge. After meetings on Friday and Monday, the Commission, Meta and TikTok agreed to set up a joint channel for the Ceuta crisis, Politico reports, citing three people with knowledge of the talks. Through it, platforms, fact-checkers and the Commission flag suspect content so it can be reviewed quickly and, if needed, taken down.

The channel is a response to the migrant crisis in Ceuta at the end of July, and the picture of the disinformation behind it has sharpened since. On August 6 a Commission spokesperson said channels linked to foreign information manipulation – Russian ones in particular – began amplifying the situation on July 30, having shown no such activity before that date; Europol and the EEAS are examining possible Russian involvement. Counter-disinformation group 411 examined some 4.5 million posts and found accounts linked to the Russian military reached more than 500,000 people with far-right framings of the crossing, reproduced in seven languages – over 720,000 views in six hours on August 1. One origin was Rybar, a Telegram channel tied to Russian intelligence, amplified by a repeater network that included Pravda-linked accounts. Fact-checker Maldita.es traced disinformation about reception – claims that Spain grants asylum to everyone who enters – through at least ten Facebook groups that also organise new crossings, with posts calling on members to go in on August 15.

Thierry Breton, the former EU commissioner behind the Digital Services Act, is calling for a formal DSA inquiry with researcher access to platform data. “Without understanding the algorithmic mechanism, every future Ceuta will produce another deadlock,” he told La Stampa. So far, no member state has triggered the DSA's crisis mechanism.