The Kremlin-linked Matryoshka bot network has launched a disinformation campaign on social media targeting Western audiences, promoting claims of alleged Ukrainian involvement in an assassination attempt on Donald Trump.
This was reported by The Insider, citing research by the Antibot4Navalny project, which monitors Russian information networks.
The campaign followed the April 25 incident during the White House Correspondents’ Dinner, when 31-year-old Cole Thomas Allen opened fire. Russian structures involved in hybrid operations quickly used the event to promote a disinformation narrative about a “Ukrainian link.”
Analysts have identified at least nine types of fabricated claims circulated as part of the campaign. These include allegations of the shooter’s supposed “pro-Ukrainian radicalization”: claims of workplace conflicts over “propaganda,” large donations to Ukraine, display of Ukrainian symbols, and alleged plans to join the Ukrainian armed forces.
To reinforce these narratives, fabricated or misrepresented quotes are used. In particular, “political scientist Roger Griffin” is attributed statements about a link between support for Ukraine and radicalization that he did not make.
Similarly, Bellingcat founder Eliot Higgins is falsely cited as claiming that a “pro-Ukrainian activist” was allegedly used by European intelligence services to eliminate Trump.
A separate strand involves fake video content. Actor Pedro Pascal is shown in a fabricated video allegedly supporting the attacker and accusing Trump.
Fabricated claims about “Ukrainian accomplices” are also circulating. These allege that the FBI is searching for two Ukrainian citizens, the Tomenko father and son, who worked at the Washington Hilton and provided the shooter with a building blueprint. At the same time, claims about “networks of Ukrainian refugees” allegedly involved in planning the attack are spreading.
Another fabricated narrative says correspondence was found between the shooter and “Dmytro Rymarenko,” who, together with the Tomenkos, allegedly entered the United States via the Mexican border and is wanted.
Bots are also attempting to suggest widespread Ukrainian support for the attack, spreading false claims about flash mobs using the hashtag #NextTime and fabricated reactions from Ukrainian users. To legitimize these claims, fabricated comments from “experts,” including “political scientist Andrzej Gil,” are used.
Additionally, a false claim is circulating about a note allegedly found in the attacker’s car in which he says he acted to “save Ukraine” and describes himself as a “martyr.”
An important element of the campaign is the creation of fake materials presented as Western media reports, government statements or international organizations, designed to simulate authenticity and increase credibility.
Matryoshka
Matryoshka is a Kremlin-linked network of bots, trolls and coordinated anonymous platforms that specializes in mass dissemination of disinformation. Its main tool is short vertical videos styled as content from reputable Western media and organizations. These videos are published simultaneously on X (Twitter), Telegram, Bluesky and closed chat rooms.
The network is part of a broader Russian disinformation ecosystem linked to state authorities and security services. After the collapse of structures associated with Yevgeny Prigozhin’s “troll factory,” coordination of such campaigns was transferred to the Russian Presidential Administration.
This activity is overseen at senior levels, including by First Deputy Head of the Presidential Administration Sergei Kiriyenko.
