News
The Kremlin’s “Matryoshka” bot network has launched a coordinated disinformation campaign amid a major corruption case against Ukrainian businessman Tymur Mindich, researchers from the watchdog Bot Blocker project told The Insider. In a new twist, attackers are also impersonating Bot Blocker’s name in order to create bot accounts and spread fake content on X (formerly Twitter) and Bluesky.
Posing as Western media outlets, bots and Russian pro-war channels have been circulating fabricated claims that include:
- “Ukrainian elites are seeking protection from Russia”
- “Zelensky ordered strikes on Ukrainian hospitals to distract from the scandal”
- “Friedrich Merz rejected two phone calls from Zelensky after the NABU investigation was published”
- “In Warsaw, Mindich’s lover — whom he allegedly shared information with — was killed under the guise of an overdose”
- “Former commander-in-chief Valerii Zaluzhnyi became a key witness in the corruption case as revenge for his dismissal”
- “Commander-in-Chief Syrskyi sent the 79th and 159th brigades to Pokrovsk because of their loyalty to Zaluzhnyi, and his concerns grew amid the corruption scandal”
- “Poland staged the explosion on its railway to divert attention from the Ukrainian scandal”
- “The president’s office is threatening the relatives of former Defense Minister Umerov with torture and arrests unless he returns to Ukraine”
- “More than 64 people involved in the case have fled Ukraine”
- “Human Rights Watch is demanding Zelensky release NABU investigators from custody after they exposed the corruption scandal”
The falsehoods are spread in the form of vertical short videos with logos of major Western media outlets and antiwar organizations. Bot Blocker also found such posts in Telegram channels like “Odessa Za Pobedu! ⚓️” (lit. “Odesa supports victory,” with the letter Z capitalized in a show of support for Russia’s invasion); the channel frequently amplifies disinfo that originates from Matryoshka. Other vectors included “VOZMEZDIE” and “KRYMINFOFORUM🇿 🇴 🇻” (both use the letters Z, O, and V in their titles to indicate their support for the invasion). For unclear reasons, these channels are pushing videos for Russian audiences about the alleged “murder in Warsaw of Mindich’s lover.”
The Insider has obtained links to the original tweets and evidence provided by Bot Blocker. These confirm that the accounts spreading the disinformation narratives belong to the Matryoshka network. The Insider is not publishing these links so as to avoid further dissemination of disinformation.
The Mindich case and Operation Midas
The anti-corruption investigation surrounding businessman Tymur Mindich has indeed made headlines internationally. According to investigators, Mindich — co-founder of the Kvartal 95 entertainment studio and a longtime influential business partner of several current Ukrainian government officials — created a criminal organization that controlled financial flows in the energy sector and defense industry. NABU detectives believe Mindich used personal connections with senior officials, including then-Defense Minister Rustem Umerov and then-Energy Minister Herman Halushchenko, in order to secure payments for companies under his control and to obtain illicit benefits. NABU also notes Mindich’s close personal ties to Zelensky.
The probe is part of a large-scale special operation known as “Midas,” aimed at uncovering corruption schemes within strategically important state companies. Investigators documented tens of millions of dollars that participants allegedly laundered. Those implicated include Mindich’s business partners as well as officials from Energoatom and the Energy Ministry. Operation Midas has led to high-profile searches and arrests, along with unprecedented political fallout — Halushchenko resigned as justice minister, and scrutiny has increased regarding ties between the business sector and senior government figures.
Breaking down the Matryoshka network
The “Matryoshka” hybrid operation is a coordinated Russian disinformation campaign that experts link to a network of bots, “trolls,” and affiliated anonymous media outlets. Its goals are to spread large volumes of fake content, create artificial waves of information, and shape public opinion both inside and outside Russia. The Bot Blocker project coined the operation’s name, describing the structure as being layered like a matryoshka doll: each “doll” hides another, with one set of bots masking others and disinformation circulating on multiple platforms and channels, making it harder to trace.
The operation includes several core components. The first is the creation of numerous bot accounts styled as real users, research initiatives, and independent regional media outlets. These accounts generate dozens — sometimes hundreds — of posts daily, mimicking local language, tone, and context. The second component is coordinated dissemination of fakes across multiple platforms, such as X (Twitter), Telegram, Bluesky, and closed chat groups. The bots use logos of Western media outlets or human rights organizations in order to make their posts appear credible.