How the ‘Matryoshka’ Disinformation Campaign Hijacked Real Bluesky Accounts

Influence operations linked by researchers to Russia have reportedly begun targeting the social network Bluesky using a tactic that differs from traditional bot campaigns: compromising real user accounts and turning them into propaganda distribution channels. Investigations by academic researchers and online watchdog groups connect this activity to a broader operation known as “Matryoshka,” also called Operation Overload or Storm‑1679.

The campaign uses hijacked identities, AI‑generated media, and coordinated amplification to push narratives intended to undermine trust in Western institutions and weaken support for Ukraine.

Hijacking Real Bluesky Accounts to Spread Disinformation

Instead of relying only on newly created fake profiles, the network reportedly took control of legitimate Bluesky accounts belonging to recognizable individuals—such as journalists, professors, artists, and filmmakers—and used those trusted profiles to publish fabricated content.

According to research from Clemson University’s Media Forensics Hub and collaborating investigators, the campaign exploited the fact that Bluesky is relatively new and many public figures had not yet secured accounts under their names. That made their identities easier to impersonate or hijack on the platform.

Once compromised, these accounts posted or shared manipulated videos and fabricated news reports designed to appear credible because they came from real, established profiles.

This tactic can make detection harder: audiences often assume a known account is trustworthy, allowing disinformation to spread before moderation systems or users recognize the manipulation.

What the “Matryoshka” (Operation Overload) Campaign Is

Researchers use the name Matryoshka—a reference to Russian nesting dolls—to describe a layered influence operation that disguises propaganda inside seemingly credible media formats.

Also known as Operation Overload or Storm‑1679, the campaign has been observed impersonating news organizations, academics, and government institutions in order to sow confusion and distrust in democratic societies.

The strategy typically combines several techniques:

• Impersonation of trusted sources: Content is branded with stolen logos or presented as if it came from legitimate media outlets or experts.
• Synthetic media: AI‑generated or manipulated videos and audio clips make the material appear authentic.
• Coordinated amplification: Networks of accounts spread the content across platforms to create the impression that the information is widely confirmed.

These tactics are designed to make propaganda look organic and credible rather than obviously state‑linked.

AI‑Generated Videos and Media Impersonation

A distinctive element of the campaign is its use of synthetic or manipulated media. Analysts have identified videos and images created to resemble broadcasts or reports from Western outlets, sometimes featuring AI‑generated visuals or altered footage.

These videos often mimic the style and branding of real media organizations, making them more likely to be believed and shared before fact‑checkers can debunk them. Researchers say this approach is increasingly common in influence operations because generative AI allows convincing media to be produced quickly and at scale.

Researchers Tracking the Operation

Several groups have investigated the campaign’s activity on Bluesky and other platforms.

• Clemson University’s Media Forensics Hub analyzed suspected influence networks and reported that the operation was impersonating or taking over real identities on Bluesky.
• Investigations were conducted with assistance from online monitoring groups such as Antibot4Navalny and dTeam, which track coordinated influence campaigns.

Reporting citing these investigations has also linked the activity to the Moscow‑based Social Design Agency, though such attribution is presented as a researcher assessment rather than a confirmed legal finding.

Expansion Across Social Platforms

The Matryoshka operation did not originate on Bluesky. Researchers first documented similar campaigns spreading across multiple networks, including X (formerly Twitter), Telegram, TikTok, and other platforms.

As moderation policies and user migrations change where audiences gather, influence networks often adapt by moving their operations to new platforms. Analysts say this pattern explains why Matryoshka activity has appeared on Bluesky as the network grows.

Targeting Elections and Geopolitical Conflicts

The campaign has also been connected to influence efforts around major geopolitical events and elections.

Researchers and monitoring organizations have linked related disinformation campaigns to narratives targeting:

• Western support for Ukraine
• German federal elections and political debates
• Moldova’s 2025 parliamentary election, where observers documented hundreds of pieces of foreign information manipulation linked to Russian‑aligned operations
• Armenia’s parliamentary elections, which analysts say were targeted by a large wave of fabricated videos and disinformation narratives

These campaigns aim to shape political discourse, deepen polarization, and weaken trust in democratic institutions.

How Bluesky Responded

Bluesky has acknowledged the presence of coordinated influence activity on its platform.

The company says it has identified and removed thousands of posts tied to the operation and is developing stronger tools to detect coordinated manipulation campaigns.

According to the platform’s transparency reporting, Bluesky has also expanded monitoring systems and investigative workflows dedicated to identifying networks attempting to manipulate public discourse.

Why This Tactic Matters

The most notable shift in the Bluesky case is the move from obvious bot networks to compromised real accounts with existing reputations. That approach can make propaganda more persuasive and harder for both users and moderation systems to detect.

As generative AI lowers the cost of producing convincing fake media, researchers expect influence operations like Matryoshka to continue evolving—moving across platforms and combining identity theft, synthetic media, and coordinated amplification to shape online narratives.