“Matryoshka” bots start referring to Armenian elections: What do we know?

Bot accounts called “Matryoshka” and linked to Russian information networks, have become active on social media, sharing videos about the upcoming parliamentary elections in Armenia and Prime Minister Nikol Pashinyan.

In particular, ten videos shared by bot accounts named “Matryoshka” in early October were videos generated using artificial intelligence (AI). In these videos, the policies of Armenian Prime Minister Nikol Pashinyan are compared to the Holocaust carried out by Germany. So-called Holocaust survivors tell of their suffering, say that Pashinyan is building “gas chambers” and call on the people to take steps to get rid of him.

These videos use manipulative wording and disinformation, such as assumptions about the existence of “gas chambers” or a “dictatorial regime.”

What did the investigation show?

The investigative platform “Agenstvo” writes that recently accounts of the Russian disinformation network “Matryoshka” have begun sharing videos on the X and Bluesky social networks, mentioning the parliamentary elections in Armenia to be held in June 2026. A representative of the “Bot Blocker” project told the media outlet that, according to their information, a campaign within the framework of “Matryoshka” has never been launched so early before the elections.

Thus, on October 7, the “Matryoshka” accounts published at least 10 videos mentioning the upcoming parliamentary elections in Armenia and Prime Minister Pashinyan. In the videos, trolls (organized groups of people spreading fake content) used segments of videos featuring real people, editing them with other footage where those people are not visible. The audio was apparently generated using artificial intelligence.

Four videos use images of former prisoners of Auschwitz, on behalf of whom it is said that “Nikol Pashinyan is building gas chambers.” He is called a “traitor” and Armenian citizens are compared to Jews who were “waiting for the tragedy to happen.”

In both videos, false statements about the situation in Armenia are attributed to British police officers. One alleges that British police have trained Armenian security forces to use violence against participants in potential protests after the 2026 elections. In others, Pashinyan is accused of “destroying Armenia,” while a fake “police officer” calls on Armenians to “not be tolerant of the destructive practices of Nikol Pashinyan’s government.”

What is a “Matryoshka”?

The “Matryoshka” network is part of Russian disinformation and hybrid campaigns. It uses fake accounts that pose as well-known foreign journalists, think tanks, and public figures, and spreads disinformation on their behalf. The network operates on various platforms: X (formerly Twitter), Bluesky, YouTube, and Telegram.

The “Matryoshka” network was disclosed back in 2023, and Bot Blocker played an active role in this matter. Initially, the target of this network among post-Soviet countries was Ukraine, then Moldova, where national elections were held in 2024 and 2025, and now Armenia, where parliamentary elections are expected in June 2026.

France has also been a target of the network. VIGINUM* (In French: Service de vigilance et de protection contre les ingérences numériques étrangères), a special service of the French government operating within the General Secretariat of Defense (SGDSN), has a study on the Russian “Matryoshka”.

According to the report, the actions of Matryoshka operators are coordinated and “directed against specific countries,” and at the level of each country, attacks on organizations and prominent individuals may be carried out in the same order, which indicates that the operators are using a pre-made list.

* Note that VIGINUM was created in 2021 with the aim of identifying and preventing foreign digital interference, in particular disinformation campaigns, bot and troll networks, and manipulative propaganda campaigns directed against France and European countries.

The network often uses fake documentary formats to exploit historical traumas and incite public fear against political figures.

How botnets are identified

Botntes are usually detected through simultaneous technical and content analysis. Researchers and fact-checkers look for several key signs that indicate that an account or group of accounts is not a real user, but part of a coordinated network.

Methods for detecting bot and troll networks include the following behavioral patterns:

• Account creation date and activity: Hundreds of accounts can be created in the same month or day.
• Repetitive content: posts with the same wording or the same hashtags from different users.
• Unnatural interaction: likes or retweets only within the network.
• Lack of identity: no photos, personal posts, or interactive communication.
• Concurrent activity: simultaneous publications on different platforms regarding the same material.

The combination of all these features allows digital security specialists to identify coordinated botnets, like “Matryoshka”.

Armenia and the “Matryoshka”

The structure, messages, and even language of the videos shared by the network about Armenia testify to the influence of Russian propaganda narratives:

• Blaming the West for instability in Armenia;
• Pashinyan depicted as an “agent of the West”,
• Armenia is moving away from “national, traditional values”.

The Fact Investigation Platform has recently made numerous publications (1, 2, 3, 4, 5) presenting details on how newly created but short-lived websites that imitate reputable websites spread disinformation about Armenian officials and their activity. Some publications have shown the close connection of disinformation with Kremlin circles.

Thus, the activity of “Matryoshka” in relation to Armenia, albeit with a relatively small number of publications, shows that the region’s domestic political topics continue to be part of Russian information influence.

Hasmik Hambardzumyan