What began as an ordinary day for Ben Gilbert, a Colorado-based professor who mostly posts about natural resources and guitars on social media, turned into a lesson in modern information warfare.
Last month, a video posing as a news report suddenly appeared on Gilbert’s Bluesky account, accusing France of weakening its own police force by financially backing Ukraine. The problem was that he had never posted it.
According to researchers and Bluesky, Gilbert was among hundreds of users whose accounts were hijacked as part of what investigators believe is a new Russian disinformation campaign aimed at weakening Western support for Ukraine, according to a report by the New York Times.
The operation targeted a wide range of users on the social media platform, from journalists and professors to artists and filmmakers, whose accounts were then used to circulate fabricated videos and fake news reports. Some of the manipulated clips were created using artificial intelligence, including one that impersonated a Canadian police official criticising French President Emmanuel Macron.
Researchers at Clemson University, working alongside an online monitoring collective known as the dTeam, linked the campaign to the Moscow-based Social Design Agency. The effort is believed to be connected to a wider Kremlin influence operation known as “Matryoshka”, named after Russian nesting dolls.
Unlike previous Russian propaganda efforts that relied heavily on fake accounts and bot networks, this campaign appeared to take a different route by infiltrating real user profiles.
Bluesky said it had identified and removed thousands of such posts since April, describing Russian influence operations as “an industrywide problem”.
“We dedicate significant resources toward detecting and disrupting coordinated inauthentic campaigns,” the company said in a statement.
Gilbert only discovered the post after being contacted by The New York Times.
“I just deleted it,” he said in an email.
In several other cases, users learned their accounts had been compromised only after Bluesky suspended them and asked owners to reset access credentials.
Among them was Pamela Wood, a political reporter with The Baltimore Banner, whose account was suspended during a vacation after it shared a misleading video claiming The New York Post had tied Ukraine to a man accused of attempting to assassinate US President Donald Trump at the White House Correspondents’ Association dinner.
“Bluesky didn’t provide much information but suggested that my account may have been hacked or compromised,” Wood said. “My account is rather vanilla, just posting my stories, pretty much, and I hadn’t posted or even looked at Bluesky in a few days, so getting hacked made the most sense.”
About The Matryoshka Operation
The Matryoshka operation first emerged in 2024 and became known for producing fake reports designed to resemble content from established news organisations such as Reuters and France 24. Investigators say the strategy often involves baiting fact-checkers into debunking the fabricated claims, which are then amplified further by Russian media outlets presenting them as Western-origin narratives.
Russian propaganda efforts on Bluesky gained visibility during Germany’s elections last year, when pro-Kremlin campaigns attempted to strengthen support for the far-right Alternative for Germany (AfD) party.
Joseph Bodnar, a researcher at the Institute for Strategic Dialogue, said the use of real Bluesky accounts represented a notable escalation.
“What we usually see is using hijacked accounts on X, but those are random, obscure accounts with crazy avatars,” Bodnar said. “They’re not trying to get someone moderately known or respected.”
Ukraine remains the primary focus of the Matryoshka network, though earlier campaigns also targeted the 2024 Paris Olympics and the Trump administration’s dismantling of the US Agency for International Development.
One of the operation’s most successful campaigns falsely claimed that USAID had paid celebrities, including actor Ben Stiller, to visit Ukraine. According to researchers, the fabricated videos reached millions online.
While recent Bluesky posts also touched on Trump, investigators said much of the messaging centred on France and Armenia, two countries Moscow views as strategically important as Europe deepens support for Kyiv and Armenia edges away from Russia’s influence.
