BLUF: Per Bloomberg reporting on October 14, as summarized by secondary outlets, Russia-, Iran- and China-linked networks are using mainstream generative AI tools ahead of the November 3 US midterms. The Russia-linked Matryoshka network (also tracked as Operation Overload and Storm-1679) is reported to be producing fabricated news clips styled as established outlets. For organizations the risk is not only election content. The same technique, a fake clip in a trusted outlet's look, can be aimed at a company, an executive or a client. We have high confidence the technique exists, moderate confidence in the current volume, and have not reviewed the underlying research ourselves.
What Is Established
This account relies on the October 14 reporting as relayed by a secondary outlet, and on OpenAI's October 8 announcement that it banned accounts tied to Russian and Iranian influence operations (covered in our briefing on false-front influence operations).
- Three state-linked clusters. Reporting names Russian, Iranian and Chinese networks using generative AI to make video, personas and accounts.
- Matryoshka. Reported to have spread AI-manipulated video since early September, including celebrity deepfakes and fabricated clips made to look as if they came from outlets such as CNN.
- Iran-linked networks. Reported to push partisan AI-generated material, in some cases posing as US activists.
- China-linked networks. Spamouflage and related clusters are described as large pools of artificial accounts managed with AI.
What Is Not Established
We have not seen the underlying research. Attribution is the assessment of the researchers and companies quoted, not a legal finding. Reach is unclear: operations like these routinely publish at volume and persuade few people, a gap we discuss in AI influence operations: more capacity, unproven persuasion. Do not assume any single clip changed anyone's mind.
Why a Brand Should Care
A fabricated clip in a real outlet's look has one purpose: borrowing trust. The target does not need to be a politician.
- Your name can be the subject. A fake "report" about a company, a recall or an executive spreads faster than a correction because it arrives looking like journalism.
- Your own people may share it. Employees, customers and partners see a familiar masthead and forward first.
- Verification is slow. Outlets must be asked, and the fake is usually gone or reposted by the time they answer.
What to Do Now
- Name a verification owner. One person decides whether a clip about you is real, and who to ask at the outlet. Keep the outlet's editorial contact in a list.
- Set up a source-of-truth page. A page on your own site where you post confirmed statements, so a fake can be answered with a link.
- Brief staff. A clip that appears to come from a major outlet and is only on social is a reason to pause, not to share.
- Capture evidence. Save the clip, the account, the URL and the time. Platforms and outlets act faster with a clean record.
- Know where a fake would appear first. Short-video platforms, messaging channels and small unfamiliar sites usually precede mainstream pickup. See our guide to narrative threat monitoring.
- Pre-agree the response threshold. Decide in advance when you correct publicly and when you stay quiet, since amplifying a low-reach fake can do more harm than the fake.
Questions Leaders Should Ask This Week
- If a clip styled as a major outlet named us tomorrow, who would we call first?
- Do we have a page where we can post a dated denial?
- Would our staff share it before checking?
- Are we watching the channels where these clips start?
Organizations that want this built into an operating plan can read about our narrative and reputational threat intelligence work.
Confidence and Caveats
High confidence that fabricated clips styled as real outlets are an established technique. Moderate confidence in the current scale, which depends on a single reported source we have not independently reviewed. Low confidence in any claim about effect on voters or audiences. We will update this note when primary research is available.
Frequently Asked Questions
What is Matryoshka? A Russia-linked influence network, also tracked as Operation Overload and Storm-1679, reported to produce fabricated news-style videos and send them to outlets and fact-checkers.
Can a fake clip target a company rather than a politician? Yes. The method, a false item in a trusted outlet's look, works against any organization or executive.
How do we check whether a clip is real? Ask the outlet's editorial desk directly, look for the item on the outlet's own site, and check the age and history of the account that posted it.
Should we respond publicly to every fake? No. Set a threshold in advance, because answering a low-reach fake can spread it.
Kronus Intelligence Group builds and operates custom intelligence infrastructure for organizations that cannot afford to be wrong. If your environment requires it, we want to hear from you.
Start a Project →