The “Matryoshka” bot network, a sophisticated Russian disinformation operation, has launched a wide-reaching campaign focused on the June 29 assassination attempt against Ukrainian businessman Vadym Yermolaiev in Monaco. According to reports from the Antibot4Navalny project, the network is disseminating high-quality fake videos disguised as content from reputable Western media outlets and think tanks. By leveraging the logos and branding of established institutions, the campaign aims to inject a specific, fabricated narrative into the public sphere: that the Security Service of Ukraine (SBU) orchestrated the bombing to silence Yermolaiev, whom they falsely claim was preparing to provide incriminating testimony against President Volodymyr Zelensky to the National Anti-Corruption Bureau of Ukraine (NABU).
The disinformation campaign utilizes a “laundry list” of fabricated quotes from influential, real-world figures to bolster its credibility. Among the baseless claims are alleged statements from Monaco police chief Éric Arella, who is falsely cited as blaming Ukrainian intelligence for a series of crimes in Europe, and misinformation attributed to ISW president Kimberly Kagan, who is depicted as accusing the SBU of initiating a campaign of terrorism. Even prominent investigative organizations have been targeted; the network released videos under the Bellingcat brand claiming French intelligence complicity in the attack, and fabricated clips attributed to Wired and Politico suggest an academic “confirmation” of Zelensky’s guilt through artificial intelligence analysis. Extensive verification by The Insider confirms that none of these individuals or organizations ever made these statements.
The logistical reality of the attack stands in stark contrast to the narratives spun by the Matryoshka network. On the evening of June 29, a lone assailant left an explosive device packed with shrapnel at the entryway of a residential building in Monaco, injuring Yermolaiev, his female companion, and his young son. Monaco’s Attorney General, Stéphane Thibaut, has classified the incident as an attempted murder and confirmed that the suspect, who remains at large, fled across the border into French territory. Despite the bot network’s insistence on a political motive tied to anti-corruption testimony, authorities have stated that no clear motive for the attack has yet been established.
The victim himself is a figure of significant controversy. Vadym Yermolaiev, a major developer from Dnipro, holds a Cypriot passport and renounced his Ukrainian citizenship in 2017. He has faced scrutiny from the Ukrainian government, including personal sanctions imposed by President Zelensky in December 2023, following allegations that his business interests in Crimea transitioned to Russian legal jurisdiction following the 2014 occupation. Furthermore, his familial ties include his elder son, Artur Yermolayev, who recently reached a plea deal in Estonia after being convicted of operating a fraudulent call center network that swindled over €100 million from various victims.
The mechanism behind this campaign is the hallmark of the Matryoshka operation—a multi-layered infrastructure designed to create artificial information noise. Researchers describe the network as a “nesting doll” system, where bots are embedded within various digital platforms to mimic authentic human discourse or legitimate institutional reporting. By operating through a dual-pronged approach—simultaneously generating thousands of fake, locally-patterned social media profiles and coordinating the mass distribution of high-production-value fake video content—the network obscures its Russian origins while polluting the information landscape to manipulate international public perception.
This campaign serves as a diagnostic example of the modern challenges in countering state-sponsored disinformation. By weaponizing the brands of respected Western media and utilizing advanced synthetic media tactics, the Matryoshka network effectively forces legitimate news organizations and fact-checkers into a defensive posture. As the investigation into the Monaco bombing continues, the digital trail provides a clear window into how such networks exploit real-world violence to manufacture geopolitical toxicity, turning a localized criminal act in a small principality into a global platform for pro-Kremlin propaganda.
