Summary: The Shadow War for France’s 2027 Ballot
As the calendar inches toward the spring of 2027, the French presidential election is already being fought in the murky trenches of cyberspace, far before any candidate has officially filed their papers. The contest to succeed President Emmanuel Macron has become a prime target for a sophisticated, covert influence operation aligned with Russian interests, signaling that the battle for French democracy is not merely a domestic political affair but a critical frontier in Europe’s wider information war. The detection of this campaign, tracked by researchers from the network AntiBot4Navalny, reveals a coordinated effort dubbed “Matryoshka”—a layered, deceptive operation designed to destabilize the political landscape by targeting leading contenders with a barrage of fabricated media content, deepfake videos, and false narratives that weaponize real news events. This operation has already triggered criminal proceedings in France, underscoring the gravity of the threat and the fragility of public trust in an era where the distinction between authentic journalism and synthetic propaganda is becoming increasingly blurred. The initial wave of this offensive focused on Gabriel Attal, the youthful former prime minister whose political ascent and visibility made him a primary target for the operation’s malevolent creativity.
The campaign against Attal represents a textbook case of hybrid warfare, employing the visual language of trusted French institutions to inject poison into the national discourse. Operatives circulated fabricated videos bearing the iconic logos and graphical identity of premier news outlets such as Le Figaro and Libération, using this sheen of authenticity to deceive voters seeking reliable information. The content of these forgeries ranged from the grotesquely absurd to the deeply personal, with fake headlines claiming that Attal had been hospitalized, and others baselessly alleging he was suffering from Parkinson’s disease. This medical disinformation was calculated to undermine his physical fitness for the presidency, exploiting long-standing tropes about a leader’s health and vigor. In a paradoxical twist characteristic of these operations, the network also disseminated false claims that Attal was waging a phantom campaign against nonexistent Russian disinformation as a pretext to censor and block the social media platform X. Additional fabrications alleged that Attal had bribed journalists to spread disinformation against him, and even that he had considered faking an assassination attempt on himself to frame Russia—a rhetorical masterstroke designed to discredit any legitimate security concerns he might raise by pre-emptively labeling them as theatrical hoaxes. The sheer volume and chaotic nature of these falsehoods serve a purpose: to saturate the information ecosystem with noise, fostering cynicism and hopelessness among the electorate, making it impossible for citizens to discern truth from fiction.
The legal implications of this assault on Attal were swift and significant. In a landmark move, Attal filed a formal criminal complaint with French authorities, formally alleging foreign interference originating from Russian networks. His legal team emphasized that the fake content posed a direct threat to the integrity of the upcoming presidential vote, arguing that such manipulation was designed to corrupt the democratic process at its core. Reinforcing this argument, the lawyers revealed that Attal had been explicitly warned about the campaign by France’s highest security bodies: the Secretariat-General for Defence and National Security (SGDSN) and Viginum, the country’s dedicated foreign interference watchdog. This institutional acknowledgment elevates the incident from a mere nuisance to a recognized state-level threat, indicating that the French intelligence apparatus is actively bracing for a prolonged cyber-influence war. The decision to pursue criminal charges signifies a new, more combative stance by French political figures against such attacks—moving from passive absorption of the damage to actively seeking legal accountability. It highlights the growing awareness that simply ignoring disinformation is insufficient; instead, victims must expose the perpetrators, hoping that the glare of judicial scrutiny will deter future operations or at least reveal their methods to the public. While Attal’s office did not publicly comment further, the filing of the complaint serves as a powerful signal to allied nations facing similar threats that proactive legal defense is a viable strategy.
Following the intense firestorm directed at Attal, the Matryoshka network pivoted its focus to another formidable contender: Édouard Philippe, also a former prime minister and a leading figure in the polls for the 2027 race. The pattern of attacks against Philippe mimics the approach used against Attal, yet it demonstrates a more insidious evolution in the operation’s tactics—the seamless integration of real-life controversies with outright fictional claims. The campaign zeroed in on a current judicial investigation regarding elite financial misconduct, specifically probing a €2.154 million agreement between the Le Havre metropolitan authority and the association LH French Tech, signed while Philippe served as mayor. The forged articles, mimicking the formats of Le Monde and AFP, falsely claimed that a fellow implicated individual, Stéphanie de Bazelaire, had publicly admitted Philippe orchestrated corruption during this investigation. However, no such admission exists; de Bazelaire has made no such statements. The actual investigation, which involves potential charges of embezzlement of public funds, favouritism, and illegal conflict of interest, is a legitimate and serious matter, but the disinformation campaign skillfully stitches false quotes and denunciations onto the factual scaffolding of this legal case, creating a hybrid narrative that is exceptionally difficult for casual readers to debunk.
Beyond the corruption narrative, the operation against Philippe released a raft of other fabricated stories designed to appeal to distinct segments of the electorate and exploit historical wounds. One false post alleged that Philippe had apologised for referring to inhabitants of France’s former colonies as “scum”—a deliberately provocative and offensive claim likely aimed at stirring resentment within immigrant communities and left-wing voters, while simultaneously angering nationalist factions. Another fabricated narrative alleged that a company owned by Philippe’s wife had supplied toxic components for the Moderna COVID-19 vaccine, a classic anti-vaccine conspiracy trope repurposed to smear the candidate’s family and cast doubt on public health measures. These two examples show the operation’s strategy of targeting populist anxieties—colonial resentment and vaccine hesitancy—to fragment the electorate. The use of respected media outlets to lend credibility to these absurd stories is a key element of the “Matryoshka” playbook. By layering a tiny grain of truth (real legal cases, real public figures) with a thick coating of fabricated evidence, the operation ensures that even when a specific claim is debunked, the lingering suspicion remains in the minds of the audience, corroding trust in both the candidate and the media itself, a classic goal of information warfare.
The Matryoshka network is not a novice actor; it has a long history of interfering in democratic processes, and its current operations extend far beyond France’s borders. Indeed, a parallel campaign utilizing identical methods has been detected targeting candidates in Germany’s upcoming September state elections. In Germany, the network has shrewdly exploited the historical tensions between the former East and West, seeking to aggravate deep-seated grievances that persist decades after reunification. By amplifying regional economic disparities, cultural misunderstandings, and nostalgic narratives, the operation aims to deepen political polarization, weaken centrist parties, and foment a sense of alienation among voters. This cross-European coordination indicates a sophisticated, centrally-managed strategy to destabilize the European Union from within, using a common toolset and template tailored to local contexts. The ramifications for the upcoming French presidential election are stark: the disinformation is not merely an online nuisance but a coordinated offensive intended to erode the legitimacy of the eventual winner, regardless of who that is. For France, the spring of 2027 will be a test not only of the candidates’ political mettle but of the nation’s resilience against a digital adversary that uses the very instruments of democratic communication—free press and social media—as weapons against the state. The French government, through Viginum and the criminal courts, has chosen to fight back, but the ultimate outcome may depend on the vigilance of French citizens and their ability to navigate a profoundly poisoned information ecosystem.