Russian disinformation networks have launched a sustained and escalating campaign to interfere in France’s 2027 presidential election, using deepfakes, fabricated media reports and false claims about candidates’ health and alleged corruption, according to a new analysis by Ukraine’s Center for Strategic Communications. The report, shared by Ukrainian state news agency Ukrinform, says France is now the second-most-targeted country for Russian foreign information manipulation and interference (FIMI), behind only Ukraine. The European External Action Service’s fourth threat report, published in March 2026, also identified France as a major target of Russian manipulation, and the Ukrainian analysis recorded 107 major Russian information attacks aimed at France in 2025, compared with 112 aimed at Ukraine. France is preparing for a presidential election scheduled for April 18, 2027, with a possible run-off on May 2 if no candidate wins an outright majority in the first round. President Emmanuel Macron, who has served two terms, is constitutionally barred from seeking another, making the race unusually open. According to the analysis, Russian-linked networks have already zeroed in on three potential successors: former prime ministers Édouard Philippe and Gabriel Attal, and European Parliament member Raphaël Glucksmann. The operations targeting them range from fake articles imitating leading French news outlets to forged videos and stolen journalistic identities. The report says the campaign is not simply a matter of online noise; it is a deliberate effort to shape the outcome and legitimacy of the French election. The high volume of attacks, comparable to the level used against Ukraine, suggests Moscow views France as a crucial battlefield in a wider information war over Europe’s future. Researchers warn that as the vote approaches, digital influence operations are likely to multiply, exploiting new AI tools and messaging platforms to spread falsehoods faster and more persuasively than any fact-checker can respond.
One of the first operations identified in the report was Storm-1516, a known Russian disinformation network that produces fabricated videos, deepfakes and false testimonies. Storm-1516 initially targeted Philippe, the former prime minister and mayor of Le Havre, with false assertions about his health. Although the specific condition was not named, health-related smears are a common tactic because they can be denied and repeated, forcing candidates onto the defensive while the original allegation continues to circulate. Philippe, who has consistently polled as a leading contender in the race to succeed Macron, was targeted because of his centrist appeal and institutional credibility. The same operation later set its sights on Glucksmann, a pro-European, pro-Ukrainian MEP. A fake news website designed to look like the French outlet Blast claimed that Glucksmann’s wife was trying to bribe media organizations to improve his public image ahead of election day. The operation also allegedly stole the identities of real French journalists and used fabricated documents to support its claims. This two-step approach—impersonating credible news brands and hijacking the names of actual reporters—is meant to create the illusion of independent verification. False stories can then be amplified by social media users, smaller websites and even unwitting commentators who believe they are sharing authentic journalism. The Ukrainian analysts note that the attacks on Glucksmann fit a broader pattern of targeting politicians who strongly support Ukraine and democratic institutions. By painting such figures as corrupt, media-manipulating or controlled by hidden interests, Russian networks hope to remove credible voices from the political space. The use of deepfakes and forged bylines also raises the cost of fact-checking, because each false story must be individually debunked while the operation simply moves on to the next fabricated narrative.
Another Russian-linked operation, known as Matryoshka, targeted Gabriel Attal, the youngest former prime minister in France’s modern political history and another potential presidential candidate. The operation distributed fake videos styled to resemble reports from well-known French outlets, including Le Figaro and Libération, linking Attal to alleged political scandals. Some posts falsely claimed that Attal had been hospitalized or that he had Parkinson’s disease. Other fabricated claims said he had paid media outlets to spread disinformation about himself and was even considering staging an assassination attempt that would be blamed on Russia. The Matryoshka operation is distinctive because of its layered, self-referential structure. Some of its stories are so implausible that they appear designed to sow confusion and ridicule rather than belief. The false assassination plot, for example, works in several ways at once: it damages Attal’s reputation, but it also pre-emptively delegitimizes any future official complaint about Russian interference by suggesting that French politicians invent such threats for electoral gain. If enough people have seen the fake story, real warnings from French intelligence agencies may be dismissed by a segment of the electorate as political theater. Attal responded by filing a legal complaint, describing the campaign as “foreign interference originating from Russian networks.” France’s General Secretariat for Defense and National Security, together with its Viginum digital interference monitoring unit, had alerted Attal to the hostile material before the complaint was lodged. The government’s awareness of the operation shows that France’s security apparatus is tracking these threats. But the report warns that legal and administrative responses are inherently reactive and often slower than the spread of disinformation. By the time a fake post is debunked or a court takes action, the story may already have reached millions of people and entered the country’s political bloodstream.
The campaign goes far beyond individual politicians, according to the Center for Strategic Communications. The operation known as Portal Kombat, especially its network of Pravda-branded websites, has directly targeted French institutions and the electoral process itself. The group operates sites such as francais.news-pravda.com and fr.news-pravda.com, which act as automated content amplifiers for Kremlin narratives. These websites mimic the style of news aggregators while pushing one-sided, anti-Western content through anonymous channels. A central theme is the delegitimization of Viginum, the French agency responsible for countering foreign digital interference. Russian-backed messaging repeatedly depicts Viginum as an instrument of “total control and censorship” and as a threat to free expression. This narrative is strategic: it lays the groundwork for claims that the 2027 election will be stolen or manipulated by French authorities. If a significant number of voters believe that the agencies protecting electoral security are actually tools of political surveillance, then any officially confirmed case of foreign interference can be dismissed as a false flag or conspiracy theory. The same messaging claims that France has lost its sovereignty to the United States and suggests that a future French president should withdraw the country from NATO and restore closer relations with Moscow. These themes align with long-standing Russian strategic objectives of weakening European unity and eroding the transatlantic alliance. The campaigns also promote conspiracy theories about corrupt French elites and exploit sensitive social issues, including LGBTQ rights and gender-related topics, to inflame cultural divisions. The broader message attacks the EU and NATO as the sources of lost sovereignty, economic decline and military escalation. The Ukrainian analysis argues that the ultimate goal is to create an environment in which the legitimacy of the next French president is questioned from the moment the election ends, regardless of who wins.
The distribution architecture of this campaign differs significantly from earlier Russian propaganda efforts. Anonymous websites and Telegram channels, rather than official state media, now carry most of the content, according to the analysis. Websites accounted for 49.8 percent of the analyzed publications, while Telegram accounted for 47.4 percent. Official Russian outlets such as RT en français, TASS and Sputnik Afrique were also identified in the report, but they played a smaller role. The shift toward anonymous and unaffiliated platforms is a deliberate adaptation to the digital environment. Official state-owned channels are easily identified, blocked and attributed, whereas anonymous websites can be created quickly, abandoned and replaced. Telegram channels can be operated under a range of handles without meaningful transparency about ownership, making it harder for researchers, journalists and platforms to trace the origin of a story and allowing Russian networks to maintain plausible deniability when a fake story is exposed. The content model appears to be hybrid: state media may produce the initial message, but anonymous channels do the amplification, often adapting the material to French political culture and current events. Because much of the distribution occurs on platforms with weaker verification and moderation, the disinformation can reach audiences that have abandoned traditional media. The report also notes that Telegram’s file-sharing capabilities make it especially suitable for spreading deepfake videos and fabricated documents. The reliance on anonymous channels means that even when one network is dismantled, copycat operations can restart with new names and new accounts. This decentralised model is one of the main challenges facing French and European counter-disinformation agencies. France’s status as a permanent member of the UN Security Council, a NATO member and the EU’s leading military power explains why Moscow treats it as a strategic target second only to Ukraine itself.
French authorities have begun to respond. Attal filed a legal complaint against the disinformation campaign and explicitly described it as “foreign interference originating from Russian networks.” In August, the Paris prosecutor’s office announced that it had opened an investigation into suspected Russian interference ahead of the 2027 presidential election. The probe currently concerns Philippe and Attal. The Center for Strategic Communications said the documented cases are not isolated or accidental; they point to a coordinated Russian effort to shape France’s information environment before the vote, targeting both individual candidates and public confidence in the institutions that oversee the democratic process. The report calls for stronger cooperation with Ukrainian and other European partners, faster sharing of threat intelligence, stricter platform transparency rules and improved media literacy among French voters. It also suggests that election authorities should prepare contingency plans for deepfake releases on election day itself, when fact-checking resources are most stretched and newsrooms are under intense deadline pressure. Political parties, too, need to understand that Russian operations are designed to polarize and destabilize, not to offer a constructive political alternative. The report warns that the campaign is likely to intensify as April 2027 approaches, with new tools, new narratives and new targets likely to emerge. The objective is not necessarily to place a Kremlin-friendly candidate in the Élysée Palace; it is to weaken France, fracture Europe and undermine the support that sustains Ukraine’s resistance. The center’s conclusion is sobering: France’s 2027 presidential election will be a test not only of the candidates and the voters, but of the entire country’s ability to withstand an adversary whose most powerful weapon is information itself.
