Sustained AI-Driven Russian Disinformation Campaigns Doppelgänger, Storm-1516, and Matryoshka Reportedly Disrupting German Federal Elections

Leading up to Germany’s February 23, 2025, federal election, the alleged Russian Doppelgänger, Storm-1516, and Matryoshka (Operation Overload) disinformation campaigns have reportedly been deploying AI-generated deepfake videos and fake news sites to spread false claims about German politicians and public figures. AI-powered bots have allegedly been amplifying the content across social media. Researchers suggest the campaign sought to erode trust in Germany’s democratic process. Germany's domestic intelligence agency (BfV) described the scale as unprecedented.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.1 Disinformation, surveillance, and influence at scale

The incident involves state-sponsored malicious actors using generative AI to conduct coordinated, large-scale disinformation campaigns aimed at manipulating political processes and public opinion in the U.S. and Germany.

Additional risk subdomains

• 3.2 Pollution of information ecosystem and loss of consensus reality: Coordinated bot networks flooded social media platforms with AI-generated articles and deepfakes, polluting the information ecosystem during critical election periods.
• 3.1 False or misleading information: The AI systems were used to generate specific false narratives, such as fabricated corruption and personal scandals involving politicians.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The disinformation campaigns were intentionally orchestrated by human threat actors using deployed generative AI models to influence democratic elections.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The AI systems were used to generate deepfakes and synthetic content (AI-generated articles and cloned voices), which fall under transparency obligations for AI-generated content under the EU AI Act.

AI system and alleged parties

• AI system: generative AI programs
• AI purpose: Social Media Content Generation; Voice Generation
• Behaviour type: Tool
• Alleged developer: Unknown entities related to Doppelgänger, Unknown deepfake technology developers
• Alleged deployer: Storm-1679, Storm-1516, Russian government, Operation Overload, Matryoshka, John Mark Dougan, Doppelganger
• Alleged harmed parties: Unnamed British police officer, Unnamed American university presidents, Robert Habeck, Olaf Scholz, Natalie Finch, German voters, German politicians, German federal election integrity, General public of Germany, Friedrich Merz, Electoral integrity, Democracy, Academics targeted by Storm-1679, Academics targeted by Operation Overload, Academics targeted by Matryoshka

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Severe
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Minor, indirect Substantial
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Minor, indirect Substantial
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: The reports explicitly describe the creation and spread of malicious and toxic content targeting politicians and voters.

Directly caused: Generative AI was used to create fake news articles, political cartoons, and cloned voiceovers (such as the FBI director's voice) to spread false claims of voter fraud and political scandals.

Indirectly caused: Coordinated bot networks and social media accounts amplified this AI-generated content, reaching millions of views on platforms like X, TikTok, and Telegram.

Inferred additional harm: It is highly likely that millions of social media users were exposed to additional toxic, divisive, or xenophobic AI-generated content that went undetected by researchers.

Democracy

Reported: The reports explicitly describe efforts to undermine faith in democratic processes and institutions.

Directly caused: AI-generated content was used to fabricate claims of voter fraud, missing candidates, and ballot shredding to delegitimize the electoral process.

Indirectly caused: The campaigns sought to weaken trust in state institutions, mainstream media, and democratic elections in both the United States and Germany.

Inferred additional harm: The cumulative effect of these at-scale AI-enabled operations likely contributed to increased political polarization and a long-term erosion of public trust in democratic systems among exposed populations.

Psychological

Reported: The report explicitly describes psychological distress caused to individuals whose likenesses were manipulated.

Indirectly caused: The report describes how Natalie Finch, a mental health nurse, had her voice and video cloned using AI to speak about German politics, which caused distress and required her to publicly address the fake.

Inferred additional harm: It is likely that other individuals and politicians targeted by highly realistic deepfakes and fabricated personal scandals experienced significant emotional distress and anxiety, though specific numbers are not quantified.

Epistemic

Reported: The reports describe a massive influx of AI-generated misinformation and fabricated stories.

Directly caused: AI tools like ChatGPT were used to rewrite articles and fabricate entirely false stories, such as a German minister conspiring with Ukraine to recruit migrants for terrorist attacks.

Indirectly caused: The proliferation of over 100 fake news websites mimicking legitimate outlets polluted the information ecosystem, making it difficult for voters to distinguish real news from fabricated content.

Inferred additional harm: The widespread dissemination of highly realistic deepfakes and automated articles likely misled a significant portion of the electorate, eroding the shared consensus reality necessary for informed democratic participation.

People affected

• Occurrences reported: 2
• People reportedly harmed: 5
• People reportedly exposed: 2500000

Potential causes

Management

• Prioritizing Growth Over Safety: Platforms failed to restrict bots to maintain high engagement metrics.
• Failure to Curb Bot Accounts: Platform leadership did not restrict known Doppelganger bot accounts.
• Inadequate AI API Safeguards: AI providers failed to block accounts generating scale disinformation.

Technology

• AI Voice Cloning: AI cloned FBI director voice to spread fake voter fraud narratives.
• Deepfakes of Regular People: AI tools recreated a nurse's voice to spread political disinformation.
• Algorithmic Amplification: X's algorithm prioritized high-engagement extremist content.

Data Inputs

• Plagiarized Article Rewriting: Generative AI used to rewrite and spin legitimate news stories.
• Stock Media Manipulation: AI tools altered authentic stock images for misleading political posters.
• Inauthentic Audio Tracks: AI-generated crowd chants replaced original audio in TikTok videos.

Human Factors

• Disinformation Laundering: Prominent politicians shared AI-generated claims, normalizing them.
• Voter Susceptibility: Audiences struggle to distinguish AI deepfakes from authentic footage.
• Paid Actor Collaboration: Human actors collaborated with AI networks to legitimize fake stories.

Process and Methods

• Automated Bot Deployment: Adversaries used automation to post AI content at precise intervals.
• Sleeper Website Activation: Coordinated networks hosted AI articles on dormant pseudo-news sites.
• Bypassing Platform Detection: Doppelganger used cloaking and redirects to evade moderator reviews.

Regulatory Environment

• Inadequate Platform Oversight: Lack of enforcement under DSA to stop coordinated Russian bot networks.
• Weak KYC for Hosting Providers: Adversaries easily bought Western hosting servers using front companies.
• Lack of Deepfake Regulations: Absence of clear legal penalties for weaponizing political deepfakes.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple credible sources (NewsGuard, Correctiv, government agencies, and threat intelligence firms) provide consistent and detailed accounts of the disinformation campaigns, the specific AI tools used (ChatGPT, DALL-E 3, voice cloning), and the targeted elections in the U.S. and Germany.
• Ambiguities identified: The exact AI models used for voice cloning and video manipulation are not explicitly named, though ChatGPT and DALL-E 3 are identified for text and image generation.
• Alternative interpretations: Some might view the campaigns as primarily traditional cyber-influence operations where AI played only a minor, scaling role, rather than a novel AI-driven threat.

Russian-linked influence networks utilized generative AI tools to conduct large-scale, automated disinformation campaigns targeting the US and German elections. By generating fake news websites, cloning voices, and leveraging bot networks, the operations sought to undermine democratic processes and public trust, demonstrating an evolved capability in foreign information warfare.

• Overall national security impact: Severe
• Scope: Multiple nations
• Primary target: United States and Germany
• Other affected: NATO countries
• Alleged perpetrator: Russia

Threat characteristics

• Imminence: Near-term. Represents a developing and active threat targeting specific electoral cycles, requiring continuous monitoring and defense.
• Autonomy: Human-controlled. AI systems were utilized as tools by human operators who directed the content creation, translation, and dissemination processes.
• Novelty: Evolved capability. Represents a significant scaling and sophistication of traditional foreign influence operations through automated generative AI tools.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or kinetic assets were targeted or affected in this incident.
• Information security: Severe. Russian-linked networks used generative AI to scale disinformation, creating over 160 fake websites and deepfakes to manipulate the information ecosystem in the US and Germany.
• Sovereignty: Severe. The campaign directly targeted democratic elections in the US and Germany, attempting to undermine public trust in democratic institutions and influence voter behavior.
• Economic security: Minor. While utilizing advanced commercial AI tools, the incident did not target critical financial systems or result in strategic technology theft.
• Societal stability: Substantial. The operations sought to deepen political polarization and erode social cohesion by spreading divisive narratives and cloning citizens without consent.