A pro-Russia disinformation campaign is using free consumer AI tools to produce far more fake and manipulated material than before, according to new research. The campaign, known as Operation Overload and Matryoshka, has used AI-generated images, cloned voices, fake websites and coordinated social media posts to spread false narratives and draw attention from fact-checkers and media organizations.
How the campaign grew
Operation Overload has been active since 2023. Multiple groups, including Microsoft and the Institute for Strategic Dialogue, have aligned it with the Russian government. Researchers have also tied it to Storm-1679.
The campaign’s central method is impersonation. It circulates false narratives while mimicking media outlets, with the apparent goal of increasing division in democratic countries. Its targets include audiences around the world, including in the US, but researchers say its main target has been Ukraine.
The growth described in the research is substantial. Between July 2023 and June 2024, researchers identified 230 unique pieces of content promoted by the campaign. Those items included pictures, videos, QR codes and fake websites.
In the most recent eight-month period covered by the report, Operation Overload produced 587 unique pieces of content. Researchers said most of that newer material was created with help from AI tools. Between September 2024 and May 2025, the output increased dramatically and drew millions of views globally.
Why free AI tools matter
The researchers point to consumer-grade AI tools that are available for free online as a driver of the surge. The campaign does not appear to rely on custom AI systems. Instead, it uses tools that ordinary internet users can access, including AI-powered voice and image generators.
That matters because the barrier to producing convincing false material is lower. A single narrative can be turned into several formats, allowing the campaign to push the same story through different types of content. Researchers described this as “content amalgamation.”
In practice, that means one false claim can be reinforced by multiple assets. The campaign can pair a fake image with a manipulated video, a QR code, a fake website or social posts. Each piece gives the story another path to travel and another chance to reach a new audience.
“This marks a shift toward more scalable, multilingual, and increasingly sophisticated propaganda tactics,” researchers from Reset Tech and Check First wrote in the report.
Aleksandra Atanasova, lead open-source intelligence researcher at Reset Tech, told WIRED that the variety of material stood out. She said the campaign had broadened the kinds of content it used and was layering different formats around the same stories.
Images, voice clones and false scenes
The researchers could not identify every tool used by the campaign, but they narrowed some images to Flux AI. Flux AI is a text-to-image generator developed by Black Forest Labs, a German-based company founded by former employees of Stability AI.
Using SightEngine, an image analysis tool, researchers found a 99 percent likelihood that several fake images shared by Operation Overload were created with Flux AI image generation. Some of those images claimed to show Muslim migrants rioting and setting fires in Berlin and Paris.
The researchers then generated images that closely matched the look of the published images using prompts that included discriminatory language, including “angry Muslim men.” They wrote that this showed how text-to-image systems can be used to promote racism and anti-Muslim stereotypes, while also raising ethical concerns about how prompts function across different AI generation models.
Black Forest Labs told WIRED that it builds multiple safeguards to help prevent unlawful misuse, including provenance metadata that allows platforms to identify AI-generated content. The company also said preventing misuse depends on multiple layers of mitigation and cooperation among developers, social media platforms and authorities.
Atanasova told WIRED that the images reviewed by her team did not contain metadata.
The campaign has also used AI voice cloning. Researchers said this technology was used to manipulate videos so prominent figures appeared to say things they never said. The number of videos produced by the campaign rose from 150 between June 2023 and July 2024 to 367 between September 2024 and May 2025.
One example involved Isabelle Bourdon, a senior lecturer and researcher at France’s University of Montpellier. In February, a video posted on X made it appear that she was urging German citizens to take part in mass riots and vote for the far-right Alternative for Germany (AfD) party in federal elections. Researchers said the footage was taken from the university’s official YouTube channel, where Bourdon discussed a recent social science prize she won, and that AI voice cloning changed the apparent subject of her remarks.
Where the content spreads
Operation Overload’s AI-generated material is distributed through more than 600 Telegram channels. It is also pushed by bot accounts on platforms including X and Bluesky.
Researchers said TikTok became part of the distribution network for the first time in recent weeks. This was first spotted in May. The number of accounts was small, just 13, but the videos received 3 million views before TikTok demoted the accounts.
Anna Sopel, a TikTok spokesperson, told WIRED the platform had already removed the accounts named in the report and said TikTok works to detect and disrupt covert influence operations on an ongoing basis.
The report also compared platform responses. Researchers said Bluesky had suspended 65 percent of the fake accounts, while “X has taken minimal action despite numerous reports on the operation and growing evidence for coordination.” X and Bluesky did not respond to WIRED’s requests for comment.
The fact-checking trap
One of the campaign’s more unusual tactics comes after the fake content is created. Operation Overload sends emails to hundreds of media and fact-checking organizations around the world. Those messages include links to the fake material and ask recipients to investigate whether it is real.
The approach may seem self-defeating, but researchers say attention is part of the objective. If a real news outlet or fact-checking organization posts the material, even while labeling it false, the campaign still gains visibility from a trusted source.
Since September 2024, researchers said up to 170,000 such emails were sent to more than 240 recipients. The messages usually contained multiple links to AI-generated content, though researchers said the email text itself was not generated using AI.
The findings show how free AI tools can change the scale and texture of disinformation. Operation Overload is not described as using secret technology. It is described as using accessible systems to make more content, in more formats, for more platforms, while pushing old-style manipulation into faster production cycles.