Russia’s Matryoshka disinformation network moved within hours of the April 25 White House Correspondents’ Dinner shooting to manufacture a Ukrainian connection, deploying fabricated quotes, fake videos and coordinated bots before Western audiences had time to learn the shooter’s name.
Within minutes of Cole Thomas Allen opening fire at the Washington Hilton on April 25, Russian hybrid operations structures had identified their opportunity. By the time US media had confirmed the shooter’s identity — a 31-year-old tutor and computer engineer from Torrance, California — the Kremlin-linked Matryoshka bot network was already flooding X, Telegram and Bluesky with a coordinated narrative: Ukraine was behind the attack.
The campaign was documented by researchers at the Antibot4Navalny project, which monitors Russian bot networks on social media, and reported by The Insider.
Analysts identified at least nine distinct categories of fabricated content circulating as part of the campaign. The operational logic was consistent across all of them: take a real event, invent a Ukrainian dimension, and repeat it across platforms simultaneously.
The first and most foundational layer concerned the shooter’s biography. The network spread claims that Allen had received repeated workplace reprimands for “obsessive pro-Ukrainian propaganda”, had donated more than $20,000 to Ukraine, displayed Ukrainian flags at his workplace and expressed interest in joining the Ukrainian armed forces — none of which appears in any public record or court filing.
To lend the narrative academic credibility, fabricated expert endorsements were layered on top. A figure described as “political scientist Roger Griffin” was quoted claiming that “a convinced supporter of Ukraine and the Democrats” represents “a catalyst for radicalisation”. No such statement exists. More damagingly, Bellingcat founder Eliot Higgins was falsely cited as claiming that “European intelligence services used a Ukraine supporter to eliminate Trump” — a fabrication that fits a well-documented Matryoshka pattern. The network had previously attributed invented statements to Higgins in campaigns targeting Moldova and in the Greenland disinformation operation of January 2026, in both cases confirmed as fabrications by Higgins himself.
Fabricated video content formed a third strand. Actor Pedro Pascal was shown in a manipulated clip allegedly endorsing the attacker and blaming Trump for the attack, while fake materials styled as outputs from Western media organisations and international bodies were produced to simulate independent corroboration.
The most elaborate fabrications involved invented Ukrainian accomplices. The network circulated claims that the FBI was searching for two Ukrainian citizens — father and son Dmytro and Valery Tomenko — who allegedly worked at the Washington Hilton and provided Allen with a floor plan of the building. Running alongside this was a separate narrative about a phantom suspect named “Dmytro Rymarenko”, said to have entered the United States via the Mexican border together with the Tomenkos. Neither individual appears in any law enforcement record connected to the case.
Two further fabrications targeted broader Ukrainian complicity. Claims circulated that US immigration enforcement had begun raiding shelters for Ukrainian refugees because Allen had “accomplices among Ukrainian refugees” — with Ukraine’s Foreign Ministry falsely reported to have condemned the raids. Neither the raids nor the statement occurred. Simultaneously, the network manufactured evidence of a Ukrainian social media flash mob using the hashtag #NextTime, allegedly celebrating the attack, and attributed comments to an invented “political scientist Andrzej Gil” who claimed Ukrainians were “lamenting the failure of the assassination attempt”.
The final fabrication was the most direct: a note allegedly found in Allen’s car in which he claimed to have acted “to save Ukraine” and described himself as a “martyr”. Allen’s actual manifesto — sent to family members minutes before the attack and cited in federal court filings — makes no mention of Ukraine. It focuses entirely on grievances against the Trump administration, describing the president as “a paedophile, rapist and traitor”.
Matryoshka’s fabrications represent the hard end of the operation. But a subtler and arguably more dangerous layer ran in parallel: pro-Kremlin proxy outlets in Slovakia and the Czech Republic repackaged real facts about Allen into a “Ukrainian connection” framing that was far harder to debunk because it contained no outright lies.
Slovak outlet Hlavný Denník published a piece headlined “Ukrainian connection to the White House shooting: The shooter actively supported Kyiv and collected donations for the Ukrainian armed forces.” The article reported that Allen had expressed support for Ukraine on social media and had been involved in fundraising for Ukrainian units – both accurate – while the headline and framing constructed a causal link the article itself quietly walked back, noting that “no official information was provided about any connection with Ukrainian government agencies or Zelenskyy, although this cannot be excluded.”
The Czech site Oral.sk went further in tone, describing Allen as “a fanatical opponent of Trump and supporter of Ukraine” and attributing his radicalisation to “progressive corporate media and radical non-profits”—a framing that positions mainstream Western media as a radicalisation pipeline feeding violence against Trump.
The most explicit transmission of a Kremlin narrative came through Armádny Magazín, which published a commentary attributing the following to Valentin Bogdanov, head of the New York bureau of VGTRK – Russia’s state television network: “Routh travelled to Kyiv in 2022, participated in pro-Ukrainian demonstrations and also tried to recruit foreign fighters for the war against Russia. The idea that ‘Trump is not good for Ukraine’ and that for this reason it is necessary to prevent his election is identical in both cases.” The parallel drawn between Ryan Routh, who attempted to assassinate Trump in 2024, and Allen was presented without any editorial distance, effectively laundering a Russian state media talking point through a Slovak publication.
A separate fabrication targeting Ukraine’s ambassador to the United States, Olga Stefanishyna, circulated in parallel: a video clip purportedly showing her stealing wine bottles during the chaos of the shooting. Euronews debunked the claim, establishing that the woman in the video was not Stefanishyna.
Matryoshka is not an improvised operation. According to The Insider, the network operates as part of a broader Russian disinformation ecosystem directly linked to state authorities and security services — and its current form is itself the product of institutional evolution within the Kremlin’s influence apparatus.
After the dissolution of structures associated with Yevgeny Prigozhin’s troll factory, coordination of large-scale disinformation campaigns was transferred to the Russian presidential administration. Oversight sits at the senior level: the operation is run under the direct supervision of First Deputy Head of the Presidential Administration Sergei Kiriyenko, one of the most powerful figures in Russia’s domestic and hybrid warfare architecture. Content production, however, is outsourced to private contractors. The most prominent among them is the Agency for Social Design, along with a cluster of affiliated structures responsible for developing fabricated news, memes and video content targeting foreign audiences.
A separate but integrated role is played by Russian special services, particularly the GRU. Operations of this type can involve officers operating under diplomatic cover, foreign intermediaries and recruited participants. Several campaigns in this operational family — including the one known as Storm-1516 — have been directly linked to GRU-connected structures.
The network’s primary instrument is short vertical video, produced to mimic the visual language and branding of credible Western media organisations and international bodies. These videos are distributed simultaneously across X, Telegram, Bluesky and closed chat rooms – a multi-platform saturation approach designed to create the impression of widespread, independent corroboration before fact-checkers can respond. Matryoshka also systematically emails its fabricated content directly to fact-checking organisations and media outlets, a tactic researchers have described as partly aimed at occupying verification teams with difficult-to-debunk material while the narratives spread elsewhere.
The network first emerged in its current form in September 2023 and has since run coordinated operations targeting the US 2024 presidential election, Moldova’s 2024 presidential elections, the Greenland narrative in January 2026 and now the Trump assassination attempt. In each campaign, the same core technique applies: a politically salient real event is used as a vehicle for a pre-fabricated Kremlin strategic narrative, with Matryoshka providing the amplification infrastructure and proxy outlets in Central and Western Europe providing the veneer of independent regional corroboration.
When Ukrainian drones struck a Tuapse oil refinery three times in two weeks, the Kremlin…
MEPs voted 446 to 63 on Thursday to demand the swift establishment of a special…
Two SIS officers held in Russia were released on 28 April as part of a…
Geoffrey Cox, who served as Attorney General under both Theresa May and Boris Johnson, was…
The European Parliament voted 418 to 207 on Wednesday to freeze EU funds for Slovakia…
April 2026 was not just a month of active Russian propaganda — it was a…