TLP:CLEAR · Disclosure is not limited.

Europe Hybrid Threats: New Influence and Hoax Reporting

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-11-12 14:49Z · Overall confidence: HIGH

BLUF

Russian-linked Matryoshka is very likely running an influence campaign ahead of Spain’s 29 November election, while a separate investigation alleges Russian military intelligence sought to inflame protests in France. Italy has reported mass bomb-threat emails to schools, but the supplied reporting does not establish Russian responsibility for those threats or a single operation coordinating the activity across countries.

Executive summary

Reporting published on 12 November adds detail on three distinct threat patterns. AntiBot4Navalny researchers describe Matryoshka content impersonating established media and promoting opposition to support for Ukraine, sanctions and Spain’s EU membership. An investigation based on allegedly intercepted correspondence links Russian military intelligence to efforts to influence French protest movements, but the supplied material does not include independent official confirmation of that attribution. In Italy, the government reported threat emails to more than 1,800 schools on 12 November, following similar alerts to about 6,300 schools the previous day; police in Rome said the threats were unsubstantiated. The reporting documents activity and disruption, but does not establish a centrally coordinated Russian campaign spanning these cases.

Change from previous assessment

Since the 11 November brief, confidence in the reported Matryoshka campaign targeting Spain has risen from low to medium. New reporting attributes specific fabricated videos and media impersonations to findings by AntiBot4Navalny researchers. Reporting also adds an allegation of Russian military intelligence efforts to influence French protests and new figures for school threat emails in Italy, including reports affecting more than 1,800 schools on 12 November. These additions do not establish Russian direction of the Italian threats or a single centrally directed campaign. Initial confidence in cross-case coordination remains low to medium.

Key judgments

1. Russian-linked Matryoshka is very likely conducting an influence campaign aimed at Spain’s 29 November snap parliamentary election. AntiBot4Navalny researchers report fabricated videos and counterfeit media content, including material mimicking France 24 and El País, that promotes ending aid to Kyiv, lifting sanctions on Russia and Spain leaving the EU. The reporting does not establish the campaign’s audience reach or effect on voter behaviour. (Confidence: medium · REPORTED)
   • I&W: AntiBot4Navalny researchers or Spanish election authorities document additional Matryoshka accounts or fabricated election content before the vote, confirming continued activity. (0-17 days)
   • I&W: Platform or independent research findings show the cited material was not distributed by Matryoshka-linked accounts, weakening the attribution. (0-17 days)
2. It is unlikely that the supplied reporting establishes Russian military intelligence’s operational role in efforts to inflame French protests beyond an allegation. InformNapalm’s investigation says intercepted correspondence was linked to GRU lieutenant colonel Stanislav Nemich and describes covert efforts to intensify anti-government sentiment and encourage confrontation with police. The account rests on one investigative reporting chain and the correspondence is described as allegedly linked to Nemich; no independent French government confirmation appears in the supplied reporting. (Confidence: low · ASSESSED)
   • I&W: French authorities publish forensic findings that authenticate the correspondence and link it to Nemich or the GRU, strengthening the attribution. (0-30 days)
   • I&W: French authorities or independent investigators dispute the correspondence’s provenance or identify a different source for the protest messaging, weakening the attribution. (1-3 months)
3. The email bomb threats almost certainly created a recurring disruption risk for schools in Italy, but it is unlikely that the supplied reporting establishes Russian responsibility. The Italian government reported threats to more than 1,800 schools on 12 November and similar alerts to about 6,300 schools on 11 November. Rome police said they had nothing to substantiate the threats, while authorities in Scotland, Northern Ireland and the Republic of Ireland treated similar emails as hoaxes and kept schools open. The sender’s identity and any state direction remain unestablished in the supplied reporting. (Confidence: medium · ASSESSED)
   • I&W: Italian authorities report further school threat emails and document closures or evacuations following specific threat assessments, confirming continued disruption. (0-14 days)
   • I&W: Investigators identify the sender or infrastructure and publish evidence linking it to a Russian state actor, changing the current attribution assessment. (0-30 days)
4. It is unlikely that the supplied reporting establishes a single Russian-directed operation coordinating Matryoshka’s Spain campaign, the alleged effort to influence French protests and the school threat emails in Italy. The Spain reporting identifies Matryoshka activity, the French allegation comes from a separate investigation, and the Italian reporting does not identify a Russian link. This assessment does not rule out coordination; the supplied claims show no shared command, personnel or infrastructure across the cases. (Confidence: medium · ASSESSED)
   • I&W: Investigators identify shared accounts, infrastructure or personnel connecting Matryoshka activity, the French protest operation and the Italian threat emails, supporting a coordination assessment. (0-3 months)
   • I&W: Authorities establish that the Italian emails came from unrelated senders and investigators fail to corroborate operational links between the Spain and France cases, further weakening the coordination hypothesis. (0-3 months)

Outlook & scenarios

Matryoshka activity continues through Spain’s election (65%)

Matryoshka continues circulating fabricated media content and anti-Ukraine narratives ahead of the 29 November vote. Spanish authorities and researchers identify further examples, but the available reporting still does not demonstrate a measurable effect on voting or public opinion.

Separate incidents remain unconnected (25%)

The Spanish influence campaign, the allegations concerning French protests and the Italian school emails remain distinct cases. Reporting adds detail on individual activity, but investigators do not establish shared infrastructure, personnel or direction.

Cross-border coordination emerges (10%)

Low-probability, high-impact wildcard: investigators identify common infrastructure or personnel linking the Matryoshka campaign, the alleged French operation and the Italian threat emails. Such evidence would raise the prospect of coordinated activity designed to compound public disruption and complicate attribution.

Recommendations

1. Track Matryoshka material ahead of Spain’s 29 November election. Preserve original posts and files, record the media brands being impersonated, and distinguish documented distribution from unverified estimates of reach or effect.
2. Keep the Italian school threat emails separate from Russian attribution reporting. Record threat counts, closures, evacuations, police assessments and any disclosed sender or infrastructure evidence in a single incident timeline.
3. Treat the French protest allegation as unconfirmed until French authorities or independent investigators authenticate the correspondence and substantiate the link to Stanislav Nemich or the GRU.
4. Assess cross-case coordination only when reporting identifies specific shared infrastructure, personnel, funding or direction. Do not infer a common command from similar tactics or timing alone.

Confidence & uncertainty

Confidence is high in the underlying event picture: the Italian school threats were reported with an Italian government account, and the Spain campaign is described in reporting that names AntiBot4Navalny researchers and specific fabricated content. The source base is less conclusive on attribution. The Spain reports draw on the same research findings, the French claim rests on one investigation using allegedly intercepted correspondence, and the supplied reporting does not establish Russian direction of the Italian emails or coordination across the cases. Overall confidence applies to the reported activity, not to a Europe-wide command structure.

Intelligence gaps

• [EEI 1.2 · UNCOVERED] Observed reconnaissance activity around critical sites indicative of attack planning (unauthorised drone flights, repeated surveillance visits, loitering vehicles, mapping/photography of assets). Recommended collection: open-source/media
• [EEI 1.3 · UNCOVERED] Law-enforcement or customs seizures, arrests or interdictions of persons or shipments carrying explosives, sabotage tools, specialty cutting/electrical equipment, or covert comms gear destined for/near critical infrastructure. Recommended collection: law enforcement
• [EEI 2.1 · PARTIAL] Emergence or amplification of coordinated social-media networks (sets of accounts, pages, channels) pushing identical narratives or hashtags across multiple platforms, including bot-like activity metrics and origin IP/common management indicators. Recommended collection: social-media/OSINT
• [EEI 2.2 · PARTIAL] Publication or internal guidance from state-run media, proxy outlets, or identified influence platforms distributing talking points, pre-scripted messaging, or translated content targeted at specific EU countries/communities. Recommended collection: open-source/media
• [EEI 2.3 · PARTIAL] Distribution of manipulated multimedia (deepfakes), targeted phishing/whaling campaigns, or localized false narratives timed to political events (elections, protests, court rulings) with tracked reach and engagement metrics. Recommended collection: cyber/forensic
• [EEI 3.1 · UNCOVERED] Unusual financial transactions: wire transfers, crypto conversions, or payments to shell companies, NGOs or individuals exceeding typical baselines that link to known proxies or front organisations. Recommended collection: financial
• [EEI 3.2 · UNCOVERED] Travel and movement indicators for suspected operatives: repeated border crossings, chartered/irregular flights, booking patterns or mobile/location data placing identified individuals in staging areas shortly before incidents. Recommended collection: border/immigration
• [EEI 3.3 · UNCOVERED] Cargo, freight or maritime movements with discrepancies (concealed/dual-use equipment, false manifests, unusual routing) detected at ports, rail hubs or via AIS that correspond to deliveries of material used in sabotage or influence operations. Recommended collection: customs/ports
• [EEI 3.4 · PARTIAL] Intercepted or otherwise-obtained communications showing tasking, coordination, or payment instructions between Russian agencies/handlers and proxy groups, including identified command-and-control servers or encrypted group identifiers. Recommended collection: signals-intel/SIGINT

Red cell review: CONCUR WITH COMMENT

TLP:CLEAR