//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0327 EDT (UTC-04), Wednesday 21 October 2026

Contents

11 stories from 41 sources across 40 organizations

KEY JUDGMENTS

Foreign influence operations targeting the midterms face no federal counter. Federal attribution to a named state actor is unlikely by November 3, and platform removal of Matryoshka content is unlikely by that date, after the FBI disbanded its Foreign Influence Task Force, Office of the Director of National Intelligence (ODNI) dissolved the Foreign Malign Influence Center, and State closed its counter-disinformation office. Moderate confidence rests on consistent reporting of those closures. A platform or agency takedown before Election Day would alter this assessment.

Russian and Iranian operations against NATO targets span sabotage, espionage, and cyber intrusion. Lithuanian authorities will likely detain a Starlink arson suspect by November 21, the third such attack on Ukrainian communications infrastructure. UK prosecutors are unlikely to charge any Royal Air Force (RAF) Fairford suspect by November 21; espionage re-arrests signal prolonged evidence-building. Swallowtail's sustained access to a NATO shipbuilder, with an unrecovered loader payload, leaves the full Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU) compromise unknown.

SafePay will very likely claim a new US critical infrastructure victim within 30 days. High confidence reflects 600 documented victims since August 2024. ProPublica's account that FBI purges killed the Navatek bribery case will likely prompt a congressional inquiry or IG referral within 30 days. Beijing is unlikely to respond to the Protecting American Intellectual Property Act (PAIPA) sanctions with a specific countermeasure by November 20.

Allied Intelligence

Lithuania Thwarts Russia-Linked Arson Attack on Starlink Equipment Facility Near Vilnius Aimed at Disrupting Ukraine Operations

BLUF: Lithuanian authorities will likely detain at least one suspect in the Starlink arson attempt by November 21, given advance intelligence warnings and an active pre-trial investigation already underway.

Prime Minister Mindaugas Sinkevičius said an attempt to set fire to a Lithuanian company storing Starlink equipment failed at about 2 a.m. on October 18, after authorities had warned the firm and stepped up security 1. Satellite antennas and a control unit were targeted, and investigators found incendiary liquids and 3-to-10-liter containers 12. Reuters reported that crisis centre head Vilmantas Vitkauskas described the target as a base station on the outskirts of Vilnius, with minor property damage, no disruption to operations, and suspects still being sought 3. Sinkevičius told LRT Radio the act was Russian "hybrid war" sabotage 1, and Vitkauskas linked it to earlier arson at Starlink sites in Poland and Bulgaria 3. A pre-trial investigation is open 1, Moscow calls such accusations baseless 3, and the National Security Commission meets October 19 1.

Analyst Note: Confidence is moderate, resting on an open pre-trial investigation and an active suspect search, though no suspect is named and Poland's case took weeks to yield detentions. Lithuanian authorities will likely announce the detention or arrest of at least one suspect in the October 18 Starlink arson attempt by November 21, 2026. The failed attack follows Bulgaria's October 10 fires, including arrest warrants for two German teenagers whose whereabouts are unknown, and the September Poland fire, making Lithuania the second NATO member to report such an arson and showing a pattern of repeated attempts against infrastructure supporting Ukrainian military communications. Vilnius's advance warning to the firm suggests prior intelligence on the plot and a possible trail to perpetrators. Sourcing is consistent but draws on a narrow set of Lithuanian government voices, and attribution to Moscow rests on official statements rather than published forensic findings. A locally recruited criminal proxy or unrelated group could be responsible, and Vilnius may be attributing the attack ahead of evidence to build European support against hybrid threats. An arrest would let prosecutors link the three cases and justify wider site protection, while none would leave operators and Kyiv relying on guarded, unattributed security measures.

Sources:

1: Attempted arson at Lithuanian firm storing Starlink equipment, PM blames Russia - LRT

2: Lithuania Suspects Russia After Attack on Starlink Equipment - Newsweek

3: Lithuania says attempted Starlink arson was Russia-linked sabotage - Reuters (via Internazionale)

Lithuania foils arson attack on Starlink equipment, suspects Russian involvement - Kyiv Independent

Prior Reporting

UK Counter-Terror Police Re-Arrest Two Men for Assisting Iranian Intelligence Over RAF Fairford Incident

BLUF: Re-arrests under espionage statutes rather than terrorism charges signal a prolonged evidence-building effort, and it is unlikely that any suspect is formally charged by November 21.

Counter Terrorism Policing re-arrested two men on Tuesday under Section 3 of the National Security Act for assisting a foreign intelligence service: a 24-year-old British national and a 25-year-old British-Iranian dual national, both from Westminster 123. CBS News reported both had been bailed earlier pending further investigation 3. Assistant Commissioner Laurence Taylor said seven men have been arrested, that "highly likely" describes Iranian state involvement, and that the investigation remains live 23. The other five remain on bail, and no one has been charged 23. Police found gasoline but no explosives in three vans near RAF Fairford on September 27, according to CBS News 3. CNN reported that Prime Minister Andy Burnham called the plot "almost certainly directed" by the Islamic Revolutionary Guard Corps (IRGC), which Iran rejects, and that no US bombers have returned to Fairford 2.

Analyst Note: Confidence is high because all four outlets report consistent core facts and police statements say evidence gathering continues, though sourcing is shared and secondary with no independent primary access. The Section 3 National Security Act re-arrests reset custody clocks and suggest investigators are building a state-linkage case, which demands more evidence than a terrorism-preparation case. Gasoline without explosives weakens the original terrorism framing. It is unlikely that any of the seven men arrested in the RAF Fairford investigation is formally charged with an offence by November 21, 2026. Prosecutors may instead be close to a charging decision on the National Security Act offence and using the bail period to assemble evidence for charges within weeks. If a charge does come, London can expose Iranian state involvement in court and Washington can weigh returning bombers to Fairford. If none comes, the bombers stay in the US and Britain absorbs continued Iran-linked basing risk without legal confirmation.

Sources:

1: Two men re-arrested on suspicion of aiding Iran over RAF Fairford incident - The Guardian

2: Two men rearrested on suspicion of assisting Iran's intelligence service in RAF Fairford incident - CNN

3: 2 men rearrested on suspicion of spying for Iran over suspected plot at U.S.-run air base in England - CBS News

RAF Fairford suspects face new charges of working for Iranian intelligence - The National

Shin Bet Internal Report Reveals Agency Chief Had No Understanding of Hamas Intentions Days Before October 7 Attack

BLUF: Leaked at the height of Netanyahu's legal clash with the former Shin Bet chief, this unverified document serves more as political ammunition than as an independent accounting of intelligence failures before October 7.

Israel's Channel 11 reported on October 15 that an internal Shin Bet report dated two days before the October 7, 2023 attack shows then-chief Ronen Bar focused on a long-term ceasefire with Hamas, according to JNS 12. The document is titled "Consultation regarding the management of negotiations for a long-term ceasefire with Hamas" 12. Host Ayala Hasson said it records Bar and his deputy discussing Yahya Sinwar's "interests, benefits and concessions," and called it a "shocking lack of understanding" 12. Bar had sued Prime Minister Benjamin Netanyahu for defamation a day earlier over a September 28 X post alleging "failures and crimes"; Netanyahu posted a link to Hasson's report on October 15 12.

Analyst Note: If authentic, the Channel 11 account gives Netanyahu new material in his dispute with Ronen Bar and bears on the debate over Shin Bet accountability for October 7. It places Bar's attention on ceasefire terms with Sinwar rather than warning indicators two days before the attack. Netanyahu amplified it one day after Bar's defamation suit, so the release appears tied to that litigation and may shape how any inquiry frames Shin Bet failures. The leak may instead be politically timed, and a ceasefire consultation may be routine contingency planning that does not show Bar misread Hamas. Confidence is low: the record rests on one secondary stream (JNS, with a syndicated copy), the document is unpublished and unverified, and a presenter's characterization stands in for its content.

Sources:

1: Shocking lack of understanding: Shin Bet chief unaware of Hamas intentions internal report reveals - JNS

2: 'Shocking lack of understanding': Shin Bet chief unaware of Hamas's intentions, internal report reveals - Cleveland Jewish News (JNS syndication)

Seven with Ayala Hasson: Shin Bet internal report reveals agency chief had no understanding of Hamas intentions - Kan 11 (Channel 11)

IC Oversight & Policy

ProPublica: Trump FBI Purge Killed Active Bribery Investigation Into Graham and Clyburn

BLUF: ProPublica's account that Trump-era FBI purges killed an active congressional bribery case will likely prompt a formal congressional inquiry or IG referral within 30 days.

ProPublica reported Tuesday that the FBI opened a bribery investigation in early 2025 centered on a March 2020 dinner at which Sen. Lindsey Graham allegedly agreed to steer a $10 million contract to Navatek in exchange for a $100,000 campaign pledge, according to former Navatek CEO Martin Kao's account to agents 12. Kao also told agents the company struck similar deals with Rep. James Clyburn and Rep. Joe Wilson 13. The FBI named two former Navatek executives as subjects but did not designate the lawmakers. ProPublica said the two lead agents were removed and the supporting prosecutor quit after the Trump administration dismantled public-corruption units, leaving the case dead 14. Graham's office and Clyburn's office denied wrongdoing and called Kao a convicted felon or fraudster, Wilson's office cited compliance with campaign finance rules, and Kao is serving an 87-month sentence 13.

Analyst Note: Confidence is moderate, resting on a single ProPublica document review of the agent removals, with The Hill, ABC News 4 and Bangor Daily News adding nothing independent, against strong Democratic oversight incentives ahead of November. The second installment extends the Navatek series beyond Susan Collins and ties the case's end to dismantled public-corruption units. Members of Congress or Judiciary committee leadership will likely announce a formal inquiry, letter demand, or inspector general referral on the FBI's handling of the Navatek investigation by November 20, 2026. Pressure would come mainly from House Democrats and outside watchdogs, since Graham's death and his staff's retention under his sister weaken Senate incentives, and Clyburn's inclusion may blunt partisan framing. The case may instead have stalled on evidentiary weakness, given a convicted felon seeking leniency and Supreme Court rulings narrowing bribery law. If an inquiry emerges, the FBI, Department of Justice (DOJ) and contractors like Integer Technologies should preserve records; if not, oversight staff can defer resources.

Sources:

1: How Trumps FBI Purge Saved Lindsey Graham and James Clyburn From a Bribery Investigation - ProPublica

2: How Trump's FBI purge saved Lindsey Graham and James Clyburn from a bribery investigation - Bangor Daily News

3: FBI probed whether Graham, Clyburn and Wilson were tied to bribery scheme: ProPublica - ABC News 4

4: FBI investigated whether Lindsey Graham, James Clyburn were involved in bribery scheme - The Hill

Foreign Threats to US Elections Maturing Faster Than Defenses as Post-2016 IC Election Security Architecture Dismantled

BLUF: Dismantlement of the FBI Foreign Influence Task Force, ODNI's Foreign Malign Influence Center, and the State Department's counter-disinformation office makes it unlikely that any federal agency publicly attributes a foreign influence operation targeting the 2026 midterms by November 3.

Just Security reports that U.S. officials told the New York Times in September the intelligence community has found no attempts to compromise voting machinery, and that reported foreign activity consists of online influence operations, primarily Russian, including AI-generated fake videos tied to a Kremlin-linked network 12. Just Security also reports that X removed 13,000 accounts linked to Russian, Chinese, and Iranian influence operations 1. The same article states that the FBI disbanded its Foreign Influence Task Force in February 2025, the State Department closed its counter-disinformation office in April 2025, and ODNI cut its workforce by more than 40 percent and dismantled the Foreign Malign Influence Center as a stand-alone organization 12. It adds that the Election Assistance Commission has had no commissioners since July, Cybersecurity and Infrastructure Security Agency (CISA)'s 2026 election security plan arrived 40 days before the midterms, and federal state election-security funding fell from $55 million in 2024 to $45 million for 2026 1.

Analyst Note: The federal bodies that once produced election-influence attributions are gone or hollowed out: the FBI task force, the State Department office, ODNI's Foreign Malign Influence Center, and the Election Assistance Commission, which lacks a quorum. ODNI has yet to release its 2024 election assessment, and Warner and Himes noted on October 2 that required products remain outstanding. It is unlikely that ODNI, the FBI, or CISA publicly attributes a specific foreign influence operation targeting the 2026 midterms to a named state actor by November 3. Confidence is moderate, because the evidence is one original Nextgov/FCW report amplified by secondary outlets, with no agency officials describing planned releases. Silence may instead mean attributions are being held for the mid-December post-election assessment, or that adversaries stuck to low-level online work officials judge too minor to name. Attribution will come from X, Alethea, and other private researchers, so states, platforms, and campaigns should plan for federal response gaps before Election Day.

Sources:

1: Foreign Threats to U.S. Elections Are Maturing Faster Than the Defenses to Counter Them - Just Security

2: Foreign Threats to U.S. Elections Are Maturing Faster Than the Defenses to Counter Them - Safehouse Briefing (Substack)

Officials see gaps in election communications as AI makes foreign influence easier - Nextgov/FCW

Counterintelligence & Espionage

Poland Detains Dual-Citizen Military Reservist on Espionage Charges for Conducting Reconnaissance of Military Installations

BLUF: Poland's arrest of a recently naturalized dual citizen inside a military training pipeline points to a foreign service attempting to embed access agents within NATO reserve structures.

Polish military police detained a 31-year-old Polish-Ukrainian dual citizen holding the rank of senior private reserve on October 16 at the Military Medical Academy in Łódź, where he was taking a reservist officer training course, on orders from the Łódź-Polesie District Prosecutor's Office 12. The suspect faces charges of declaring readiness to act for the benefit of a foreign intelligence service against Poland, punishable by up to eight years, and a court ordered three months of pretrial detention 12. Deputy Defence Minister Cezary Tomczyk told reporters the man had "clearly revealed himself" as someone conducting reconnaissance of Polish Armed Forces military installations and had recently obtained Polish citizenship 12. Rzeczpospolita reported that officers found several phones, documents, official stamps, foreign currency and gold, though authorities have not confirmed those details or identified the foreign intelligence service involved 12.

Analyst Note: The case fits a pattern: Poland opened more espionage investigations in 2025 and 2026 combined than in the previous three decades, and most convicted agents have been Ukrainian or Belarusian nationals recruited by Russian services. A recently naturalized dual citizen entering a Military Medical Academy training course raises the question of whether a foreign service directed him to seek access through the reserve force. Authorities have not named that service. Deputy Minister Tomczyk's public attribution of reconnaissance is unusually forward-leaning for an open investigation, and the seized phones, stamps, currency and gold, if confirmed, point to operational tradecraft. He may instead have been an untrained opportunist who drew attention through clumsy behavior, with an innocent explanation for the items not yet ruled out. Confidence is high because Notes From Poland and Anadolu each reported the detention, charges and statement independently, and Liga.net relayed the same account with no conflicting facts. Independence is limited, though, since all rest on one military police announcement and one ministry statement.

Sources:

1: Poland detains Polish-Ukrainian military reservist on suspicion of espionage - Notes From Poland

2: Poland detains reservist suspected of spying on military sites - Anadolu Agency

A man with Ukrainian and Polish citizenship is suspected of espionage - Liga.net

State Department Sanctions Five Chinese Entities Over Google AI Trade Secret Theft Under PAIPA

BLUF: It is unlikely that Beijing responds to the PAIPA designations with a specific countermeasure by November 20, as China's pattern is to absorb narrow, individual-linked sanctions with rhetoric rather than escalatory retaliation.

The State Department announced on October 19 that it sanctioned five Chinese entities under the Protecting American Intellectual Property Act: Shanghai Zhisuan Technology, which former Google engineer Linwei Ding founded in 2023, incubator MiraclePlus, and three MiraclePlus-linked partnerships 12. Office of Foreign Assets Control (OFAC) added them to its Non-SDN Menu-Based Sanctions List, imposing property blocking, foreign-exchange and banking limits, a loan cap above $10 million per year, and an investment ban, and issued a general license allowing MiraclePlus wind-down transactions through January 19 1. Ding was convicted in January of seven trade secret theft counts. A judge acquitted him of economic espionage on August 20 and sentenced him in September to 12 months minus a day; the Justice Department is appealing the dismissal 23. China's commerce ministry on Tuesday voiced "firm opposition," rejected the theft allegation, and said Beijing would take unspecified "necessary measures" 3.

Analyst Note: We assess with high confidence, given four consistent outlets that draw on the same State Department announcement and ministry statement and so are only partly independent, that the designations hit MiraclePlus hardest. Its investors, co-investors and banks must cut US-linked dealings before the wind-down license lapses on January 19. Beijing's response so far is rhetoric, and the ministry's promise of unspecified "necessary measures" commits it to nothing. It is unlikely that China announces a specific countermeasure, such as sanctions, an unreliable entity list addition, or export restrictions, explicitly in response to the PAIPA designations by November 20, 2026. A calibrated reply may instead be held in reserve for a broader trade negotiation, framed as unrelated to this action. The Justice Department's appeal of the espionage acquittal could draw further Chinese comment, and more PAIPA designations could prompt a targeted reply. If China names a countermeasure, US firms with Chinese partners must reassess retaliation exposure. If not, compliance teams can plan around the January 19 deadline alone.

Sources:

1: US Sanctions Five Chinese Entities Over Google Trade-Secret Theft - Export Compliance Daily

2: U.S. sanctions 5 Chinese firms linked to convicted ex-Google engineer - UPI

3: Beijing blasts US sanctions on 5 Chinese firms tied to ex-Google engineer - Associated Press

US sanctions 5 Chinese entities over ex-Google engineer's AI trade secrets theft - South China Morning Post

IC Technology & Cyber

CISA and FBI Issue Joint Advisory on SafePay Ransomware Targeting Critical Infrastructure

BLUF: SafePay will very likely claim a new US critical infrastructure victim within the next 30 days, as the advisory's publication will not materially reduce the group's access to unpatched edge devices faster than it can exploit them.

CISA and the FBI, with the US Secret Service and German and UK law enforcement partners, published a joint advisory on October 20 stating that SafePay has affected at least 600 victims across multiple critical infrastructure sectors since August 2024 12. The advisory lists initial access through stolen or guessed credentials, phishing, and exploitation of five named CVEs, including CVE-2024-40766, in edge and internet-exposed systems 1. It also describes data exfiltration before encryption, a ransom demand set as a subset of company revenue in cryptocurrency, and phone calls to victims on the group's behalf 13. The Record reported that SafePay has claimed attacks on Microlise and Conduent, and that Conduent announced an $80 million class action settlement last Friday 3.

Analyst Note: High confidence rests on a primary government advisory documenting at least 600 victims since August 2024, an operating leak site, and activity continuing through August. The Record and other outlets reproduce its figures without contradiction, though they add little independent collection. Naming CVE-2024-40766 and four other edge-device flaws indicates unpatched firewalls and VPN appliances remain the main entry point, and publication will not close that exposure quickly. SafePay will very likely claim or be reported to have claimed a new US critical infrastructure victim between October 21 and November 20, 2026. Defenders face extortion pressure beyond encryption, since SafePay exfiltrates first, sets demands against revenue, and phones victims. Conduent's $80 million settlement shows the liability that follows a contractor breach. The advisory may instead reflect an agency push to publicize a group whose pace is already declining, and law enforcement attention could disrupt or rebrand it. Operators and contractors should prioritize patching the five CVEs and rehearse extortion response now.

Sources:

1: #StopRansomware: SafePay Ransomware - CISA

2: SafePay ransomware group has targeted hundreds this year, US agencies say - WKZO (Reuters)

3: FBI says SafePay ransomware gang 'among most active' with more than 600 victims since 2024 - The Record (Recorded Future News)

SafePay Ransomware Group Warning from Feds - ISSSource

DHS Bans DeepSeek Products Across Federal Civilian Agencies Using Supply Chain Authorities

BLUF: Converting a chatbot ban into a full supply chain audit will force federal integrators to map underlying AI models across their product lines, creating procurement friction that extends well beyond DeepSeek itself.

Department of Homeland Security (DHS), citing the Federal Acquisition Supply Chain Security Act and a Federal Acquisition Security Council review, barred civilian federal agencies from procuring products and services from Hangzhou DeepSeek Artificial Intelligence, its affiliates, and third-party tools built on its models, per a Federal Register notice 123. The notice reproduces Secretary Markwayne Mullin's June 26 exclusion letter, though TechSpot, citing AP, dates the order to late July 13. Mullin cited China-based servers, PII collection, possible transfer of sensitive prompt data to Beijing, and potential malware 12. Agencies have 60 days to remove DeepSeek and may request exceptions from CISA with "compelling justification"; DoD national security systems are excluded 2. China's Foreign Ministry spokesperson Mao Ning on Tuesday accused Washington of politicizing technology and trade 3.

Analyst Note: Civilian agencies must purge DeepSeek and any vendor software built on its models within 60 days, turning a chatbot ban into a software supply chain audit. Integrators selling AI-enabled products to federal buyers now must trace which model underlies each product, which many cannot do today. The order has been in force since at least late July, so agencies and contractors have already operated under it while the public notice lagged. CISA waivers require compelling mission justification and will be narrow, and DoD national security systems fall outside the order. The order may instead mostly formalize restrictions agencies already imposed, with limited operational effect beyond signaling to Beijing and to Chinese open-weight developers such as Moonshot and Alibaba. Confidence is high: four outlets agree on scope, deadlines and exemptions, though all draw on the same Federal Register notice (one also on AP), so independence is limited and the order's date is the only discrepancy.

Sources:

1: DHS to ban DeepSeek from federal civilian agencies - CyberScoop

2: US bans DeepSeek across federal agencies, putting AI supply chains under scrutiny - CIO

3: US bans DeepSeek and AI tools built on its models from federal agencies, prompting angry response from China - TechSpot

Homeland Security bans DeepSeek use in federal civilian agencies - Engadget

Adversary Intelligence

Russian GRU Hackers Compromise NATO Shipbuilder and Military Aircraft Engine Maker in Espionage Campaign Using Novel Backdoor

BLUF: Swallowtail's sustained hands-on access to a NATO shipbuilder signals GRU prioritization of naval industrial targets, and the unrecovered loader payload leaves the full scope of compromise unknown.

Symantec's Threat Hunter Team reported on October 20 that Swallowtail (Advanced Persistent Threat 28 (Fancy Bear / Swallowtail; APT28), Fancy Bear, Forest Blizzard) targeted a law enforcement agency, a naval shipbuilder and a military aircraft engine maker in two NATO member states 1. At the shipbuilder, Symantec observed hands-on-keyboard activity over a week and an intrusion lasting at least two months, starting with a macro-enabled Word document opened on July 24 that installed the Hookedge backdoor 12. Operators stole credentials, including an NT LAN Manager (NTLM) capture via PowerShell, and opened a persistent Secure Shell (SSH) tunnel to their own server 1. Symantec also found a previously undocumented loader, ld.exe, but did not recover its encrypted payload, so its function is unknown 12. CyberScoop quoted Symantec's Dick O'Brien saying the motive is uncertain 2.

Analyst Note: Swallowtail's dedicated server and persistent SSH tunnel at a NATO naval shipbuilder mark a shift from disposable cloud staging to operator-controlled infrastructure. A week of hands-on-keyboard activity and an NTLM credential capture show the shipbuilder was a chosen target, not collateral. Defenders at other naval and aerospace suppliers should hunt for off-screen Edge launches, webhook.site traffic and unexpected ssh.exe sessions. The undocumented ld.exe loader remains unexplained because its encrypted payload and key were never recovered, so data theft is unconfirmed. The campaign may instead be opportunistic collection against any reachable defense supplier, not a focused effort tied to Ukraine support. Confidence is high, resting on Symantec's primary host-level reporting. CyberScoop and The Hacker News repeat it and add little independent corroboration, and the loader's function is the only gap.

Sources:

1: Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries - Symantec (Broadcom) Threat Hunter Team

2: Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign - CyberScoop

Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader - The Hacker News

Russian Matryoshka Bot Farm Targets US Midterms With AI-Generated Synthetic Videos

BLUF: Russia's Matryoshka network will keep flooding social media with fabricated broadcasts through Election Day, but bot-inflated metrics mask limited real audience reach and erode trust more than they shift votes.

Bloomberg News reviewed 130 videos and doctored newspaper fronts targeting the midterms, published September 10 to October 9 by the Russian state-backed Matryoshka (Operation Overload) network, most flagged by Antibot4Navalny, with Graphika and dTeam corroborating 12. AI-fabricated clips of Robert De Niro, Julia Roberts and Cher attacking Democrats appeared on X from early September, some promoting #AllDemocratsAreCriminals 12. Breitbart reported fake ABC and CBS broadcasts alleging misconduct by Democrats James Talarico and Jon Ossoff, with no evidence for either claim 3. Bots inflated views, and Kyiv Post cited Antibot4Navalny data showing views spiking to 200,000 within an hour before flatlining 4. The New York Times cited US intelligence officials saying Russia's goal is to deepen distrust rather than favor one party, and the FBI and CISA urged vigilance on Friday 2. Graphika's Jean le Roux told Bloomberg few of the fake stories gain traction 3.

Analyst Note: It is unlikely that Meta, X, or YouTube publicly announces removal of accounts or content tied to the Matryoshka network targeting the US midterms by November 3, 2026. Moderate confidence rests on the network's consistent pattern across reporting, but no platform statement or enforcement signal addresses this campaign specifically. The evidence base is thinner than the coverage suggests, since Bloomberg is the sole primary report and the Japan Times, Yahoo News and Breitbart rework it. Kyiv Post adds only forensic view-count detail from Bloomberg's source group. Because the operation aims to erode trust in the process, election officials and campaigns should expect more fabricated ABC and CBS broadcasts through Election Day, especially against Democrats in competitive Senate races. Bot-inflated views overstate reach, and independent researchers have found limited traction. Platforms may instead be removing accounts through routine enforcement that researchers, not the companies, report. Without an official takedown record, officials must rely on Graphika and Antibot4Navalny to flag content before November 3.

Sources:

1: Russia is using an army of bots to push fake U.S. election videos - The Japan Times

2: Russia Steps Up Online Campaign to Sow Midterm Election Chaos - Yahoo News

3: Midterms: 'Russian Bots' Launch Army of Fake Videos of Celebrities, Like Taylor Swift, Attacking Democrats - Breitbart

4: Russian Matryoshka Bot Farm Targets US Midterms With AI - Kyiv Post

Russia Is Using an Army of Bots to Push Fake US Election Videos - Bloomberg News

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE