Adversary Intelligence — 2026-08-09

GRU-Linked Networks Storm-1516 and Matryoshka Target Three French Presidential Candidates With Deepfakes and Cloned Outlets

BLUFMoscow's targeting pattern across three candidates who could consolidate anti-Le Pen coalitions points to a deliberate effort to shape the runoff field, not merely to sow generalized disorder.

French security officials told AFP that a week of false claims in July that Édouard Philippe had dementia, spread via a fake site impersonating broadcaster BFM-TV registered days before the campaign began, was France's first confirmed disinformation operation against a declared candidate, attributed to Storm-1516 12. The same network targeted Raphaël Glucksmann, who said on August 4 that France's SGDSN confirmed a fake site imitating outlet Blast and a deepfake video using a cloned voice of journalist Edwy Plenel to allege his partner Léa Salamé bribed reporters for favorable coverage 34. Separately, Viginum attributed a campaign against candidate Gabriel Attal to the Matryoshka network with a high degree of confidence, citing eight fabricated videos and X posts impersonating outlets including BFM, RFI, Le Figaro and Le Monde with false claims that his father died of a drug overdose, that he had Parkinson's disease, and fabricated remarks on migrants and Muslims; a security source said the campaign drew only a few thousand views despite detection 12. Viginum has linked Storm-1516 to 205 disinformation operations in France and Europe since August 2023 4.

Analysis
Storm-1516 and Matryoshka's targeting of Philippe, Glucksmann, and Attal is now formally attributed by French state bodies (Viginum, SGDSN), not open-source researchers alone, and the selection tracks Le Pen's strongest potential second-round rivals, consistent with an effort to clear a path toward a Le Pen-Mélenchon runoff. The 205-operation tally since August 2023 indicates standing GRU-linked infrastructure rather than episodic activity, though sourcing rests on a single AFP wire thread with other outlets citing secondhand. Targeted politicians have direct incentive to publicize the attacks, since attribution to Russian intelligence draws sympathetic coverage and bolsters support for anti-disinformation legislation that will not reach parliament until October, leaving no legal deterrent through the current phase of candidate declarations despite the campaigns' low measured reach.

4 sources