Loading threat actor…
Operation Overload is a Russia-aligned malign influence operation also tracked as Matryoshka and Storm-1679. It is focused on information manipulation rather than traditional network intrusion and is designed to launder pro-Kremlin narratives into mainstream discourse, undermine trust in democratic institutions, and exacerbate political and social divisions in countries viewed as strategically important to Russia. The operation is known for impersonating legitimate media organizations, journalists, and fact-checking entities to give fabricated content the appearance of credibility. Its tradecraft includes fake news articles, counterfeit fact-checking resources, manipulated imagery, coordinated inauthentic behavior on social platforms, and AI-enabled synthetic media. Reported techniques include cloning journalists’ voices, splicing fabricated voiceovers into authentic video footage, and producing deepfake-style content to support false narratives. The campaign also floods journalists, researchers, and fact-checkers with deceptive verification requests and fabricated leads, apparently to overwhelm investigative capacity and induce inadvertent amplification of false claims. Operation Overload has targeted elections, public trust, and geopolitical alignment issues across multiple countries. Reported target sets include the United States, France, Germany, Moldova, Armenia, and Ukraine-related audiences and narratives. In the United States, the operation has been linked to efforts to undermine confidence in the presidential election, spread fabricated scandal narratives about political figures, inflame fears of political violence, and exploit divisive social issues. In France and Germany, it has sought to pollute the information environment around major political events and elections. In Moldova, it has conducted anti-government and anti-EU messaging, including vilification of President Maia Sandu and narratives portraying Moldova as incompatible with Europe. In Armenia, it has been associated with disinformation targeting Prime Minister Nikol Pashinyan and broader attempts to shape debate over the country’s geopolitical orientation. The operation’s recurring objectives are consistent with Russian strategic influence goals: weakening support for Ukraine, undermining European unity and NATO cohesion, discrediting pro-Western leaders and institutions, and promoting narratives favorable to Kremlin interests. Its use of AI-enabled voice cloning and other synthetic-media techniques marks it as an adaptive and technically sophisticated influence actor within the broader Russian information operations ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Russian-aligned information operation targeting Armenia as part of broader influence activity, including election-related disinformation.
Pro-Russia influence operation using AI voice cloning and manipulated media to impersonate journalists and spread fabricated content.
A pro-Russia influence operation using AI voice cloning and fabricated voiceovers inserted into legitimate footage to impersonate journalists and spread disinformation.
Russia-linked influence operation targeting European audiences; described as part of a set of campaigns impersonating media outlets to spread Kremlin-aligned narratives.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.