SecAlliance's Disinformation Monitoring and Managed Cyber Threat Intelligence services provide continuous visibility into narrative-based threats, including the detection of coordinated campaigns, early identification of emerging content targeting clients, and structured intelligence to support communications and crisis response teams. Learn how we can support your organisation.
Contact usArmenia’s June 2026 parliamentary election was never just a domestic contest. It became the latest test of how Russia tries to shape political outcomes in countries slipping from its orbit.
After the loss of Nagorno-Karabakh in 2023 shattered faith in Moscow as Armenia’s main security guarantor, Yerevan began looking westward for new partners. The Kremlin answered with pressure on multiple fronts. In the months before the vote, Armenia was hit by a coordinated campaign of disinformation, cyber activity, economic threats and political signalling designed to raise the cost of that pivot. Fake stories painted Prime Minister Nikol Pashinyan as corrupt, reckless and controlled by the West. Other narratives warned that Europe meant war, social breakdown and economic ruin.
By examining both covert and overt operations, this blog tracks how those messages shifted as election day neared, how they overlapped with other forms of coercion, and what Armenia’s experience reveals about the way Russian influence operations are adapting.
1. Covert
The online disinformation campaign targeting Armenia’s June 2026 election was one of the most extensive Russia has mounted against any single country. This began at least eight months before polling day, ultimately generating over 400 fabricated news reports.
Most notably during this period, the Kremlin-affiliated Matryoshka network (also tracked as Storm-1679 by Microsoft and known as Operation Overload) posted fake videos and publication covers purportedly from legitimate international news outlets across X and other platforms. These included AI-generated deepfake videos cloning the voices and likenesses of real journalists from outlets including Euronews, and various celebrities, and spoofed front pages of French publications such as Libération and Ouest France.
Matryoshka examples: a fabricated Vogue cover falsely claiming Pashinyan's wife's outfit was the most expensive, and a fake Netflix statement falsely alleging the Armenian government threatened the platform's staff after it declined to acquire a propaganda film [source][source]
Running alongside Matryoshka was Storm-1516, which created websites impersonating international and local news outlets, distributing links and videos to that content across X and Facebook – including via paid advertising – to maximise reach.
Storm-1516 examples, showing a fabricated story about a new bill forcing Armenian children to learn Islam and another on Pashinyan selling Armenian land to Turkey [source][source]
In Armenia, researchers identified an evolution in Storm-1516 methods. Rather than relying solely on fabricated outlets, nearly 40% of Storm-1516's false claims against Pashinyan originated with Okay Deprem, a self-described Turkish journalist openly aligned with the Kremlin. Deprem’s content ran on real Turkish nationalist and pro-Russian outlets. This gave the disinformation a veneer of legitimacy that fake websites cannot provide. The use of Deprem's content alongside the Turkish nationalist website suggests a structured relationship between pro-Kremlin Turkish media figures and Russian influence infrastructure targeting Armenia.
Our analysis shows that the false claims being circulated fell into six core themes:
These narratives were not developed for Armenia in isolation. Russia has deployed the same core narratives – migrant panic, LGBT agenda, Western puppet, corrupt leader – across multiple target countries in recent years, from Moldova's 2025 election to attempts to destabilise the 2024 Paris Olympics, reflecting an industrialised approach to influence operations in which themes are stress-tested in one environment and redeployed in the next.
According to The Insider, the Armenia campaign had a clear command structure. Overall coordination reportedly sat with Russia's newly created Presidential Directorate for Strategic Partnership and Cooperation, with FSB, GRU, and SVR officers embedded across the Russian Embassy in Yerevan. Alongside this, Russia operated a cultural centre in Yerevan, part of the Kremlin's Rossotrudnichestvo soft power network, running youth programmes built around the message that Armenia's future lay with Russia, headed by a sanctioned figure who had previously channelled Kremlin funding to pro-Russian opposition forces during Moldova's elections.
The Kremlin also enlisted Russian political consultancies and think-tanks, including the SocialDesign Agency (SDA), sanctioned in the European Union and the United Kingdom for spreading disinformation to undermine support for Ukraine.
2. Overt
Across May 2026, Russia’s overt influence messaging Armenia’s elections was less about the mechanics of the vote itself than about framing the choice facing voters. The central line from Moscow was that Armenia could not simultaneously pursue European integration while retaining the benefits of Russian-led regional structures. This allowed Russian officials to present the election not as a domestic political contest, but as a civilisational and economic decision: Armenia could remain within the Eurasian space, or it could follow a Western path carrying punitive consequences.
President Vladimir Putin’s messaging was clearest around the Eurasian Economic Union (EAEU) summit in Astana at the end of May. He warned that Armenia’s EU ambitions created material risks for its position in the EAEU, arguing that Yerevan could not belong to both frameworks at once. The economic warning was explicit: Armenia, he suggested, could lose a substantial share of GDP if it moved away from the Russian-led bloc. This was not simply policy commentary. It functioned as strategic signalling to Armenian voters that Pashinyan’s pro-European course would carry immediate economic costs, including potential disruption to trade, investment, and energy advantages.
Sergey Lavrov, Russia’s Minister of Foreign Affairs, followed the same logic with his intervention, but with a more diplomatic register. In mid-May, he described Pashinyan’s decision not to attend the EAEU leaders’ meeting because of the election campaign as “sad”, presenting the summit as a missed opportunity to resolve tensions. He reiterated that EU accession and EAEU obligations were incompatible and accused the West of attempting to sever Armenia from its CIS partners through “aggressive Russophobia”.
Maria Zakharova, spokeswoman for the Russian Ministry of Foreign Affairs, sharpened the accusatory element. On 28 May 2026, she argued that Armenian assurances about maintaining friendly relations with Russia contradicted Yerevan’s actual conduct. While insisting that Moscow did not oppose Armenia diversifying its foreign ties, she claimed the current course was not balanced and suggested Armenia was entering strategic arrangements with Western capitals that had declared a hybrid war against Russia. Her framing recast Armenian sovereignty as vulnerability to Western exploitation, and cooperation with Europe as participation in an anti-Russian project.
The May messaging shows a coordinated overt influence line: Russia avoided directly instructing Armenians how to vote but repeatedly defined the stakes of the election in coercive geopolitical terms. The narrative was that Pashinyan’s Western-facing policy would isolate Armenia from its natural partners, expose it to economic harm, and make it an instrument of hostile Western strategy.
1. Covert
In the weeks leading up to the election, analysis by Bot Block shows that Russia’s Matryoshka network dedicated over 90% of its content to the Armenian vote.
Graph from analysts at Bot Blocker showing the late-stage escalation of Matryoshka network campaign on Armenian [source].
The same narrative themes continued, including a fabricated video of Pashinyan hitting a child, deepfake videos of celebrities criticising him and false claims that ballots were being destroyed at polling stations in Yerevan.
Storm-1516 examples, showing a fabricated video of ballots being destroyed and a deepfake video of Pashinyan striking a child [source][source]
Armenia was also targeted with cyber operations throughout this period, characterised by election-related data breaches, DDoS activity and political messaging from hacktivist groups.
Hacktivist entity 'Wolves of Turan’ claims Turkish-nationalist alignment and first appeared in January 2026. Since then, the group has used ideological messaging as mobilising calls for DDoS activity and has claimed collaboration with other hacktivist entities. Armenian entities are frequent targets of these activities, including recent use of inflammatory anti-Armenian rhetoric threatening the destruction of the Armenian state and people.
Wolves of Turan Telegram posts listing Armenian government entities as ideological targets, June 2026 [source][source][source]
Throughout May, the group listed numerous Armenian government ministries, critical infrastructure, and civil society domains as DDoS targets on their Telegram channel. This included election-related entities such as the election website, the President’s website and numerous other government ministries.
In the week of the election, Wolves of Turan also claimed to compromise an election subdomain belonging to Armenia’s Ministry of Internal Affairs. In a possible indication of collaboration, this breach appeared on a darkweb leak site Bashe/APT73 ransomware group [source], possibly to amplify the post’s visibility. The breach, containing 30,074 rows of citizens’ personal and voting data, was released one day before election day.
Wolves of Turan Telegram post claiming the elections.mia[.]gov data breach, 02 June 2026 [source] [source]
Despite the breach containing potentially sensitive information, it is unlikely this activity had any significant impact on the election in terms of voter preference, turnout or organisational reputation. The activity mostly holds propaganda value for Wolves of Turan, as the group tries to establish itself as a credible threat through conducting activities that undermine Armenian government organisations and throws doubt on the election’s integrity.
It is not known if this data was accessed and exploited by other actors. However, amid concerns around wide-ranging possible interference activities in this election, sensitive breaches can pose credible risks to impacted voters in terms personal safety. In addition, it risks violating voter privacy and, if amplified, undermining the integrity of institutions administering elections both in the eyes of the public, and amongst institutions themselves.
Separately, hacktivist group Armenian Code was also active in the election period. The group first appeared in January 2026 and claims to represent the ‘Real Armenia’ through ideological, anti-government messaging and DDoS activities. Since April 2026, the group has posted inflammatory political messaging on topics including Pashinyan’s policies towards Turkish normalisation, the peace agreement with Azerbaijan and alignment with the EU. These critiques embody a broadly ‘pro-Russia’ stance.
Political messaging from Armenian Code and AI-generated disinformation posts against the Pashinyan government calling on Armenian citizens to vote against ‘the traitor’ Pashinyan [source][source][source]
In addition, the group listed numerous Armenian government domains as DDoS targets throughout May – June 2026. This includes the Prime Minister’s and president website, as well as the Ministry of Defence.
Armenian Code DDoS target list, posted on their Telegram channel in the week before election day [source][source]
Interestingly, on 04 June 2026, Armenian Code published a QR code on their channel, alongside calls for Armenians to “act” against the ‘betrayal of the homeland and...its destruction”. The graphic indicates these QR codes were also hung up as physical posters in Armenian locations, though this could not be verified.
The QR code linked to the domain armeniancode[.]com, which was registered 19 May 2026. The associated X account claims French registration, though this is unconfirmed. France hosts a significant Armenian diaspora, and it is possible the location choice reflects an attempt to add authenticity to the account. The X account provides a mail address, mail.armeniancode24[.]com; however, this has no associated MX record and therefore cannot receive mail.
armeniancode[.]com (top left) was taken offline shortly after the QR codes were published on Armenian Code’s Telegram channel (bottom) [source]. This prompted retaliation by Armenian Code, with further Armenian entities to be listed as DDoS targets [source]. The associated ‘@armeniancode24’ X account is shown top right [source]
Open sources have questioned the authenticity of both Wolves of Turan and Armenian Code, citing probable links to Russia [source]. This assessment is based on behavioural trends, including both channels’ registration and posting patterns. Both groups have not posted since 06 June 2026, the day before voting.
With much of this activity focused on noise and generating visibility rather than achieving operational disruption, the compounded impact on the election was likely low. However, the outlined activity almost certainly reflects only a small subset of cyber operations targeting Armenia, with higher impact operations possibly being observed elsewhere.
2. Overt
Between 01 and 07 June 2026, Russian overt influence messaging moved from strategic warning into direct contestation of the electoral environment itself. This was overt influence by delegitimisation: casting the incumbent as authoritarian, the opposition as suppressed, and the geopolitical stakes as nothing less than Armenia’s future survival.
The emphasis was no longer only that Armenia’s Western trajectory would be economically and geopolitically dangerous; it was that the Armenian authorities were allegedly undermining the democratic legitimacy of the vote before polling day had even arrived. Messaging treated the election as a referendum on Armenia’s geopolitical loyalty: Europe was presented as incompatible, destabilising and ideologically anti-Russian, while Russia was positioned as the anchor of economic realism and regional continuity.
Putin’s most relevant line during the election week was the continued amplification of his warning that Armenia’s EU-facing policy risked creating a “Ukraine scenario”. Although this framing had been introduced before the final week of the campaign, it remained central to Russian messaging as Armenians went to the polls. Lavrov did not appear to issue a major new Armenia-election-specific intervention between 01 and 07 June 2026, but his earlier framing continued to sit beneath the Russian line.
One day before the vote, Zakharova responded to reports that opposition parties could be barred from participating by accusing the Armenian authorities of waging a struggle against democratic procedures. She claimed that efforts to remove Strong Armenia and potentially Prosperous Armenia — the latter being the main pro-Russian opposition challenger and the latter an old oligarch-linked opposition party — from the contest would amount to a “crime against democracy”.
Zakharova linked this alleged exclusion to pressure on the opposition, arrests, harassment, property seizures and the persecution of the Armenian Apostolic Church. Her statement was significant because it pre-emptively challenged the legitimacy of the electoral process. If opposition forces were excluded, she argued, Armenian citizens would be deprived of the right to choose their country’s future[SC2] [SC3] .
1. Overt
The day after the election, Russian messaging shifted from pre-emptive warning to post-result interpretation. The immediate challenge for Moscow was that Nikol Pashinyan’s Civil Contract party had won the vote and appeared able to govern independently, despite months of Russian pressure, warnings and amplification of opposition claims. Moscow’s response therefore did not present the result as a clean democratic mandate. Instead, it sought to keep the election politically contested by emphasising alleged irregularities, opposition suppression, Western interference and the continued strength of pro-Russian forces.
Zakharova argued that Civil Contract had not received a “monopoly on power” and claimed that its support had fallen compared with the previous electoral cycle. This line allowed Moscow to acknowledge the result without accepting its political meaning. Rather than treating Pashinyan’s victory as a mandate for Armenia’s Western-facing trajectory, Zakharova reframed the outcome as evidence of division, polarisation and unresolved public support for Russia.
Zakharova also extended the pre-election delegitimisation frame. She said the campaign and voting process had taken place amid severe repression of opposition parties, movements, activists and supporters. This was significant because it converted the pre-election warning about possible exclusion of opposition forces into a post-election claim that the process itself had been distorted. In this framing, Pashinyan’s victory was not the expression of a settled democratic choice, but the product of a hostile political environment shaped by repression and Western interference, particularly from the EU.
The opposition results were central to this argument. Strong Armenia emerged as the main opposition force, while Robert Kocharyan’s Armenia Alliance also entered parliament. For Russian messaging, this provided a useful dual claim: Pashinyan had won, but a substantial part of the electorate had backed forces opposed to his Western-facing trajectory.
The post-election response was not a concession but a holding operation. Moscow did not need to prove that the election had been stolen; it only needed to deny Pashinyan a clean mandate. The overt influence objective was to preserve the opposition as a vehicle for future pressure, sustain the argument that Armenia remained divided, and frame the westward pivot as contested, illegitimate and dangerous.
2. Covert
While the result was a clear victory, the relatively narrow majority provides fertile ground for the next phase of Russian information operations.
Within days of the result, pro-Kremlin networks have already shifted focus toward attacking Volodymyr Zelenskyy. However, Armenia is unlikely to drop off Russia's target list. The established narratives, election fraud, Western interference, economic ruin, war risk, is readily adaptable to delegitimising Pashinyan's mandate. We can expect existing narratives to be repurposed around the claim that Pashinyan governs without genuine popular support, that the result was manipulated, and that Armenians who voted against him represent a silent majority being ignored.
Russia's longer-term objective is unlikely to have changed. Having failed to prevent Pashinyan's re-election, the probable aim shifts to destabilising his government sufficiently to force early elections, elections Russia will seek to ensure are won by a pro-Russian successor.
Armenia’s June 2026 election shows that Russian interference is not only about pushing individual falsehoods or backing a preferred candidate. It is about shaping the political environment in which choices are made and later interpreted. In Armenia’s case, that meant saturating the information space with narratives calibrated to the country’s deepest anxieties: war, betrayal, Turkey, national erasure, moral decline, and the loss of sovereignty.
The campaign also suggests an evolution in tradecraft. While fabricated outlets, deepfakes, and spoofed media remained part of the toolkit, there was increasing use of more plausible intermediaries, real media ecosystems, and narratives rooted in existing domestic tensions. The goal was not simply to convince Armenians of a single lie, but to make the westward turn feel dangerous, divisive, and fundamentally unnatural.
Just as importantly, Moscow did not need to prevent Pashinyan’s victory to extract value from the campaign. It only needed to deny him a clean mandate, preserve pro-Russian political forces as vehicles for future pressure, and keep Armenia’s political trajectory framed as unstable and contested. The cyber and hacktivist activity described here appears to have supported that effort mainly by creating noise, vulnerability, and an atmosphere of disorder rather than by decisively disrupting the vote itself.
Armenia therefore offers a useful case study in how modern election interference works: not as a single operation, but as a layered effort to erode confidence in institutions, increase the perceived cost of geopolitical independence, and keep political sovereignty open to external pressure.
{{standout}}
