This report examines Russian information activity during the first seven days of the Iran War, starting on 28 February 2026, with initial strikes from the United States and Israel. It focuses on how Russian state institutions, state-aligned media, and affiliated online networks responded to the rapidly developing situation. The analysis identifies key fake narratives promoted during the opening phase of the war, patterns of amplification observed before and immediately after the first strike, and the role of official Kremlin commentary in shaping the information environment. By examining these early dynamics, the report provides insight into how Russia seeks to exploit emerging crises to advance strategic narratives and influence international perceptions of the conflict.
Looking at data running from 28 February 2026 to 06 March 2026, SecAlliance has analysed several instances of covert influence operations that we have attributed, with high confidence, to the Russian state – and specifically, to the Matryoshka Campaign.
The Matryoshka campaign is a large-scale Russian disinformation operation that uses impersonation and fabricated media to spread false narratives online. The campaign typically involves creating fake news articles, forged documents, and manipulated videos that imitate reputable Western media outlets or institutions. These materials are then circulated through coordinated networks of social media accounts, often amplifying claims about Western hypocrisy, corruption, or military misconduct. The name “Matryoshka” reflects the layered nature of the operation: fake content is wrapped within seemingly credible sources, which are then amplified through multiple accounts and platforms. The campaign has frequently targeted audiences in Europe and North America, particularly around geopolitical crises.
The findings demonstrate a coordinated attempt to exploit the early stages of the Iran War using fabricated media impersonating credible Western outlets and institutions. The content promoted narratives undermining Western governments, damaging Ukraine’s reputation, and inflaming social tensions in Europe. The activity also showed clear signs of coordinated amplification, with posts receiving hundreds of thousands of views but almost no engagement.
Fake Le Point Video
On 02 March 2026, a post on X falsely claimed that Ukrainian telephone scammers had stolen EUR 42 million from French citizens following the escalation of the conflict in the Middle East. An accompanying video using Le Point branding alleged that calls soliciting donations to strengthen the air defence capabilities of French bases in the Middle East were made after reports of strikes on France’s naval base in Abu Dhabi and further claimed the scheme targeted individuals in the United States, Germany, and Israel. [source].
No such news report exists, and Le Point didn’t make these claims.
The narrative appears designed to portray Ukrainians as opportunistic criminals exploiting international crises, thereby undermining Western public support for Ukraine and eroding trust between Ukraine and its European partners.
Fake French Directorate-General for External Security (DGSE) Video
On 02 March 2026, a post on X falsely claimed that France’s Directorate-General for External Security (DGSE) had advised citizens to avoid public places due to the escalation of the conflict in the Middle East. An accompanying video using DGSE branding alleged that radical Islamists had become more active in France following reports of the death of Ayatollah Ali Khamenei, creating a high risk of terrorist attacks. The video further claimed that French citizens had been advised to avoid public places from 01 March 2026 and to exercise increased caution around migrants from the Middle East [source].
This narrative appears intended to stoke fear of terrorism while inflaming anti-migrant sentiment in France. By attributing the warning to the country’s intelligence services, the disinformation attempts to create the impression that the threat is both credible and officially acknowledged.
Fake Aljazeera Video
On 02 March 2026, a post on X falsely claimed that attacks on the UAE had damaged apartments belonging to several prominent figures, including Armenian Prime Minister Nikol Pashinyan. An accompanying video using Aljazeera branding, used real news footage from the UAE and alleged that the damaged apartment was worth around USD 15 million and claimed the issue had sparked widespread discussion on the ‘Armenian internet’, fuelling allegations of corruption. It further claimed that the prime minister’s press secretary, Nazeli Baghdasaryan, responded by stating that reports of the prime minister owning USD 170 million in real estate abroad were Russian disinformation [source].
The narrative appears aimed at undermining Prime Minister Pashinyan domestically by portraying him as corrupt and secretly wealthy. This aligns with broader Russian information operations targeting Armenia’s current leadership amid tensions between Yerevan and Moscow and Armenia’s growing distance from Russian security structures.
Fig 1, 2, and 3: Examples of the posts featuring the fake Le Point, Aljazeera and DGSE posts/videos.
Fake Euronews Video 1
On 02 March 2026, another post and video on X falsely claimed that reports of Nikol Pashinyan’s alleged real estate holdings in the UAE had sparked outrage among Armenians worldwide. The accompanying video used Euronews branding and repeated claims that the Armenian prime minister owned luxury property abroad, again alleging that his press secretary, Nazeli Baghdasaryan, had dismissed reports of USD 170 million in foreign real estate as Russian disinformation [source].
This narrative reinforces corruption allegations against Pashinyan while amplifying the appearance of widespread Armenian public anger. The repetition of the claim across two fake media reports is likely aimed at manufacturing credibility and to amplify this particular narrative.
Fake Institute for the Study of War (ISW) Video 1
On 02 March 2026, a post on X falsely claimed that France had concealed the deaths of 70 soldiers allegedly killed in an Iranian strike on a base in Abu Dhabi. An accompanying video using Institute for the Study of War (ISW) branding falsely attributed comments to analyst Kelly Campa accusing President Emmanuel Macron of prioritising support for Ukraine over France’s defence and bearing responsibility for the alleged deaths [source].
The narrative attempts to undermine confidence in the French government and portray support for Ukraine as harmful to France’s national security. By falsely attributing the claims to a respected defence think tank, the disinformation seeks to lend credibility to the accusation.
Fake Euronews Video 2
On 03 March 2026, a post on X falsely claimed that Euronews had reported that Dubai police detained Ukrainian looters while the city was under rocket and drone fire. The accompanying video was presented as a Euronews broadcast. It reused an authentic segment featuring presenter Jane Witherspoon before switching to a deepfake narration imitating her voice, which claimed that debris from intercepted missiles and drones had damaged a dozen residential buildings, including the USD 7 million mansion of a Ukrainian military general [source].
No such report appeared on Euronews’ official platforms.
Fake Euronews Video 3
On the same day, another video following the same format appeared online. The post again claimed that rocket debris had damaged the home of a Ukrainian general. However, the Euronews-branded video instead featured a deepfake of Jane Witherspoon repeating the claim that Ukrainian looters had been detained in Dubai. The content suggests the videos accompanying the posts were likely mixed [source].
Again, none of these claims appeared on official Euronews channels.
Regardless of the apparent mistakes in the linking of the post to the video, the narratives appear designed to damage Ukraine’s international reputation by portraying Ukrainians as criminals exploiting wartime chaos while also spreading sensational claims about Ukrainian military elites.
Fake ISW Video 2
Another fake ISW video appeared on 04 March 2026, and claimed that according to ISW, France's nuclear weapons pose a greater threat to world peace than Iran's nuclear program due to poor storage conditions. The video goes on to claim that France does not comply with international standards for storage and maintenance of its nuclear weapons. It then goes on to use a fake quote from a another ISW analyst, Stephen Gordon to give the claims validity [source].
The narrative appears to exploit news of France expanding its nuclear deterrent to portray French nuclear policy as reckless and destabilising. By falsely attributing the claim to the Institute for the Study of War, the disinformation seeks to lend credibility to criticism already voiced by the Ministry of Foreign Affairs of Russia and reinforce the narrative that France’s nuclear posture poses a greater threat than Iran’s programme.
Fig 4, and 5: Examples of the posts featuring the fake Euronews and ISW posts/videos.
Did Anyone Actually See These Posts?
As seen in other operations linked to the Matryoshka campaign, these posts accumulated a significant number of views despite receiving very little engagement. Individual posts recorded between 100,000 and 1 million views, while all remained below 100 interactions (likes and reposts). The post with the highest reach, approximately 1 million views, featured the fabricated Institute for the Study of War (ISW) video falsely claiming that France had concealed the deaths of French soldiers following Iranian strikes. Despite this reach, there were no comments on the post. The posting account itself also had little followers, suggesting this view count could have come from bot accounts forming part of the coordinated inauthentic amplification.
This pattern was consistent across all the network’s activity: high view counts paired with minimal interaction and from accounts with limited or no follower base. Such indicators suggest that the visibility of the posts may have been artificially inflated through coordinated inauthentic amplification, potentially involving bot accounts.
Available evidence suggests there was limited coordinated narrative preparation within the Russian information ecosystem in the week preceding the initial strikes of 28 February 2026. Open-source analysis indicates that the scale of the operation appears to have caught Moscow off guard, with Russian officials reportedly expecting at most a limited attack on Iranian nuclear facilities rather than a broader campaign targeting leadership and infrastructure. The Kremlin reportedly convened emergency discussions shortly after the strikes, further indicating that the scope of the operation had not been anticipated internally.
In the days leading up to the attack, Russian state-aligned media did discuss rising tensions around Iran and the possibility of escalation. However, this coverage appears to have been speculative rather than coordinated narrative preparation. Commentary in state-affiliated outlets focused largely on geopolitical analysis, including questions about whether the United States would risk another Middle Eastern war and discussion of domestic US support for such an operation. These themes are typical of Russian geopolitical commentary and do not appear to have formed part of a structured influence campaign anticipating imminent strikes.
This pattern contrasts with earlier Russian influence operations in which narratives were visibly pre-positioned before the triggering event. For example, in the Greenland information campaign analysed previously by SecAlliance, pro-Kremlin outlets and online networks seeded narratives questioning Western intentions and the legitimacy of Danish control over Greenland well in advance of the political developments that later became the focus of the campaign. In that case, narratives appeared synchronised across state media, commentary outlets, and Telegram channels before the issue reached wider international attention.
The Iran crisis shows far less evidence of such pre-positioning. Instead, Russian information activity during the opening phase of the conflict appears primarily reactive. Rather than seeding narratives in advance of the strike, the Russian information ecosystem appears to have adapted quickly to events as they unfolded. This difference suggests that, unlike the Greenland campaign, the Iran conflict was not an information operation anticipated and prepared for in advance, but rather an emerging crisis that Moscow subsequently sought to exploit once the conflict had begun.
Fig 6: Narrative activity surrounding the first strike. Unlike previous influence campaigns, coordinated narrative amplification appears largely after the triggering event rather than before it.
Russia typically employs a combination of overt and covert information operations to shape the narrative environment around international crises. Covert influence operations rely on concealment: anonymous networks, coordinated inauthentic accounts, and unattributed content designed to seed narratives indirectly into the information space. By contrast, overt influence operations rely on visibility rather than secrecy. Senior officials, state diplomats, and government-aligned media openly advance coordinated narratives through press conferences, official statements, and televised commentary, allowing Moscow to shape debate while retaining plausible deniability for narratives that may also circulate through covert channels.
Overt operations focus on agenda-setting, repetition, and saturation. Russian officials reframe events, question the legitimacy of Western actions, and emphasise perceived hypocrisy or division among Western states. Unlike covert disinformation, overt influence leverages the authority of the Russian Foreign Ministry and senior political figures to normalise contested narratives in plain sight. The objective is not necessarily persuasion alone, but introducing alternative interpretations that generate confusion, fatigue, and scepticism towards established accounts.
This overt-covert pairing is particularly useful in the context of the Iran War given the strategic partnership between Moscow and Tehran. Russia has incentives to support Iranian narratives while avoiding the appearance of direct involvement or escalation with Western states. Overt messaging from Russian officials therefore provides a legitimising framework. At the same time, covert networks can amplify more extreme or conspiratorial interpretations of the conflict that official channels cannot credibly advance. Together, these approaches create a layered influence strategy that expands the reach and impact of Russian messaging across fragmented online information environments.
Moscow’s Official Position
As anticipated, the Kremlin’s public messaging on the Iran War has been rapid, disciplined, and opportunistic. Statements by President Vladimir Putin, Foreign Minister Sergei Lavrov, and Foreign Ministry spokesperson Maria Zakharova have consistently framed the conflict not primarily as a regional security crisis but as further evidence of Western recklessness and disregard for international law. Across these statements, the emphasis has been less on Iranian conduct and more on portraying the United States and Israel as the actors responsible for destabilising the region.
Putin’s rhetoric has combined condemnation with an attempt to position Russia as a relevant diplomatic actor. In public remarks and Kremlin readouts of diplomatic contacts, the Russian president has criticised Western military action while simultaneously presenting Moscow as a potential mediator. Statements surrounding calls with Gulf leaders have emphasised Russia’s readiness to contribute to de-escalation and regional stability. This messaging allows Moscow to occupy two positions simultaneously: condemning Western actions while presenting itself as a responsible international interlocutor.
Lavrov has articulated the Kremlin’s strategic framing of the conflict. In his remarks, he has argued that the war undermines the international non-proliferation regime and risks encouraging nuclear proliferation rather than preventing it. By claiming there was no credible evidence that Iran was developing a nuclear weapon prior to the escalation, Lavrov has sought to portray the intervention as unjustified and counterproductive. This argument serves a dual purpose: it challenges Western claims regarding the security rationale for military action and reinforces Moscow’s broader narrative that Western interventions frequently destabilise the very regions they claim to protect.
Fig 7: Russian Foreign Ministry spokesperson Maria Zakharova delivers a weekly press briefing in Moscow. These briefings serve as a key platform for the Kremlin’s overt messaging on international crises [source].
Zakharova’s commentary has been considerably more confrontational and propagandistic. In briefings and public statements, she has characterised the conflict as the result of a fabricated or exaggerated threat used to justify long-planned regime change. She has also criticised Western rhetoric encouraging political change inside Iran, framing such language as cynical interference in the country’s internal affairs. This line closely mirrors familiar Russian information narratives: Western governments are depicted as pursuing regime change under humanitarian or security pretexts, while negotiations and diplomatic processes are framed as insincere or instrumental.
Taken together, these statements indicate that overt Kremlin messaging is serving several functions simultaneously. First, it seeks to delegitimise the war by presenting it as an unjustified act of aggression rather than a response to a security threat. Second, it folds the conflict into Russia’s longstanding narrative that Western interventionism is a principal driver of global instability. Third, it attempts to undermine Western credibility on issues of international law and non-proliferation. Finally, it positions Russia as a pragmatic and stabilising actor at a moment when the conflict risks further fragmenting the regional security environment.
In effect, the Kremlin’s overt commentary is less about defending Iran itself than about shaping the broader narrative environment. Putin provides the presidential framing and diplomatic posture; Lavrov supplies the legal and strategic argumentation; Zakharova delivers the sharper rhetorical attacks designed for rapid circulation through media and information networks. Together, these messages seek to transform the Iran war into another illustration of Moscow’s central geopolitical claim: that Western interventionism, rather than the behaviour of states such as Russia or Iran, is the primary source of contemporary international disorder.
Added Complexity: Russia’s Relationship to Iran in the Ukraine Context
Russia’s information posture towards the Iran war is shaped by the evolving strategic relationship between Moscow and Tehran, particularly since the start of the war in Ukraine. Over the past several years, Iran has become an important military partner for Russia, most notably through the provision of Shahed-series drones used extensively against Ukrainian infrastructure and cities. These loitering munitions have played a significant role in Russia’s long-range strike campaign, reshaping aspects of the war by allowing Moscow to conduct sustained, relatively low-cost drone attacks.
However, the current Iran conflict appears to highlight the limits of this partnership. Despite rhetorical support and diplomatic coordination, Russia has so far avoided direct military involvement in the war and has largely confined its response to political statements and mediation efforts. It is clear that Moscow is reluctant to escalate confrontation with the United States or jeopardise its relations with Gulf states while it remains heavily committed to the war in Ukraine.
At the same time, the military relationship between Russia and Iran has evolved in ways that reduce Russia’s immediate dependence on Tehran. While Iran initially supplied thousands of drones, Russia has increasingly localised production, manufacturing modified versions domestically in larger quantities than it previously imported. This reduces the risk that a conflict involving Iran would significantly constrain Russia’s ability to sustain drone strikes against Ukraine.
In this context, Russia’s information messaging appears carefully calibrated. Moscow continues to defend Iran rhetorically and criticise Western intervention, but its relatively cautious posture reflects a broader strategic calculation: preserving the benefits of the partnership while avoiding deeper entanglement in a conflict that could complicate its primary military priority in Ukraine.
Inconsistent Messaging in Russian State-Aligned Media
Fig 8: Overt narrative amplification model
Russian overt information operations typically operate through a layered ecosystem in which official messaging is amplified and adapted across multiple media environments. Narratives often originate in statements from senior officials or government institutions, such as the presidential administration or the Foreign Ministry. These themes are then echoed and elaborated by state-aligned media outlets including RIA Novosti, RT, and Sputnik. From there, pro-Kremlin Telegram channels and military bloggers frequently intensify or dramatise the messaging, introducing more emotive or speculative claims. Finally, selected narratives circulate internationally through social media networks, sympathetic commentators, and alternative media outlets, extending the reach of the original messaging beyond Russia’s domestic information space.
Although Russian officials have generally condemned Western military action against Iran, commentary across the broader pro-Kremlin media ecosystem has not been entirely consistent. Some state-aligned analysts and commentators have framed the conflict primarily as another example of Western destabilisation, echoing official Kremlin rhetoric. However, other voices in the same media environment have adopted a more cautious tone, questioning the reliability of Iran as a strategic partner and warning against Russia becoming too closely associated with Tehran’s military decisions.
This divergence reflects a broader pattern in Russian information strategy. Rather than enforcing perfect message discipline across all commentators, the Kremlin often allows a degree of controlled pluralism within state-aligned media. Different narratives can coexist as long as they do not fundamentally challenge the core strategic line set by the Kremlin. In practice, this can produce a mix of commentary: some emphasising solidarity with Iran and criticism of Western intervention, while others highlight the risks of deeper entanglement in the conflict.
Allowing such variation can serve several strategic purposes. It enables Russian media to explore multiple geopolitical interpretations of the conflict without committing the Kremlin to a single rigid position. It also creates the appearance of a more open debate while still anchoring the discussion around shared assumptions, such as Western responsibility for escalation or the decline of Western leadership.
The first week of the Iran War provides a clear example of a fully reactive Russian influence campaign. Unlike previous influence operations in which narratives were seeded well in advance of a triggering event, there is little evidence that Moscow anticipated the scale or timing of the 28 February 2026 strikes. Instead, Russian information networks moved quickly to exploit the geopolitical moment once the conflict began. Within hours, both covert and overt channels were activated, demonstrating how Russia’s influence infrastructure can rapidly pivot to new crises.
This episode highlights Russia’s continued manipulation of global events to advance its strategic narratives, even when Moscow is not directly involved in the conflict itself. Rather than constructing entirely new messaging centred on Iran, Russian information operations relied heavily on pre-existing narratives embedded within the Russian disinformation ecosystem. These included claims of Western aggression and regime change, accusations of Western hypocrisy and double standards, and familiar attempts to undermine trust in Ukraine, European governments, and Western security institutions. By repurposing these established themes, Russian networks were able to exploit the crisis without overtly inserting themselves into the conflict or jeopardising Moscow’s strategic relationship with Tehran.
At the overt level, Kremlin messaging followed a familiar pattern. Official commentary framed the conflict as another example of reckless Western intervention while simultaneously positioning Russia as a responsible international actor. Importantly, the Russian media ecosystem did not present a single unified narrative. Instead, controlled divergence appeared across state-aligned outlets, creating the impression of debate and pluralism while remaining anchored to the Kremlin’s core geopolitical framing.
Taken together, the campaign demonstrates how Russia’s influence structures function as a standing capability rather than a single operation. Networks of impersonation accounts, fabricated media, and coordinated amplification can be rapidly activated and redirected to exploit unfolding global events. The activity observed during the first week of the Iran War is therefore not an isolated incident but another manifestation of the broader Matryoshka campaign – a layered system designed to inject disinformation into international discourse whenever geopolitical opportunities arise.
Within the Fusion Team at SecAlliance, we use real-time alerting and AI integrated tracking tools to detect narrative attacks early, so our clients can act before the damage is done.
We actively monitor:
• State-run and hostile foreign media outlets;
• Known disinformation domains and bot networks;
• Keyword patterns linked to common disinformation narratives and;
• Sentiment spikes and coordinated messaging signals.
Disinformation is evolving fast. We're here to help you stay ahead of it.
For details on our disinformation detection services, please contact info@secalliance.com.
