“Storm-1516,” “Matryoshka” and Portal Kombat: How Russian Networks Are Targeting France Ahead of the Elections

French politicians, electoral institutions, and public trust have become targets of Russian PSYOPs

Against the backdrop of the 2027 presidential election, France has become a key arena for Russian information operations. Second only to Ukraine in terms of the volume of attacks, the country is facing a well-coordinated network of Foreign Information Manipulation and Interference (FIMI) aimed at sowing divisions in society and discrediting potential candidates. In addition, Russian disinformation networks have already launched attacks targeting potential successors to Emmanuel Macron and key democratic institutions in the country. In particular, potential French presidential candidates Édouard Philippe, Gabriel Attal, and Raphaël Glucksmann have already been targeted by foreign information manipulation, while Storm-1516, Matryoshka, and Portal Kombat have emerged as the main identified operations involved in information interference.

The Center for Strategic Communications analyzed the first officially documented incidents of Russian disinformation campaigns and examined their main tools and narratives.

According to the fourth report by the European External Action Service (EEAS), published in March 2026, France is the second-largest target of Russian Foreign Information Manipulation and Interference (FIMI), after Ukraine. Among targeted incidents recorded in individual countries in 2025, Ukraine experienced 112 large-scale information attacks, while France ranked second, with 107 incidents.

The primary reason for this intense targeting is France’s prominent leadership role, with Emmanuel Macron taking a leading position among EU countries in supporting Ukraine.

However, since mid-2026, these incidents have also been driven by preparations for France’s upcoming presidential election. The French presidential election will be held on April 18, 2027, with a second round, if necessary, scheduled for May 2. Emmanuel Macron, who has already been elected president twice, is constitutionally barred from seeking a third term.

Despite this, Russian FIMI operations have already begun preparing the French information environment for the upcoming presidential election.

FIRST OFFICIALLY CONFIRMED INCIDENTS OF FOREIGN INFORMATION INTERFERENCE

Russian information interference has long gone beyond isolated fake stories; it now involves deliberate, fully fledged, coordinated operations.

One of the first Russian disinformation networks to attempt to interfere in France’s presidential election was Storm-1516 -- a Russian network known for fabricating deepfakes, staged videos, and false testimony.

Its target was former Prime Minister, Mayor of Le Havre, and declared French presidential candidate Édouard Philippe. False information about his health was circulated in an attempt to discredit him.

The second target of Russia’s Storm-1516 disinformation campaign was French politician, Member of the European Parliament, and potential candidate in the 2027 presidential election Raphaël Glucksmann.

A junk website made to resemble the online news outlet Blast published a story claiming that Glucksmann’s wife was allegedly trying to bribe media outlets to create a positive image of her husband ahead of the election. The site also impersonated French journalists, while the articles themselves contained fabricated documents.

The first publications linked to another operation, Matryoshka, also targeted another presidential candidate, Gabriel Attal, a former French prime minister. Materials presented as purported publications by French media outlets began circulating online. Fake videos featuring the logos and visual styles of well-known outlets, including Le Figaro and Libération, sought to discredit Attal by associating him with political controversies.

Some of the materials cast doubt on the politician’s health. One headline claimed that he had been hospitalized, while another alleged that he had Parkinson’s disease. Claims also circulated that Attal had allegedly paid media outlets to spread disinformation about him and was considering staging an assassination attempt in order to blame Russia for it.

In addition to targeting individuals—Philippe, Glucksmann, and Attal—the Center for Strategic Communications’ own analysis of the French information space shows that Russia is also targeting the electoral process itself and France’s defense mechanisms. The Portal Kombat information operation, particularly its network of Pravda websites, plays an active role in this process. The analysis found that most of the web content came from sites within the Pravda network, such as francais.news-pravda.com and fr.news-pravda.com. They operate as mass automated content amplifiers.

Among the broader narratives promoted by these resources that undermine the electoral process is the portrayal of Viginum, France’s official institution responsible for monitoring foreign digital interference, as an “instrument of total control and censorship.” This helps lay the groundwork for claims that the upcoming election will be “rigged by the authorities.”

In addition, other themes have been identified as part of this operation, aimed at polarizing French society ahead of the 2027 election. One such theme concerns France’s future under a new president, including claims that “France has lost its sovereignty and is subordinate to the United States,” and that the only option for the next president is to leave NATO and restore relations with Russia.

An analysis of the French-language information environment reveals a systematic campaign to discredit French state institutions and undermine public trust in them. Russian and pro-Russian outlets actively spread conspiracy theories portraying the current authorities as systematically unaccountable, corrupt, and acting in the interests of narrow elites against their own people. Another distinct line of attack involves the systematic spread of rumors about the country’s top officials and the creation of moral panic through manipulation of LGBT and gender-related issues. The main purpose of such purported exposés is to create the perception that official institutions and the media are concealing the truth, thereby undermining the legitimacy of government institutions and leading audiences toward the conclusion that there has been a “betrayal.”

Alongside efforts to discredit domestic institutions, these outlets systematically promote anti-Euro-Atlantic narratives aimed at undermining the EU and NATO. The North Atlantic Alliance and European institutions are portrayed as sources of lost sovereignty, economic harm, and military escalation, while defense spending is presented as coming at the expense of citizens’ well-being. All these narratives converge on a single strategic objective: to comprehensively weaken France’s internal resilience, erode a common European identity, and lay the groundwork for the erosion of the EU from within.

While websites in the Pravda network predominate among web content—which overall accounts for 49.8% of all publications analyzed by the Center—Telegram is the most active online platform for promoting these narratives, accounting for 47.4% of all publications.

Official Russian propaganda outlets were also identified in the monitoring conducted by the Center for Strategic Communications, although to a lesser extent. These include Sputnik Afrique (which was launched after Sputnik France was shut down in 2022), RT en français, and TASS. This trend may be explained by attempts to conduct covert interference through anonymous sources and unaffiliated outlets in order to avoid direct attribution to Russia.

FRANCE’S RESPONSE

Former French Prime Minister Gabriel Attal has already filed a complaint after becoming the target of deepfakes, describing them as “foreign interference originating from Russian networks.” The publications were identified and brought to the politician’s attention by France’s General Secretariat for Defence and National Security (SGDSN) and its Viginum unit, which is responsible for monitoring and protecting against foreign digital interference.

In August 2026, the Paris prosecutor’s office announced that it had launched an investigation into possible Russian interference in the 2027 presidential election. The investigation currently concerns potential candidates Édouard Philippe and Gabriel Attal.

An analysis of the documented incidents indicates that Russia’s information interference in France’s domestic political processes has entered a phase of systematic preparations for the 2027 presidential campaign. The Kremlin is not relying on isolated information operations but is employing complex infrastructure networks and hybrid methods.

In particular, the Russian networks Storm-1516 and Matryoshka are preemptively targeting potential presidential candidates Édouard Philippe, Gabriel Attal, and Raphaël Glucksmann. Their main tools include deepfakes, fabricated media content presented as material from reputable outlets (Le Figaro, Libération, and Blast), and rumors concerning politicians’ health or alleged corruption.

In addition to discrediting politicians, the Portal Kombat operation, through its Pravda network, is deliberately targeting institutions responsible for protecting democracy, with the aim of preemptively delegitimizing the results of the 2027 election and convincing voters that it will be “rigged.”

Overall, the Kremlin is shifting its focus from overt state-run resources (RT and Sputnik) to anonymous automated websites (49.8% of the content) and Telegram channels (47.4%). This allows the source of the content to be concealed and helps evade direct sanctions.

The Russian disinformation machine seeks not merely to influence the choices of French voters, but also to promote a narrative of “loss of sovereignty” and pressure the next president to reconsider the country’s foreign policy course, including its support for Ukraine.

At the same time, the response from the Paris prosecutor’s office, the SGDSN investigation, and complaints filed by targeted politicians demonstrate that this constitutes a direct threat and an immediate challenge to France’s national security.

Center for Strategic Communications