“Matryoshka” enters the fray: The Kremlin and the GRU are spreading disinformation in Hungary ahead of its pivotal parliamentary election

Following the assassination of Yevgeny Prigozhin in August 2023 and the subsequent dismantling of his “troll farm,” the Presidential Administration has taken on a much greater role in the area of information operations, with private contractors operating under the watchful supervision of Sergei Kiriyenko, Deputy Head of the Presidential Administration, and Sofia Zakharova, an aide in the Presidential Administration’s Information Technology Development Directorate. Meanwhile, the main Kremlin-backed player in Hungary is the Social Design Agency (SDA), controlled by Ilya Gambashidze, with the associated group of companies operating under the banner of “Structura” playing a supporting role.

Gambashidze's involvement in Russian disinformation operations came to light during the FBI's investigation into Russian interference in U.S. political processes. The agency’s investigators gained access to an SDA presentation prepared for the Kremlin, which detailed the inner workings of the factory producing fake news and memes designed to influence the election.

One of the SDA’s typical tactics has been to use a network of bots to spread fake news purporting to come from respected Western publications. The strategy relies on social media users reposting these messages without verifying whether the media outlets actually reported anything of the sort. The tactic has been dubbed “Doppelgänger” in the Western press. Another area of focus for the Kiriyenko-Zakharova team is “memes”: Gambashidze’s team devises ways to package the desired narratives using already well-known and popular memes, then distributes them on social media, hoping they will go viral or be reposted by a popular account with a large audience. Particularly successful cases (for example, if a meme was reposted by Elon Musk) are reported at meetings in the Presidential Administration, which are attended by Kiriyenko.

Content has been prepared in various languages and targeted at different countries, but Kiriyenko’s bots are particularly active during election periods, when it is especially important for the Kremlin to influence public opinion in a range of locales. A similar situation was observed in the fall of 2025 in Moldova, when the country held a referendum and parliamentary elections. At that time, Russia mobilized all its resources and flooded Moldova with disinformation, even if it ultimately failed to play a decisive role in the election results.

The Insider has examined content promoted in Hungary via Meta’s social media platforms (Facebook, Instagram, Messenger, and Threads), as well as Twitter and TikTok, and found that both methods were being used by Kremlin actors in Hungary.

Hungarian social media platforms were suddenly flooded with “memes” spread for money by recently registered accounts. For example, a “Sára Kovacsevics,” who registered an account on March 31, 2026, launched over 40 ads targeting the opposition Tisza party. The “memes” claim that “if Tisza wins, candles won’t be so romantic anymore,” that if we “get rid of nasty Russian oil,” the country’s residents will have to travel by horse-drawn carts, and that Tisza’s energy plan will result in water leaking from people’s toilets. Many of “Sára’s” promotional posts weren’t blocked by Meta, and some of them are garnering hundreds of thousands of views.

Accounts like “Sára,” created over the past month, regularly post similar visual content while attempting to circumvent Meta’s restrictions. They do this by trying to avoid certain words that could trigger the platform’s filters for political advertising.

Aside from “Sára” and similar anonymous accounts, ads promoting Orbán’s candidacy or opposing Péter Magyar and his Tisza party are paid for by Hungarian state media outlets belonging to the MTVA holding company — Kossuth Rádió (170,000 Facebook followers as of April 2026) and Hirado.hu (linked to the news program “Híradó” and the M1 TV channel, which has 546,000 Facebook followers as of April 2026). In the Meta Ad Library, one can find several advertising posts launched by these pages on a daily basis since at least early March.

In this case, the activity is no longer so much about memes as it is about straightforward political advertising, but its narratives are, nevertheless, all too familiar. After all, they were among the Kremlin tactics that were exposed in investigations over a month ago.

Back in early March, the Financial Times reported that it had gained access to the SDA’s disinformation plan for Hungary, which included highlighting the contrast between current prime minister Orbán — a “strong leader with global friends” — and his main rival, Péter Magyar, “a Brussels puppet with no outside support.” According to the plan, Magyar and his Tisza party were to be subjected to “information attacks” to portray Tisza as torn apart by “incompetence, internal divisions, and secret agendas.” Kremlin analysts, meanwhile, advised Orbán to build his campaign around his personal ties with Donald Trump and the idea that the U.S. president is Hungary’s best chance to ensure security and economic stability. According to the Financial Times, memes, graphics, and videos for Orbán’s campaign were produced by Russian experts, and Hungarian influencers were tasked with spreading the content. Since February, about 50 bloggers and political analysts have been on the SDA’s radar. Sources at The Washington Post confirmed the existence of such a plan for the Hungarian elections, and today, we can all observe its implementation in real time.

Aside from the wave of “memes” on Facebook, the Kremlin has resorted to a familiar tactic: creating fake news stories in the guise of work by legitimate international news outlets. As a result, the Bot Blocker monitoring project has detected countless posts typical of “Doppelgänger,” published by the “Matryoshka” bot network in the names of outlets such as Deutsche Welle, The Kyiv Independent, Euronews, United 24, as well as the French state agency Viginum and the Ukrainian Center for Countering Disinformation — the very organizations that investigate and expose the Kremlin’s propaganda techniques.

And once again, what matters here is not only the format but also the main narrative, which focuses on stoking discord between Hungary and Ukraine. In these Kremlin materials, Orbán is portrayed as a peacemaker and a victim of aggressive Ukrainians dragging Hungary into war and plotting an assassination attempt on the Hungarian prime minister.

Moreover, Russia’s Foreign Intelligence Service (SVR) proposed staging a real-life assassination attempt to “fundamentally alter the paradigm of the election campaign,” the The Washington Post reported in mid-March — right around the time that Matryoshka began spreading fake videos about an assassination attempt on the Hungarian prime minister. As reported by  the independent investigative outlet Agentstvo, the first such video — which bore the logo of German public broadcaster Deutsche Welle — appeared on Twitter on March 17. It claimed that several Ukrainian refugees had died in Hungary “while attempting to detonate a homemade explosive device near Prime Minister Viktor Orbán’s office.” Another video, mimicking the style of the Ukrainian media platform United24, claimed that Oleg Tatarov, deputy head of the Ukrainian president’s office, had called on Hungarians to “vote with their blood.” The video also reported that Tatarov had issued similar calls for Hungarians to take up arms and achieve “the liberation of Hungary through bloodshed.” Other videos also linked the alleged assassination attempt on Orbán to Ukrainian intelligence agencies.

Here, the Kremlin hopes to kill two birds with one stone: on the one hand, to help Orbán score points by using anti-Ukrainian rhetoric, and on the other, to stoke anti-Ukrainian sentiment. The Kremlin promoted exactly the same narratives via TikTok as well.

An information campaign focused on the Hungarian elections was also launched on TikTok around January 2026. By the end of March, the platform had identified and blocked four networks attempting to influence the Hungarian elections in favor of Orbán (as well as two anti-Orbán networks).

The disinformation tracking project NewsGuard estimated that videos posted by networks supporting Orbán garnered at least 10 million views. Some of the videos were clearly generated using AI, while others were presented as authentic, even though they were also AI-generated.

Many of the fake videos focused on scare tactics related to Ukraine: for example, voters were warned that Hungarian men could be drafted to fight for Ukraine in the event that Péter Magyar’s Tisza emerges victorious on April 12.

Other accounts posted AI-generated videos in which Johnny Depp warned Hungarians that gas prices would rise if Magyar became PM.

TikTok noted that five out of six networks of inauthentic accounts were coordinated directly from Hungary, a fact that may be explained by earlier reports about a team of PR specialists sent to Hungary from Russia. However, it has long been no secret that a propaganda network has been operating in Budapest under the watchful guidance of GRU officers working under diplomatic cover.

Anti-Soviet dissident and pastor Gábor Ivanyi baptized Viktor Orbán’s children in the 1990s, but the two later parted ways. Although Orbán positions himself as a candidate who defends “traditional Christian values,” Ivanyi opposes him: the pastor does not believe in the combination of Christianity and nationalism promoted by the prime minister. Orbán did not forgive the criticism; in 2022, security forces raided the pastor’s congregation, and charges were filed against him for the alleged “violence” he perpetrated against the government officials who conducted the raid. A trial on this case is scheduled for May.

Not coincidentally, in late February videos began appearing on Twitter and Facebook with fake reports accusing Ivanyi of pedophilia. The videos cited a non-existent media outlet called “Oknyomozó Riport” (“Investigative Report” in Hungarian) as a source. To create the appearance of authenticity, three days before the video was published on social media (on February 18), the attackers registered the website oknyomozoriport[.]hu. A post accusing the pastor was promoted on Facebook by a newly created account of the same name, and the total audience for this disinformation on the social network ended up exceeding 120,000 people — mostly in the over-65 age group.

The Provereno fact-checking project noted that disinformation about Ivanyi was also spread on other similar websites that were specifically created to disseminate fake news: hirekhub24.hu and napihirek24.hu, which are hosted on the same IP address of the Hungarian hosting provider DotRoll and use the same DNS servers. Four of the five analyzed websites — hirekhub24.hu, 24veritas.com, euronews.us.com, and oknyomozoriport.hu — used the same paid WordPress theme (Soledad, with an almost identical set of plugins). Three of the websites — hirekhub24.hu, euronews.us.com, and 24veritas.com — were registered within a single week.

The Gnida Project discovered other “reports” from non-existent media outlets circulating in the Hungarian-language segments of Twitter and Facebook. One of them, Times of Ukraine, published fake news claiming that Péter Magyar was involved in the theft of 40 million euros intended as EU financial aid for Kyiv. The fake Times of Ukraine website appeared on February 1, three days before publications about the Hungarian opposition candidate went live. Similarly, the website of the non-existent European Center for Investigative Journalism began posting news about Magyar’s involvement in fraud involving European aid to Ukraine just a few days after its registration. Videos about these “investigations” were promoted on Twitter.

These schemes — creating non-existent media outlets and using them to publish fake reports — are characteristic of the Russian propaganda network known as Storm-1516. Moreover, the Hungarian fact-checking agency Lakmusz noted another characteristic feature of this network’s content: articles discrediting Orbán’s critics are written in clumsy language, suggesting they were translated using AI. To promote content on Twitter, the network uses retweets with links to videos or materials on a fake website. In this manner, it tricks the algorithms into showing the videos to a larger audience. For example, a post by an account registered in Nigeria (of all places) about Pastor Ivanyi garnered over half a million views. Promoting content through comments is another hallmark of Storm-1516.

The Storm-1516 campaign (a name given to it by the U.S. tech giant Microsoft) has been active since 2023. It is linked to the Foundation to Battle Injustice (R-FBI), founded by late Wagner Group head Yevgeny Prigozhin six months before his death. Although the campaign’s original goal was most likely to discredit the Ukrainian government, Storm-1516’s resources were subsequently also used to spread disinformation during election campaigns in Germany, the United States, and France.

The French government agency Viginum, which investigated the Storm-1516 campaign, considers it a proven fact that key figures in the operation include John Mark Dougan (an American police officer who fled to Russia in 2016) and Mira Terada, head of the Foundation to Battle Injustice. The money was transferred to Dougan by GRU officer Yuri Khoroshenky, and documents confirming the transaction were reviewed by The Washington Post.

Yuri Khoroshenky (also known as Khoroshevsky) was previously an employee of the GRU’s infamous Unit 29155, which gained notoriety for the Salisbury poisoning and for organizing sabotage operations in Europe. However, since Unit 29155 personnel became “barred from travel” in 2018 following The Insider’s publications, the unit began operating remotely from Russian territory, recruiting foreigners for their activities.

In Hungary, the GRU is also able to operate through its own officers acting under diplomatic cover. In Budapest, this was initially military attaché Oleg Smirnov, who, among other things, established active contacts with “friendly” local journalists.

According to the publication Direkt36, it was acquaintance and contacts with Oleg Smirnov that helped one of Orbán’s chief propagandists, Georg Spöttle, travel to Moscow for a conference organized by the Russian Ministry of Defense. In correspondence on the matter, Spöttle wrote to the Russian military attaché that he would publish materials in Hungarian newspapers and on television channels based on the information he received in the Russian capital — and he kept his promise. Moreover, in Russian media outlets including state news agency RIA Novosti or newspaper Pravda, the propagandist was referred to as an “internationally renowned political scientist from Hungary,” even though little was known about him in Hungary itself, according to Direkt36. Spöttle is now referred to as one of the “favorite ‘security policy experts’” referred to by Hungarian state media.

On March 6, 2024, Colonel Smirnov, who was still serving as the military attaché at the Russian Embassy, sent two English-language propaganda memos to several recipients. These multi-page documents, printed on the letterhead of the Russian Embassy in Budapest and marked as “unofficial,” were titled “On the Role of Western Countries in the Ukrainian Conflict” and “Situation Around Ukraine,” writes Direkt36. An analysis conducted by the publication, which reviewed the documents, showed that statements later made by Spöttle in the conventional press and on social media matched the received guidelines almost exactly. For example, the materials claimed that the war in Ukraine had been provoked by the West, that Ukraine is being used merely as a tool, that Zelensky is a puppet of the West, and that Western military support only prolongs the suffering of Ukrainians.

In September 2025, Spöttle traveled to Belgorod in western Russia, where he filmed the inside Russian bunkers, speaking with the soldiers there. The Insider established that the tour was led by Magomed Khiytanayev, a former deputy mufti of Chechnya and now a member of the Akhmat special forces unit led by Apti Alautdinov. Spöttle posted videos with Khiytanayev on his TikTok and YouTube channels. Earlier, as The Insider discovered, the Hungarian propagandist traveled to occupied Mariupol in the company of propagandist Vittorio Rangeloni, a correspondent for the “African Initiative” news agency, which has links to projects run by Yevgeny Prigozhin and the GRU. Following the trip, Spöttle delivered a “moving report from Donbas” on the Ultrahang podcast, while on his VK page, he wrote an article about “attacks by Ukrainian Nazis on civilians.”

Immediately before the parliamentary elections, Spöttle began publishing articles on topics identical to those of state media and the ASD’s guidelines described by the Financial Times: the weaknesses and contradictions of Magyar’s Tisza party, and the importance of friendship between Hungary and the U.S.

In the fall of 2024, when Colonel Smirnov left the embassy in Budapest, it was a GRU colonel named Alexei Zarudnev who replaced him. Zarudnev had been working at the embassy since at least 2014 and was already serving as deputy military attaché in October of that year when two GRU officers from Unit 29155, Alexei Kapinos and Evgeny Kalinin, traveled to Budapest under diplomatic cover with diplomatic mail as part of an operation to blow up weapons depots in the Czech Republic.