At the beginning of June, the number of social media accounts commenting on the anti-immigration riots in the capital of Northern Ireland, Belfast, skyrocketed. The sample of Russian accounts and those linked to that country analyzed by the cognitive cyber intelligence company Alto Intelligence recorded a 69% increase in conversations from those accounts - including bots, real users, and accounts in Russia itself - in the days leading up to the riots, which erupted on June 8.
On the 9th, there was a decrease of almost two-thirds. And on the 10th and 11th, there was another 66% surge. On those two days, the violence led the authorities in Northern Ireland to close Belfast to the outside world. If up to that point urban buses and trolleybuses had been suspended, on the 10th, trains and buses connecting the city to the rest of Northern Ireland and the Republic of Ireland were canceled.
Four months later, a new wave of disturbances, but on a larger scale and without anti-immigrant motivation, has devastated parts of Europe, especially France. This time, Russian accounts on social media have not heated up the situation. In fact, everything indicates that the explosion caught them off guard. However, they have quickly adapted. While the streets of Paris, Limoges, or Milan were being destroyed, a series of well-identified Russian entities as spreaders of disinformation - and even subject to Western sanctions - launched an online offensive regarding the disturbances. As is customary in Moscow's hybrid warfare disinformation operations, their message was not truly ideological. It simply aimed to sow chaos and confusion.
The best example is the Matrioshka network, which obviously takes its name from the famous Russian dolls. These days, this network has carried out one of its classic offensives on two fronts, following the pattern identified in 2024 by VIGINIUM, the French government agency that monitors foreign digital influence operations. On one hand, they have used their seeders accounts to falsify images from Western media with news that have absolutely nothing to do with the facts.
This is how, according to the American content verification company NewsGuard, at least 20 fake screenshots have appeared on platforms like X (formerly Twitter, well known for its lack of content moderation) showing news that does not exist, such as a supposed attack by a Muslim against Pope León XIV in France reported by an imitation of the country's official news agency, AFP, or the death of 54 French teachers during the riots, attributed to the German public television Deutsche Welle. It is an old and effective strategy. In fact, some of the images distributed by these accounts have already been used in other cases of manipulation, including the assault on Ceuta by immigrants last August.
According to NewsGuard, there are three Russian networks that have created total or partial reproductions - logos, videos, pages - of 163 media outlets worldwide. Of the top fifteen most used, eight are French. This is not so much due to the disturbances as to the fact that the country is holding presidential elections in which the two favorites - the right-wing populist Marine Le Pen and the left-wing populist Jean-Luc Mélenchon - are open supporters of Russia.
These fake news stories serve two purposes. First, they exacerbate religious, ethnic, and religious tensions, in line with the Kremlin's official stance, which sees violence as a kind of war between civilizations. Secondly, they create a much greater sense of chaos and violence than already exists.
But the seeders are only one of the two fronts of Matrioshka. The other consists of the quoters, who are accounts that massively respond to media outlets, journalists, opinion leaders, and news verification companies, asking about the false content spread by the seeders. With this strategy, the quoters inundate the accounts they target, and since social media algorithms replicate the most repeated and often controversial content, they manage to get the fake news into the communication agenda.
Another Russian hybrid warfare tool that has been particularly active these days is Rybar, a supposed geopolitical analysis network operating on Telegram, a very popular social network in Russia. Rybar has disseminated a map of Europe full of cities where there were disturbances, in order to create the impression of social crisis and total insecurity. Their target audience is more sophisticated than Matrioshka's, but more influential in society.
Rybar and Matrioshka are just two of the tools used by external actors, in this case Russia, to exacerbate the crisis. If they were prepared to act in Belfast in June, they have now demonstrated their ability to adapt. Their messages have amplified the sense of chaos and near-civil war in some cities. Thus, they have contributed to the Kremlin's narrative of a Europe on the brink of collapse and, at the same time, reinforced the Russian public opinion's view that their country is an island of stability in a crumbling world.