Russia-Aligned Influence Operation Targets US Midterm Candidates, German State Elections
We identified a very likely coordinated network of accounts across Facebook, Instagram, Pinterest, Threads, TikTok, X, and YouTube that is impersonating US Assistant Attorney General Colin McDonald, who serves in the Department of Justice’s National Fraud Enforcement Division.
Between Sept. 7 and 14, several likely inauthentic accounts on X seeded or shared videos and manipulated newspaper pages with unverified claims accusing German and U.S. politicians of electoral fraud and corruption ahead of Berlin’s Sept. 20 state elections and the US midterms. Some videos impersonated US news outlets or claimed celebrities were promoting #AllDemocratsAreCriminals. Based on post and video characteristics and dissemination tactics, we assess with high confidence that the Russia-aligned Operation Overload influence operation and the Yevgeny Prigozhin-founded Foundation to Battle Injustice (R-FBI) produced these narratives.
Online Activity
R-FBI Article Targets Merz
On Sept. 7, the R-FBI published an alleged investigation claiming German Chancellor Friedrich Merz was attempting to “cleanse the electoral field” and sabotage opposing parties before the Berlin elections. Pro-Kremlin journalist Lucas Leiroz republished the article on VTForeignPolicy[.]com and X.
Fake Accounts Allege Corruption
Between Sept. 7 and 9, several likely inauthentic or repurposed X accounts, which are now suspended, seeded unverified claims that Germany’s Christian Democratic Union and Social Democratic parties were engaged in electoral manipulation and corruption.
Videos Attack US Democrats
Between Sept. 10 and 14, other likely inauthentic or repurposed accounts, which are now suspended, shared videos that accused US Democratic politicians of corruption, antisemitism, and misconduct. The targeted politicians included Texas state Rep. James Talarico, US Sen. Jon Ossoff, US Rep. Chris Pappas, and US Senate candidates Sherrod Brown, Mary Peltola, Roy Cooper, Abdul El-Sayed, Joshua Turek, and Troy Jackson.
Celebrity Footage Misappropriated
The X accounts also posted videos that used authentic footage of US celebrities, including Sarah Jessica Parker and Julia Roberts, with added overlaid text to claim that they were promoting #AllDemocratsAreCriminals.
Posts Impersonate Trusted Outlets
Other X posts shared videos that claimed the Democratic Party was conducting “disinformation campaigns” or “false-flag operations” to falsely blame Russia for interfering in the upcoming midterms. These videos impersonated or falsely cited the BBC, CNN, Politico, the French government agency VIGINUM, and MS NOW journalist Brandy Zadrozny.
Cited by The New York Times
Graphika shared this intelligence exclusively with The New York Times, which covered Operation Overload's targeting of German and US candidates ahead of this fall's elections. Speaking to correspondent Steven Lee Myers, Graphika senior analyst Jean le Roux said the operation shows no signs of slowing: "we're definitely expecting it to ramp up... I don't think they're going to stop. I think that we're seeing the initial kickoff of the US election focused campaigning." Read the full story in The New York Times.
How We Investigated This
Graphika's intelligence is built on a proprietary methodology developed over more than a decade of network analysis and open source investigation. Every insight we publish is grounded in rigorous, evidence-based research across the platforms, communities, and narratives that shape online discourse.
Network Mapping
We identify and map online communities based on how they interact, not just what they say, revealing the structural relationships between actors and audiences.
Narrative Tracking
We monitor how narratives form, evolve, and spread across platforms, distinguishing organic conversation from coordinated amplification.
Behavioral Analysis
We analyze patterns of behavior across accounts and networks to detect coordination, inauthentic activity, and influence operations.
Cross-Platform Intelligence
Our analysis spans mainstream and niche platforms, giving a complete picture of how information moves across the broader online ecosystem.
Expert Validation
Every finding is reviewed by our team of analysts, researchers, and subject matter experts before publication.
Graphika is the most trusted provider of actionable open-source intelligence to help organizations stay ahead of emerging online events and make decisions on how to navigate them. Led by prominent innovators and technologists in the field of online discourse analysis, Graphika supports global enterprises and public sector customers across trust & safety, cyber threat intelligence, and strategic communications, spanning industries including intelligence, technology, media and entertainment, and global banking.
Related Insights
As 2026 World Cup Kicks Off, Chinese and Pro-China Actors Criticize US Visa Denials, Promote Mexico and Chinese Brands
In the context of the 2026 World Cup, Chinese and pro-China actors on Facebook, X, and YouTube have portrayed the U.S. as a vengeful, chaotic, and unfair host nation while praising Mexico as a moral counterweight.
Read the Insight
Pro-Kremlin Actors Cry FIFA Corruption After Reversal of U.S. World Cup Player Suspension
Pro-Kremlin actors showcased news of U.S. President Donald Trump influencing the reversal of a U.S. World Cup player's suspension to claim the Federation Internationale de Football Association (FIFA) is corrupt and politically biased.
Read the Insight
Russian Media, Pro-Kremlin Actors Cast US Travel and Ticket Restrictions as Undermining, Causing Chaos for World Cup
Pro-Kremlin actors online, including websites linked to pro-Russia Portal Kombat (PK) influence operation, shared reports about the U.S. denying entry to Somali referee Omar Artan for the FIFA World Cup and restrictions affecting Iranian players and supporters.
Read the InsightSee How Graphika Can Help Your Team Act on This Intelligence
This insight is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.