In the days surrounding Saxony-Anhalt's state election — one that positioned the far-right AfD as a potential governing partner for the first time since World War II — a shadow campaign unfolded across social media, manufacturing the appearance of electoral corruption where none existed. Staged videos, spoofed news logos, and impersonated journalists worked in concert to seed distrust in Germany's democratic institutions, with investigators tracing the operation to Russian military intelligence. It is a pattern as old as propaganda itself: when you cannot stop an election, you can still poison
DW debunks election fraud claims in Saxony-Anhalt vote
Election workers destroying votes for the far-right party—staged, obvious, and shared thousands of times.
Why does a state election in Saxony-Anhalt matter enough to warrant this kind of coordinated disinformation campaign?
The AfD's win there was historic—it's the first time since 1945 that a far-right party has positioned itself to lead a state government. That's a watershed moment in German politics, and it clearly caught the attention of actors who wanted to delegitimize the result.
But we should be careful here. The disinformation existed, yes, but how much actual impact did it have on the vote itself? The posts had reach, but was it authentic reach or mostly bots?
That's the right question. Smirnova specifically noted that the reach was "mostly inauthentic." So we're talking about amplification through bot networks, not grassroots sharing.
The fake videos are almost comically obvious once you look at them—identical names, missing security features. Why would anyone believe them?
Because they're not designed to convince everyone. They're designed to give people who already distrust the system a reason to share and discuss. They create noise and doubt.
And they're also designed to be plausible enough at first glance. Someone scrolling sees a news outlet logo, sees a claim about fraud, and shares it before they examine it closely.
What about the ZEIT error? That one actually involved a real news organization making a real mistake.
Right, and that's important to flag. The disinformation operation didn't create that error—ZEIT did. But the operation weaponized it, took a screenshot, and used it to suggest something illegal was happening when it wasn't.
ZEIT corrected it quickly, but the false claim had already spread to 160,000 people. That's the asymmetry we're dealing with—corrections move slowly, false claims move fast.
Is there any indication this will happen again before the federal elections?
Storm-1516 was active before the 2025 federal election, and Matryoshka has been documented repeatedly. The infrastructure is in place, the tactics are proven. The question is whether German platforms and fact-checkers can move faster this time.
And whether voters will be more skeptical of obviously fake videos. But that's asking a lot of people who are already primed to distrust institutions.
O Pulso
- A one-minute video showing a gloved hand destroying AfD ballots spread thousands of times before analysts noticed the ballots all bore the same name and lacked legally required security features — elementary errors that revealed the footage as staged.
- A second wave of near-identical videos, posted by accounts with zero followers, borrowed the logos of DW, BBC, and ARD to falsely accuse the CDU of registering fake voters using Nazi-era names — fabrications confirmed by the very journalists whose identities were stolen.
- Russian military intelligence unit Storm-1516 and the Matryoshka operation were identified as the architects behind both waves, continuing tactics documented before Germany's 2025 federal election and now catalogued across more than 180 fake posts.
- A genuine reporting error by ZEIT Online — corrected with a transparency note — was seized upon and amplified to over 160,000 views, transformed into false evidence that officials had illegally begun counting ballots early.
- The operation's goal was not to change votes but to corrode trust: bot networks and coordinated accounts ensured the false narratives spread far beyond their organic reach, leaving a residue of doubt that fact-checkers are still working to clear.
In the days surrounding Saxony-Anhalt's state election — one that positioned the far-right AfD as a potential governing partner for the first time since World War II — a shadow campaign unfolded across social media, manufacturing the appearance of electoral corruption where none existed. Staged videos, spoofed news logos, and impersonated journalists worked in concert to seed distrust in Germany's democratic institutions, with investigators tracing the operation to Russian military intelligence. It is a pattern as old as propaganda itself: when you cannot stop an election, you can still poison its meaning.
On the day Saxony-Anhalt voted — an election that could place the AfD inside a governing coalition for the first time since the Second World War — a parallel campaign was already running on social media, built entirely from fabrications.
The most widely shared piece of disinformation was a short video showing a man in white gloves marking black X's through AfD ballots while setting a CDU ballot aside approvingly. It circulated thousands of times on X and YouTube before fact-checkers noticed what the filmmakers had missed: all three crossed-out ballots bore the same name, the envelopes were already open, and the ballots lacked the hole punch required by German law for accessibility templates. The Gnida Project, a Russian disinformation watchdog, traced the video to Storm-1516, a unit of Russia's GRU military intelligence — the same unit active before Germany's 2025 federal election.
A second operation inverted the accusation. Five nearly identical videos appeared, each posted by accounts with no followers and no history, each borrowing the logos of established outlets — DW, ARD, BBC, WIRED — to allege CDU fraud. One falsely claimed that T-Online journalist Lars Wienand had uncovered evidence of the CDU registering fake voters using a database of Nazi soldier names. Wienand confirmed to DW that he had reported no such thing, and that his name and image had been misused by Russian disinformation before. Disinformation expert Julia Smirnova identified the posts as part of Matryoshka, also known as Operation Overload — a Russian campaign targeting German elections that DW Fact Check had already linked to more than 180 fake posts across X, Bluesky, and TikTok.
A third false claim fed on a genuine mistake. A ZEIT Online liveblog entry, posted at 3:15 p.m., stated that ballot counting had begun — hours before polls closed. A right-wing journalist amplified the screenshot to over 160,000 views as proof of illegal early counting. In fact, ZEIT had misdescribed a permitted preparatory step: under German law, absentee envelopes may be opened in advance to speed the count once voting ends. ZEIT corrected the error and explained the distinction. The false version had already traveled far beyond the correction.
What the pattern reveals is not a single attack but a sustained architecture of doubt — staged footage, spoofed mastheads, stolen bylines, and misread screenshots, each designed to be shared as evidence of corruption. The reach was largely artificial, driven by bot networks rather than genuine outrage. Yet the cumulative effect was a narrative: that the election was rigged, the institutions untrustworthy, the results illegitimate. As Germany looks toward federal elections, researchers are watching for the same templates to reappear.
On Sunday, Saxony-Anhalt held an election that will reshape German politics. The far-right Alternative for Germany, or AfD, won decisively enough to position itself as a potential partner in forming the first far-right state government in the country since World War II. But in the days surrounding the vote, a parallel campaign unfolded across social media—one built entirely on false claims about ballot tampering, vote manipulation, and electoral corruption.
DW Fact Check traced several of these false narratives back to coordinated disinformation operations, many of them linked to Russian actors. The most brazen involved a one-minute video that circulated thousands of times on X and YouTube. It showed a man in white gloves unpacking ballots from red envelopes, then drawing black X marks through ballots marked for the AfD while setting aside a CDU ballot with approval. The implication was clear: election workers were destroying votes for the far-right party. But the video contained elementary mistakes that exposed it as staged. All three crossed-out ballots bore the same name. They lacked the hole punch in the top right corner required by German election law to accommodate templates for blind and visually impaired voters. The envelopes themselves were already open. The Gnida Project, a Russian disinformation watchdog, identified the video as part of Storm-1516, a unit controlled by Russia's military intelligence agency, the GRU—the same unit that had been active before Germany's 2025 federal election.
A second wave of false claims inverted the target, alleging that the CDU was committing fraud. Five nearly identical videos appeared on social media, each roughly a minute long, each posted by accounts with zero followers and almost no other activity. They borrowed the logos of established news outlets—DW, ARD, WIRED, BBC—and made fabricated allegations: that the CDU was using a database of Nazi soldier names to register fake voters, or that residents were receiving campaign messages from deceased relatives. One video falsely attributed reporting to T-Online's disinformation correspondent Lars Wienand, claiming he had uncovered evidence of CDU election rigging. Wienand told DW directly that he had reported no such thing, and that this was not the first time Russian disinformation had misused his name and image. Julia Smirnova, a disinformation expert at the Center for Monitoring, Analysis and Strategy, confirmed these posts were part of Matryoshka, also known as Operation Overload, a Russian campaign targeting German elections. DW Fact Check had previously identified more than 180 fake posts across X, Bluesky, and TikTok using the same template and tactics.
A third claim seized on a reporting error to suggest electoral illegality. A post on X with over 160,000 views, shared by a right-wing journalist, accused officials in Halle of beginning to count absentee ballots before 6 p.m., when voting officially ends. The post included a screenshot of a ZEIT online liveblog entry from 3:15 p.m. stating that counting had begun. But ZEIT had made a mistake in its initial reporting. The newspaper's reporter clarified to DW that the blog post had been describing preparatory tasks—opening envelopes—not the actual counting of ballots. German election law permits ballots to be opened in advance to speed up the counting process once voting ends. ZEIT corrected the error with a transparency note explaining the distinction between preparation and counting. The false claim, however, had already spread widely.
What emerges from this pattern is not a single coordinated attack but a sustained operation designed to undermine confidence in the election itself. The false videos, the spoofed news outlets, the impersonated journalists, the misrepresented screenshots—each piece was designed to land in social media feeds and be shared by people who saw them as evidence of corruption. The reach of these posts was largely inauthentic, driven by bot networks and coordinated accounts rather than organic engagement. Yet they succeeded in creating a narrative that the election was rigged, that the institutions managing it were corrupt, and that the results could not be trusted. As Germany moves toward federal elections, fact-checkers and disinformation researchers continue documenting these operations, watching for the same tactics to resurface.
Citações Notáveis
It's not the first time that suspected Russian disinformation had misused my name and image.— Lars Wienand, T-Online disinformation reporter, after his name was falsely used in a fake video claiming he had uncovered CDU election fraud
As with other Matryoshka videos, the reach is mostly inauthentic.— Julia Smirnova, disinformation expert at the Center for Monitoring, Analysis and Strategy, on the amplification of false claims