Russian Forensics Found in German Election Disinformation

The most brazen example was a fabricated video falsely claiming that Chancellor Friedrich Merz planned to resign in favor of Hendrik Wuest⁠4⁠8. The clip did not present itself as gossip or commentary. It used the branding of Deutsche Welle and the business daily Handelsblatt to claim that leaked documents showed Merz's Conservative party planned his resignation⁠8⁠9. There were no such documents and no such plan, according to the German reporting that exposed the video as a fake⁠8⁠9. The point was not to persuade a careful reader of a complicated argument but to create a moment of confusion that could travel faster than any correction⁠4⁠8.

The timing was not accidental. Germany was heading into four state elections in September 2026, with Saxony-Anhalt voting on 6 September, alongside Berlin, Mecklenburg-Western Pomerania and Lower Saxony⁠4⁠10. State elections in Germany shape governing coalitions, decide regional power and test national leaders, which makes them fertile ground for an influence operation that does not need to flip a federal government to succeed⁠4⁠10. A convincing fake aimed at a leading candidate in late summer, weeks before voters go to the polls, needs only to muddy the information environment long enough to stick⁠3⁠4.

German security services told AFP they believe a Russia-linked group was behind the fake Merz resignation video⁠6⁠9. The group was identified as Storm 1516, a name also linked in the reporting to Operation Overload, Matryoshka and Storm-1679⁠6⁠9⁠7. The different labels do not necessarily mean different authors. Investigators who track Russian influence operations describe a shifting architecture in which the same networks reappear under new names, with overlapping tactics, infrastructure and targeting⁠7. That ambiguity is part of why formal attribution is difficult and why security services often speak in assessments rather than certainties⁠3⁠6.

The Institute for Strategic Dialogue later identified Matryoshka, also described as Operation Overload and Storm-1679, as a Kremlin-aligned Russian influence operation targeting the 2026 state and municipal elections⁠7. ISD's investigation, published on 4 September, placed the German activity in a longer-running campaign rather than treating the Merz video as an isolated fake⁠7. That matters because a one-off forgery can be dismissed as noise, while a persistent operation with reused methods suggests planning, resourcing and intent⁠7. The German case, in that reading, was not new tradecraft but old tradecraft applied to a new vote⁠7.

Other newsroom fakes point in the same direction. EUobserver reported that Operation Matryoshka used fake "BBC news" branding around the Saxony-Anhalt vote⁠10. The choice of a foreign public broadcaster is telling. It borrows credibility from outside the immediate German media fight, making the forgery harder for a casual viewer to check and easier to share as supposedly neutral outside confirmation⁠10. DW's own investigation similarly found that established media logos were misused to give fabricated claims the appearance of verified reporting⁠2⁠4.

Reuters reported on 5 August, updated on 6 August, that security sources said Russia was stepping up disinformation campaigns ahead of the German elections⁠3. Separate reporting citing German officials named Kremlin-linked groups including the Social Design Agency in connection with the wider pressure on Germany's local elections⁠11. Taken together, the reports describe not a single video but a surrounding effort in which fakes, amplification networks and impersonated outlets reinforce one another⁠3⁠7⁠11. The full text of the Reuters dispatch was not available in excerpt form, so the precise wording of its security-source assessments cannot be reconstructed beyond that central warning⁠3.

Politico's analysis on 6 August captured why that warning landed with such force in Berlin⁠5. German fears of Russian election meddling were already rising, and the anxiety was not confined to social media. Politico also cited a drone packed with explosives found at Leipzig Airport as part of the uneasy atmosphere around this period⁠5. A physical security scare and a digital forgery campaign do not prove a single plan, but in public perception they combine into a broader sense of vulnerability that itself can be exploited⁠5. An electorate that expects interference may be less surprised by fakes and, paradoxically, more susceptible to them⁠5.

The public record of the exposure unfolded quickly. DW published its fact check on 3 August, documenting the 180 posts and the misuse of media branding⁠2⁠4. Reuters followed on 5 August with the security-source warning about stepped-up Russian activity⁠3. Politico analyzed the rising German fear on 6 August⁠5. Reports of the security services' attribution of the Merz video to a Russia-linked group followed on 7 August⁠8⁠9. EUobserver detailed the fake BBC-branded material on 11 August⁠10. ISD then published its broader investigation on 4 September, identifying the activity as part of a Kremlin-aligned operation aimed at regional elections⁠7.

What the evidence supports is substantial but bounded. It supports that fake videos targeting candidates circulated ahead of the September elections, that they misused DW and other media logos, and that German security sources and independent investigators assessed the activity as Russian-linked or Kremlin-aligned⁠2⁠4⁠7⁠10. It supports the election calendar and the four affected states⁠4⁠10. It also supports that German officials and analysts viewed this as part of a stepped-up pre-election pressure campaign rather than an isolated hoax⁠3⁠5⁠11. What the available sources describe as indicative, rather than conclusively proven in public, is the final step from Russia-linked infrastructure to direct state direction⁠2⁠4⁠7⁠10.

That distinction is not a technicality. Influence operations are designed to leave room for denial, using compromised or impersonated accounts, copied branding and cross-platform amplification that obscures the original author⁠7⁠10. The reuse of names such as Storm 1516, Storm-1679, Matryoshka and Operation Overload reflects how investigators cluster activity by behavior and infrastructure, not necessarily by a signed order from Moscow⁠6⁠9⁠7. For voters, the practical effect is the same whether the legal threshold for state attribution has been met. A fake resignation video in trusted branding can travel widely before fact-checkers, platforms or officials respond⁠4⁠8⁠9.

There is also much that the provided reporting does not establish and that should not be filled in from memory. The excerpts do not provide verbatim official Russian responses, nor do they document every narrative pushed by every fake account beyond the Merz resignation claim and the impersonation of DW, Handelsblatt and BBC-branded outlets⁠2⁠4⁠8⁠9⁠10. The core, sourced story is narrower and for that reason stronger. A large set of fakes was found, a chancellor was falsely shown resigning, trusted logos were stolen to sell the lie, and German and independent investigators traced the pattern to a familiar Russian-aligned network operating just before four Germans states voted⁠2⁠4⁠7⁠8.