The Russian Matryoshka bot network has launched a disinformation campaign focused on the June 29 assassination attempt against Ukrainian businessman Vadym Yermolaiev in Monaco. The Insider received the report from the Antibot4Navalny project, which tracks pro-Russian bot activity on social media.
Fake videos disguised as content from reputable Western media brands push a single narrative: the Security Service of Ukraine (SBU) is behind the bombing, and Yermolaiev was targeted because he allegedly planned to testify to Ukraine’s National Anti-Corruption Bureau (NABU) regarding the activities of Volodymyr Zelensky. While there is no evidence that Yermolaiev ever intended to cooperate with NABU, the bots repeat this fiction across videos as if it were a fact.
Key narratives of the campaign include:
- Monaco police chief Éric Arella (a real person who has headed the principality’s Public Security Department since September 2024) allegedly stated that “this is not the first time Zelensky has had his opponents killed in Europe.” Arella is quoted as saying that all killings in Europe since 2023 should be viewed “as a single series of crimes” perpetrated by Ukrainian intelligence services. However, there is no independent evidence suggesting that Arella actually said this.
- Polish intelligence allegedly shared data with Monegasque police “proving” the SBU’s involvement in the assassination attempt. The video claims that Poland’s Internal Security Agency announced this on June 30, and that Monaco police purportedly confirmed receiving the information. However, there is no independent evidence suggesting that this actually happened.
- Institute for the Study of War (ISW) president Kimberly Kagan (a real person, who is indeed the founder and head of ISW) allegedly called the assassination attempt “just the beginning of a series of terrorist attacks carried out by the Security Service of Ukraine.” Kagan is quoted as saying that European leaders are “in a corrupt collusion with Zelensky” and “have given him free rein.” However, there is no independent evidence suggesting that Kagan ever said anything of the sort.
- AI tools allegedly “confirmed” Zelensky’s involvement in the assassination attempt. A video attributed to Wired claims that the outlet’s “experts” fed Yermolaiev’s biography to chatbots: ChatGPT supposedly rated the probability of Ukrainian intelligence involvement at 98%, Grok at 99%, and DeepSeek at 100%. However, there is no independent evidence suggesting that Wired did anything of the sort.
- Politico editor-in-chief Jonathan Greenberger (a real journalist who heads the publication) allegedly called the assassination attempt “a slap in the face to Volodymyr Zelensky’s political partners.” Greenberg is quoted as saying that Zelensky “feels he is the top dog in Europe and no one will punish him for what he’s done.” However, there is no independent evidence suggesting that Greenberger said this.
- Bellingcat founder Eliot Higgins (a real person) allegedly stated that France was involved in the assassination attempt. A video under the investigative group’s brand claims that French security services “were responsible for smuggling in the explosives,” and that the perpetrator was “an agent of the Security Service of Ukraine who was subsequently evacuated.” Higgins is also quoted as saying that Yermolaiev “was privy to the corruption schemes involving the Ukrainian leader and Emmanuel Macron, which involved the laundering of money from military aid.” However, there is no independent evidence suggesting that Higgins or Bellingcat commented on the incident.
The Insider has links to the original posts and Antibot4Navalny materials confirming that the accounts that posted them belong to the Matryoshka network. The editorial team is not publishing direct links in order to avoid spreading the fakes.
What happened in Monaco?
On the evening of June 29, an explosion occurred in the entryway of a residential building on Rue Révérend Père Louis Frolla in Monaco, near the French border. An unknown individual left a bag containing an explosive device packed with bolts and buckshot at the entrance, then fled. Three people were injured, identified by French media as Yermolaiev himself, his female companion, and his 13-year-old son. The woman suffered serious injuries and was in critical condition; Yermolaiev was stabilized by medics relatively soon after the blast.
Monaco’s Attorney General, Stéphane Thibaut, described the incident as an attempted murder and said the suspect acted alone and remains at large. According to police, he fled to French territory through the border town of Beausoleil. His motive has not been established.
The Ukrainian businessman’s elder son, Artur Yermolayev, was convicted in Estonia this past April for organizing a network of fraudulent call centers that stole more than €100 million from citizens between 2019 and 2022. He reached a plea deal, paid €8.5 million, and left Estonia.
Vadym Yermolaiev himself is a native of Dnipro and founder of the Alef Corporation, one of the city’s largest developers. According to Yermolaiev himself, he renounced his Ukrainian citizenship and has held only a Cypriot passport since 2017. In December 2023, Zelensky imposed sanctions against him, and according to Ukrainian law enforcement, alcohol businesses linked to the businessman re-registered under Russian law after the occupation of Crimea and paid taxes to the Russian budget. Yermolaiev denied the allegation.
What is Matryoshka?
Researchers use the term “Matryoshka” to refer to a Russian cyberoperation involved in the mass spread of disinformation through a coordinated infrastructure of bots, trolls, and anonymous platforms. Its goal is to create artificial information noise and manipulate the perception of events both within Russia and abroad. The Antibot4Navalny project named the operation after the Russian nesting doll, as bots hide inside one another, and fakes spread in layers across different platforms, making the source difficult to trace.
The mechanism operates in two directions. The first is the creation of large numbers of fake profiles that pose as ordinary people, independent media outlets, or think tanks. These accounts generate dozens of posts daily, mimicking local speech patterns. The second is the simultaneous release of identical content across social media. To appear credible, the bots use the logos of well-known Western publications and human rights organizations.
