While no definitive link to the Russian state has yet been established, there is evidence that Russian-speakers are behind some of the posts, according to Maristany de las Casas. For example, a Spanish-language post on X was found to contain a revealing clue: The post, which targeted candidates Lydia Hüskens and Andreas Silbersack of the Free Democratic Party (FDP), abbreviated their party's name as "SvDP," which would be the Russian version: Svobodnaya Demokraticheskaya Partiya.

The OSINT research group Gnida Project, which investigates Russian disinformation campaigns, has previously linked Matryoshka to Russian actors. According to its findings, the operation is technically and operationally connected to Storm-1516, a well-known unit reportedly controlled by Russia's military intelligence agency, the GRU, and which was also active in the lead-up to Germany's federal election in 2025.