A new report reconstructs the objectives, the methods and actors of this network behind the most viral hoaxes against Ukraine

This article was originally published on Facta on May 12th 2025

For the last year and a half, the pro-Russian disinformation operation “Storm-1516” has been spreading false information on the Internet to attack Ukraine and its allies, discredit Vladimir Putin’s political opponents, and try to undermine the electoral process in countries deemed “enemies” by the Kremlin.

This operation was first identified in December 2023 by the interdisciplinary team of researchers at the Media Forensics Hub (Clemson University, South Carolina, USA), which focuses on studying and combating online disinformation. Later, Microsoft’s Threat Analysis Center named it “Storm-1516”. Across continents, this network is known to be among those responsible for the most viral hoaxes against Ukrainian President Volodymyr Zelensky and his family as well as other prominent progressive politicians in Europe and the US. Through this operation, various misleading stories have reached millions of views on social media in several countries, influencing public debate as they were sometimes relaunched by Western politicians (especially far-right), unwittingly or opportunistically.

Facta has repeatedly exposed such fake news and reported on the existence of this disinformation network. Now, a report released on May 6th by Viginum ー a French public service of vigilance and protection against foreign digital interference, formed by a collective of specialists ー describes in detail how Storm-1516 works: its objectives, its complex methodology and the actors involved. In light of what has emerged, this disinformation operation can be considered a significant threat to the European digital public debate.

The objectives

The main goal of Storm-1516 is to discredit the Ukrainian government in the eyes of Western public opinion. But not only. Also, as Viginum’s analysis reads, the goal is to undermine European public support for military and economic assistance, provided to Ukraine to counter the Russian invasion of the country.

To achieve this, various false narratives against Ukraine were circulated on the Internet and social media, spread in several languages. One of these false stories claimed that the Ukrainian government would support terrorism by recruiting members of the Islamic State to fight in Ukraine, or by organising joint training between members of the Palestinian extremist group Hamas and the Ukrainian Azov battalion.

Of course, many of these fabricated reports have targeted Ukrainian President Volodymyr Zelensky, alternately accused of being a neo-Nazi ー following Kremlin’s propaganda that portrays Ukraine’s ruling politicians as supporters of Nazi ideology ー, a drug addict, a homosexual; but also of privately criticising the leaders of major countries that provide aid to Ukraine, or of having enriched himself with Western financial aid to the extent that he could afford to buy villas, yachts and hotels around the world. One of these false stories ー the one about the two million-dollar yachts purchased by Zelensky ー was also relaunched in 2023 by two Republican US Senators: Trumpian Congresswoman Marjorie Taylor Greene ー who in the past has subscribed to various conspiracy theories ー and J. D. Vance (now US Vice President). Also at that time, Vance was among those Republican Congressmen who voted against an aid package for Ukraine on December 6th, 2023.

People from the Ukrainian president’s entourage and his family were not spared. Olena Zelenska, Zelensky’s wife, was falsely accused by this disinformation network of buying jewellery and luxury cars with the financial aid going to Ukraine, but also of trafficking Ukrainian children through her foundation, which was established in September 2022 with the mission of helping people affected by the war in Ukraine. Also Facta has dealt with several fake news as such, as they reached Italian social media.

Similarly, Western politicians, personalities and governments were also attacked, especially during election periods. In the run-up to the 2024 US presidential election, won by Donald Trump against Kamala Harris, Storm-1516 circulated various conspiracy theories and fake news to discredit the electoral process and prominent figures of the Democratic Party, such as Barack Obama. In a fake audio generated with artificial intelligence, the former US president could be heard claiming that the US Democratic Party was behind the attempted assassination of Trump on Saturday July 13th 2024, during a rally in Butler, Pennsylvania.

In another case, Democratic presidential candidate Kamala Harris and vice presidential candidate Timothy Waltz were respectively accused not only of causing serious traffic accidents to then flee, but also of committing sexual assault. Storm-1516 also promoted specific pro-Trump messages, spreading for instance the false testimony of an African-American woman, alleged Trump supporter, thanking the Republican candidate for his financial support to the Dana-Farber Cancer Institute in Boston. In reality, this support had never been handed out.

Storm-1516 did not spare the European Union either, concentrating its forces on producing viral disinformation on divisive or anxiety-provoking topics related to immigration and terrorism, particularly in the run-up to major events, such as last summer’s Paris Olympics and the European Parliament elections in June 2024, the French early parliamentary elections in July 2024, and the German federal elections in February 2025. Viginum’s report highlights at least 20 operations whose purpose was to denigrate a candidate in national elections, to support candidates and parties favourable to the interests of the Russian government and its “anti-system” positioning, or to question the conditions and integrity of the vote.

For instance, a recent journalistic investigation by the German fact-checkers Correctiv (reported on Facta) has shown that Storm-1516 was behind a disinformation operation that created 一 with the help of artificial intelligence as well 一 more than 100 fictitious German-language websites. The aim was to spread false and unfounded news and to discredit several German politicians. These fake sites, which presented themselves as real newspapers, were used to spread completely unfounded information such as the false story that Green Party candidate Robert Habeck had abused a young woman years ago. Marcus Faber, head of Germany’s parliamentary defence committee and a staunch supporter of Ukraine, was instead accused of actually being a Russian secret agent. In this case, the fake news was spread with a deepfake video that digitally recreated the image of a former defence policy advisor at the MP’s office, who appeared to make the revelation in front of a camera. Such disinformation content was then circulated on social media by several pro-Russian influencers active in Germany.

Storm-1516 has also been used to denigrate the Russian political opposition. In February last year, disinformation actors circulated a false story on Yulia Navalnaya, wife of Alexei Navalny, Putin’s most notorious political opponent who died on 16 February 2024 in a maximum-security prison in Siberia. According to this false story, Yulia Navalnaya allegedly had extramarital affairs with powerful men and journalists in order to obtain «material and informational support» for FBK, the anti-corruption foundation founded in 2011 by her husband.

Researchers at Viginum claim that all this aspects «demonstrates the responsiveness of Storm-1516 operators, and their ability to adapt their narratives to various political contexts».

How it works

This disinformation network uses «a wide range of content to broadcast their narratives, including photo and video montages, fake news reports, videos and audios very likely generated using generative artificial intelligence (AI) tools, and videos likely involving amateur actors. This content includes texts and voices in French, English, Ukrainian, German, Spanish and Arabic languages», Viginum explains.

Last October, relying on more than 150 pages of documents from a European intelligence service, the Washington Post revealed that the Russian military intelligence service (GRU) had helped one of the operators linked to Storm 1516 to obtain artificial intelligence tools used to generate texts, photos, and videos. Several contents disseminated by this disinformation operation were in fact generated with these very tools.

To enhance its narratives’ credibility, Storm-1516 also relies on video/photo editing techniques to counterfeit media logos, film posters, public records, government documents, invoices, press articles and social media screenshots. «These methods have mainly been used to try and prove the existence of compromising expenses and financial transactions, potentially relying on photos of original documents obtained online», the report states.

In July 2024, a false (viral) report claimed that Zelensky’s wife Olena Zelenska had bought a Bugatti supercar for USD 4.5 million during a trip to France. An invoice for the purchase was provided as proof. As later confirmed at the time by the French car manufacturer itself, the invoice was a forged document.

To make these fake news more credible, amateur actors have been also involved. Viginum  «estimates that for more than half of the operations attributed to Storm-1516, its operators have recruited individuals to record voiceovers, act as whistleblowers, or participate in staged events. Although they often appear in disguise and in poor quality videos, several factors suggest that the actors are recruited both in Russia and abroad».

In October 2023 a viral video on social media showed a woman identifying herself as a Cartier employee at a jewellery store in New York, where the woman claimed that Olena Zelenska had purchased goods worth more than USD 1 million. The story was completely made up and, as reconstructed by several fact-checker sites, the woman pictured in the video did not live in the United States, had never worked for Cartier, but resided in Russia.

Moreover, those running this disinformation network seem to have paid particular attention to the selection of these actors, adapting their language or physical appearance to suit different narratives. Indeed, the report points out that «the video accusing Ukraine of recruiting Islamic State fighters included a voiceover recorded by an Arabic-speaking individual, while the one accusing President Zelensky of buying cocaine in Argentina involved a Spanish-speaking narrator».

The dissemination techniques

Viginum identified three different techniques used by Storm-1516 to disseminate and make the content produced go viral.

The first of these techniques, which is the most widely used, involves the use of “disposable” accounts, i.e. anonymous profiles created specifically for these disinformation operations. Analysts point out that although journalistic investigations have unmasked the falsity of these accounts, few of them have been suspended from social platforms since then.

Over time, Storm-1516 operators tried to make these fake accounts more credible by activating them and having them share legitimate articles or posts long before the disinformation operation began.

Analysts cite the case of the fake news story according to which Zelensky and George Soros, the entrepreneur and philanthropist at the centre of various conspiracy theories, were planning to bury toxic waste in Ukraine. This unfounded story was based on a YouTube account and an X account belonging to a certain “Jules Vincent”, who presented himself as a French-speaking “freelance journalist” focusing on environmental issues. «The X account linked to this fake whistleblower, created in September 2018, began sharing and publishing content on environmental topics from 15 November 2023, sometimes in an approximate

French. When the video containing the main narrative was published on YouTube on 27 November, it displayed a link to the X account of “Jules Vincent,” which then shared the video, thanking in particular the pro-Russian French-speaking account @BPartisans for relaying the narrative. The X account continued to share publications on environmental issues until early December, when it was gradually abandoned», reconstructed Viginum.

This method is particularly deceptive, as Facta had analysed in detail in this investigation, reporting on several other examples in which false whistleblowers or alleged direct witnesses had been used. Indeed, this deception grants these false stories a certain credibility, and it is specifically useful because it makes them perceived as unrelated to the partisan interests that the public generally links to political groups or the so-called “mainstream media”.

The second technique, used increasingly since March 2024, involves the use of social media accounts and third-party news sites.

In particular, Viginum’s report states, false narratives «were initially-posted on social media accounts (X, Telegram and Rumble) linked to pro-Russian media and influencers, including French-speaking ones. For example, the video accusing Leonid Volkov (editor’s note, a Russian politician and activist who collaborated with Navalny and was brutally attacked by two men last year in Lithuania where he lives in exile) of selling Ukrainian refugees to prostitution rings in Europe was initially broadcast by the X account of Adrien Bocquet, a former French serviceman exiled in Russia». Last April, Bocquet spread false accusations to blame the Ukrainian army for the massacre of civilians in Bucha, which occurred during the Russian occupation of the Ukrainian city.

Storm-1516 operators mainly target social personalities or broadcasters that politically subscribe to the message of the content created. Viginum’s analysis thus revealed that the network relied on pro-MAGA American influencers in the run-up to the US presidential elections, and on German-speaking accounts to target the German parliamentary elections. In the latter case, for instance, the first to share the fake news created by this network were German accounts known to share disinformation and pro-Russian propaganda such as Michael Wittwer, a former candidate of the right-wing extremist party Pro Chemnitz, the pro-Russian activist Jovica Jović, and Alina Lipp, a pro-Russian influencer who runs a Telegram channel of over 180,000 subscribers.

According to Viginum, it is likely that the individuals and media involved were paid by Storm-1516. In November 2024, the report specifies, «the administrator of the X account that initially broadcasted the video claiming that Haitians were voting illegally in the United States admitted having been paid 100 dollars for the publication by Simeon Boykov, who is directly involved in Storm1516 operations».

The latest technique used is the dissemination of social media accounts or sites belonging to the “CopyCop” network, administered by John Mark Dougan. The man is a former US Marine who has been living in Russia since 2016 in order to escape an FBI investigation against him. From there, he spreads fake news about the war in Ukraine with the aim of discrediting the Ukrainian government and its military in the eyes of international public opinion, by relying on a series of fake news sites, such as DC Weekly, Chicago Chronicle and Atlanta Observer.

The report states that CopyCop’s fake news websites were mainly used in initial dissemination, targeting French, American and, more recently, German audiences: «These sites, of which there are estimated to be more than 290 in total, are mainly fed by press articles rephrased using generative artificial intelligence tools, and some use the names of former local newspapers in order to lend credibility».

Who is behind it

Based on open source intelligence data, Viginum’s investigation confirmed the involvement of individuals and organisations close to the Russian government.

Among the names mentioned there is John Mark Dougan, who according to the researchers is responsible for the registration and management of the “CopyCop” infrastructure and may also be involved in the production of the narratives and content used for Storm-1516 operations.

Further analysis of this disinformation network’s operations have also found that they are almost systematically amplified by influencers linked to organisations linked to Evgenij Prigozhin, a politician and former commander of the private military company Wagner. Prigozhin is known to have died in 2023 in Russia in the crash of his plane, a few months after leading a brief uprising against the Kremlin, after having been a close Putin ally for years. When alive, he was linked to the Internet Research Agency (IRA), a Russian company founded in 2013 and engaged in online propaganda operations on behalf of Russian companies and Kremlin political interests. In 2016, for example, the IRA had created and disseminated a disinformation campaign with the aim of damaging Hillary Clinton’s presidential campaign and supporting Donald Trump, as stated in the investigations by the US Senate Intelligence Committee into that year’s US elections.

In fact, the most active profiles were found to belong to an inner circle of American, German, Finnish and Dutch influencers spreading fake news to a pro-Russian audience in different languages, linked to the Russian Foundation to Battle Injustice (R-FBI) 一 a foundation set up by Prigozhin in 2021 to document alleged “human rights violations” in Western countries一, and to the ‘BRICS Journalists’ Association’ (BJA), which also depends on the R-FBI. «Both organisations are said to be managed by Oksana Vovk, a Russian national who was imprisoned for two years in the United States for money laundering, and who now acts under the name Mira Terada», the report specifies. As Facta reported last November, a recent investigation by The Daily Beast revealed that Mira Terada is following Prigozhin’s footsteps, pulling the strings of a vast Russian disinformation operation in the West with links to Kremlin intelligence. With Mirada, John Mark Dougan himself has also collaborated on several occasions.

Finally, Russian individuals and organisations linked to Alexander Dugin also appear to be involved. Dugin is an extreme right-wing Russian imperialist ideologue politically close to Russian President Putin, and sanctioned by the European Union in October 2022 for advocating policies and implementing actions that threatened Ukraine’s territorial integrity, sovereignty and independence. Specifically, Viginum noted that foreign individuals linked to Dugin took part in Storm-1516 operations; among these names there are Raphael Machado and Lucas Leiroz, respectively president and member of the Brazilian far-right organisation Nova Resistência, close to the Russian philosopher.

The Storm-1516 network, the report concludes, could potentially be coordinated by a Russian intelligence service. According to documents from a European intelligence service obtained by the Washington Post, Yury Khoroshenky allegedly financed and coordinated Storm-1516 operations from its beginning.

According to these reports, Khoroshenky is actually an officer of Russian Military Intelligence Unit (GRU) 29155. «This “direct action” unit has publicly and historically been linked to sabotage operations, assassination attempts, the distribution of bounties for the death of NATO soldiers in Afghanistan, attempted coups in Europe, espionage operations and digital sabotage», Viginum’s report states. At the moment, Viginum is unable to confirm the direct involvement of Khoroshenky or GRU Unit 29155 in the handling of Storm-1516. However, further investigations conducted by the French service have revealed close links between the man in question and the ecosystems mentioned above.