Storm-1516: Exposure of Russian disinformation network creating fake videos to undermine Ukraine aid in 2024

The Fugitive in the Machine

John Mark Dougan is the central node in the most Russian disinformation campaign of the Ukraine war. A former deputy with the Palm Beach County Sheriff’s Office in Florida, Dougan fled the United States in 2016 to escape 21 state charges related to extortion and wiretapping. He surfaced in Moscow where he was granted asylum and eventually citizenship. Intelligence assessments from Microsoft, Clemson University, and the French agency VIGINUM identify Dougan not as a participant as the primary conduit for “Storm-1516,” a Kremlin-aligned influence operation designed to Western support for Kyiv.

Dougan operates a network of over 160 fake news websites that mimic legitimate local American and European publications. This infrastructure, dubbed “CopyCop” by researchers, launders narratives crafted by Russian military intelligence (GRU) into the Western media ecosystem. The operation relies on a specific technical architecture: a server cluster in Moscow hosting dozens of domains like DC Weekly, Chicago Chronicle, and Atlanta Observer. These sites publish thousands of AI-generated articles daily to build a veneer of legitimacy. Buried within this volume are targeted fabrications designed to go viral.

The “BadVolf” Transformation

Dougan’s trajectory from Florida law enforcement to Moscow propagandist began with a hacking scandal. In 2016, the FBI raided his home after he released the home addresses of thousands of law enforcement officers and judges under the pseudonym “BadVolf.” He fled to Russia via Canada using a disguise. Once in Moscow, his skillset, understanding American police procedure and Western media consumption, became a valuable asset to the GRU.

Documents reviewed by European intelligence services in 2024 linked Dougan directly to Yury Khoroshenky, an officer in GRU Unit 29155. This unit oversees sabotage and political interference operations. The relationship provided Dougan with funding and technical resources to his “CopyCop” network. Unlike traditional state media outlets like RT or Sputnik which face bans and labeling, Dougan’s sites appear to be independent American outlets. This camouflage allows his content to bypass social media filters and reach audiences who would otherwise reject Russian state propaganda.

Operational Mechanics: The Narrative Laundering pattern

The Storm-1516 network employs a consistent “narrative laundering” technique to inject falsehoods into the American political debate. The process follows a distinct kill chain designed to obscure the Russian origin of the information.

Table 1. 1: The Storm-1516 Narrative Laundering Chain

Stage	Action	Example method
1. Placement	The fabrication is planted on a “burner” social media account or a fringe YouTube channel.	A video featuring a paid actor posing as a “whistleblower” (e. g., a Cartier store employee).
2.	A Dougan-controlled site picks up the story, citing the burner account as a primary source.	DC Weekly publishes an exclusive report titled “Zelenska’s Million Dollar Shopping Spree.”
3. Integration	Western influencers and politicians share the DC Weekly article, treating it as a verified report.	US Congress members or verified X (Twitter) users share the link to against aid bills.
4. Amplification	Russian state media (RIA Novosti) reports on the Western reaction, completing the pattern.	“Americans outraged by Zelensky corruption,” citing the US politicians.

This method proved devastatingly in late 2023 and throughout 2024. The network’s primary objective was to synchronize these releases with serious votes on Ukraine aid packages in the US Congress. By creating the perception of rampant corruption within the Zelensky administration, Dougan’s network provided the rhetorical ammunition needed for isolationist factions to delay or block funding.

Case Study: The Cartier and Bugatti Fabrications

Two specific operations illustrate the reach of Dougan’s network. In October 2023, DC Weekly published a story alleging that Ukrainian Lady Olena Zelenska spent $1. 1 million at a Cartier store in New York City while her husband appealed to the UN for aid. The story relied on a fake Instagram video from a user named “gorgeous_bb_gucci,” who claimed to be an intern at the store. The receipt displayed in the video was a crude forgery. Yet the story was shared widely on X, garnering millions of views and citations from high-profile American political figures.

In July 2024, the network launched a similar fabrication via a French-language site Verité Cachée (Hidden Truth), another Dougan asset. This story claimed Zelenska purchased a Bugatti Tourbillon for €4. 5 million. The report featured a deepfake video of a supposed Bugatti employee. Bugatti officially denied the sale, and the “employee” was identified as an AI construct. even with the debunking, the narrative had already saturated right-wing echo chambers in the US and Europe, reinforcing the “corrupt Ukraine” frame.

The “CopyCop” Infrastructure

The of Dougan’s operation is defined by its automated volume. Researchers at Clemson University’s Media Forensics Hub identified over 160 domains linked to the same IP addresses and Google Analytics codes. These sites use generic names to sound like historical local newspapers.

“The organization is a façade… made to look like a Russian version of Amnesty International or Human Rights Watch, in fact, it seems created primarily to offer legitimacy to Russian propaganda.” , Clemson University Media Forensics Hub Report, November 2024.

The content on these sites is largely scraped from legitimate sources like the BBC or CNN, rewritten by AI tools to avoid copyright strikes. This “filler” content comprises 90% of the site’s output. The remaining 10% consists of the targeted disinformation. This ratio tricks search engine algorithms into indexing the sites as legitimate news sources. When a user searches for the fake story, they find a site that appears to have a long history of publishing normal news, increasing the likelihood of deception.

Targeting the 2024 Election

As the 2024 US presidential election method, Dougan’s network pivoted from purely anti-Ukraine narratives to direct election interference. In late 2024, the network circulated a fake video accusing Vice Presidential candidate Tim Walz of sexual misconduct. The video, which received nearly 5 million views on X in 24 hours, was traced back to Dougan’s infrastructure by Microsoft’s Threat Analysis Center. The “victim” in the video was non-existent, and the narrative bore the hallmarks of previous Storm-1516 operations: a sensational claim, a “whistleblower” video, and immediate amplification by a ring of coordinated accounts.

The European Union sanctioned Dougan in December 2025, citing his role in “destabilizing European governments” and operating the CopyCop network. Dougan responded with defiance, stating on Telegram that he did nothing “expose lies.” His continued operation from Moscow highlights the difficulty of countering disinformation when the operator resides in a protected jurisdiction, funded by a state intelligence service, and utilizes the open infrastructure of the Western internet to wage information warfare.

The Architecture of Deceit: Inside the Laundromat

The operational success of Storm-1516 relies on a sophisticated three-stage method researchers call the “disinformation laundromat.” Unlike the blunt-force trolling of 2016, this system is designed to wash the Russian origin out of a narrative before it reaches Western audiences. The goal is to convert an obvious lie into a source that looks like a legitimate American news report, making it safe for domestic political actors to share.

The process begins with “The Injection.” Russian operatives create a primary source artifact, a video featuring a fake whistleblower. These videos are low-budget productions, frequently filmed on smartphones, featuring actors who claim to be disgruntled employees or insiders. In the case of the “Olena Zelenska Cartier” hoax, the operative was a young woman speaking heavily accented English, claiming to be an intern at the Cartier mansion in New York City. She displayed a forged receipt as proof of a million-dollar purchase. Facial recognition analysis later identified the woman not as a New York intern, as a resident of St. Petersburg, Russia.

The Wash pattern: DC Weekly and the Fake Local News

Once the video exists, it is not simply posted to Twitter where it might be ignored. It is “washed” through a network of websites designed to mimic local American journalism. The flagship of this fleet in 2023 and 2024 was DC Weekly. To the casual observer, DC Weekly appeared to be a standard news aggregator covering Washington politics. It featured a generic layout, weather widgets, and hundreds of real articles scraped from legitimate sources like the Washington Post or The Hill.

The site’s operators, identified by Microsoft and Clemson University as linked to John Mark Dougan, use artificial intelligence to rewrite legitimate news stories to populate the site. This creates a “content camouflage.” When the disinformation piece is inserted, such as the fake story titled “Olena Zelenska Spends $1. 1 Million on Cartier Jewelry”, it sits alongside real news, gaining unearned credibility. The article was bylined by “Jessica Devlin,” a supposed foreign correspondent. Investigations revealed that “Jessica Devlin” did not exist; her profile photo was stolen from Judy Batalion, a real Canadian author.

Anatomy of a Storm-1516 Laundering Operation

Stage	Action	Platform/Vehicle	Goal
1. Injection	Staged video by “whistleblower”	YouTube / Telegram (Burner Accounts)	Create a primary source artifact.
2.	Article citing the video	DC Weekly / Chicago Chronicle	Grant journalistic veneer (The “Wash”).
3. Amplification	Bot swarms & “Blue Check” influencers	X (Twitter) / Facebook	Force the story into trending topics.
4. Legitimation	Citation by US political figures	Podcasts / Congressional Debate	Weaponize narrative against aid bills.

From Moscow to Main Street

The third phase is “Amplification.” Once the DC Weekly link is live, the network activates a swarm of social media accounts to spread it. In the Cartier case, the story was pushed by a small Nigerian outlet, The Nation, a frequent intermediate hop for Russian narratives, before being out by thousands of bots on X (formerly Twitter). The narrative was specifically engineered to trigger outrage among American taxpayers: the claim that while Congress debated sending $60 billion to Ukraine, the Ukrainian Lady was shopping for luxury jewelry on Fifth Avenue.

The timing was precise. The fake receipt was dated September 22, 2023. Public flight records and diplomatic schedules confirmed that on that specific day, Olena Zelenska was in Ottawa, Canada, accompanying her husband for an address to the Canadian Parliament. She was physically 350 miles away from the New York Cartier store. Yet, the truth was irrelevant to the velocity of the lie.

The Capitol Hill Connection

The final stage is “Legitimation,” where the laundered disinformation enters the American political bloodstream. The Cartier story and similar fabrications, such as the debunked claim that President Zelensky purchased two luxury yachts named “Lucky Me” and “My Legacy”, were rapidly adopted by high-profile American influencers. Accounts with millions of followers, including political commentators like Jackson Hinkle and Gunther Eagleman, shared the DC Weekly links or the underlying claims without verification.

This content did not stay on social media. It migrated to the halls of Congress. During the contentious debates over the 2024 Ukraine aid package, the narrative of “Ukrainian corruption” became a central talking point for the isolationist wing of the Republican party. While few Senators DC Weekly by name, the specific allegations fabricated by the network, luxury purchases, yachts, and skimming of US aid, were repeated in committee hearings and floor speeches. Senator Thom Tillis (R-NC) became one of the few lawmakers to explicitly call out the network, warning his colleagues in a closed-door briefing that the “yacht” and “shopping” stories were direct products of Russian intelligence designed to kill the aid bill.

The effectiveness of the Disinformation Laundromat lies in this separation. A Congressman does not need to retweet a Russian bot. He only needs to read a tweet from an American influencer who read a blog post from DC Weekly that a video from a fake whistleblower. By the time the narrative reaches the Congressional Record, the Russian fingerprints have been scrubbed clean.

“The goal is not to convince you that the lie is true. The goal is to make you doubt that the truth exists. When a fake story about yachts delays a funding bill by three months, the operation is a strategic military success.”
, Dr. Darren Linvill, Clemson University Media Forensics Hub

Fabricated Luxury: The Cartier and Bugatti Operations

The Storm-1516 network deploys a specific sub-genre of disinformation focused on “lifestyle” narratives. Unlike complex geopolitical forgeries, these operations rely on simple, emotionally charged accusations of greed. The objective is to sever the psychological bond between Western taxpayers and the Ukrainian leadership by portraying the latter as corrupt oligarchs. Two specific case studies, a fake jewelry spree in New York and a non-existent hypercar purchase in Paris, illustrate the forensic fingerprints of this machine.

Case Study 1: The Million-Dollar Cartier Receipt (September 2023)

In late September 2023, a video surfaced on Instagram from an account named `@gorgeous. bb. jeanette`. The user, posing as a former intern at a Cartier boutique in New York City, claimed she was fired after Olena Zelenska, the Lady of Ukraine, insulted her during a shopping trip. The “intern” displayed a receipt totaling $1. 1 million for jewelry purchases. Forensic analysis by the Center for Countering Disinformation and Clemson University’s Media Forensics Hub exposed the document as a crude forgery. The receipt was dated September 22, 2023. On that specific day, Olena Zelenska was in Ottawa, Canada, appearing publicly at the Canadian Parliament with Prime Minister Justin Trudeau. She had left the United States the previous day. Further scrutiny revealed structural flaws in the forged evidence. The item numbers listed on the receipt began with “CRH,” a format inconsistent with Cartier’s actual inventory codes, which start with “H” followed by digits. The “intern” herself was identified not as a New York resident, as a salon manager living in St. Petersburg, Russia. The amplification pathway followed the standard Storm-1516 protocol. The narrative did not start on a Russian state outlet appeared as a paid placement in The Nation, a legitimate Nigerian newspaper. From there, it was laundered through John Mark Dougan’s network of fake local news sites, including DC Weekly, before reaching X (formerly Twitter), where accounts like `@Megatron_ron` generated millions of views.

Case Study 2: The Bugatti Tourbillon Deepfake (July 2024)

On July 1, 2024, the network launched a second high-value luxury hoax. A French-language website named Vérité Cachée (Hidden Truth), registered only days earlier, published an article claiming Zelenska had become the owner of the new Bugatti Tourbillon, priced at €4. 5 million. The story included a video of a man identifying himself as “Jacques Bertin,” a supposed employee of the Bugatti dealership in Paris. This operation utilized generative AI. Deepfake detection tools confirmed the “Jacques Bertin” video was AI-generated, using a stock photo as a base for the avatar. No employee by that name existed at the dealership. The accompanying invoice contained multiple errors, including the misspelling of the car model as “Turbillon” and the incorrect address for the dealership in Neuilly-sur-Seine. Bugatti Automobiles S. A. S. issued an immediate denial, threatening legal action for criminal forgery. even with this, the narrative was instantly amplified by Russian state media agency RIA Novosti and spread to the US via Dougan’s “CopyCop” network. On X, the story was promoted by Jackson Hinkle and other pro-Kremlin influencers, accumulating over 12 million views within 24 hours.

Forensic Analysis of Storm-1516 Forged Documents

Feature	Cartier Receipt (2023)	Bugatti Invoice (2024)
Date of Document	September 22, 2023	June 7, 2024
Target Location	New York City, USA	Paris, France
Actual Location of Target	Ottawa, Canada (Official Visit)	Kyiv, Ukraine / Normandy (D-Day)
Primary Error	Physical impossibility (wrong country)	Spelling (“Turbillon”), Fake Address
Source Persona	“Jeanette” (St. Petersburg resident)	“Jacques Bertin” (AI Deepfake)
Laundering Point	The Nation (Nigeria)	Vérité Cachée (France)

The operational tempo of these hoaxes suggests a shift in Russian military intelligence tactics. Rather than relying solely on hacked documents, the GRU manufactures “whistleblowers” using low-cost digital actors. The Cartier and Bugatti cases demonstrate that verification of physical location and cross-referencing of inventory codes remain the most methods for debunking these fabricated luxury narratives.

The Highgrove House deception stands as a textbook case study in the Storm-1516 operational playbook. It illustrates the network’s shift from vague political rumors to specific, falsifiable narratives anchored in fabricated “evidence” and non-existent whistleblowers.

The Seed: “Sam Murphy” and the YouTube Fabrication

The campaign began on March 31, 2024, not on a news site, on a YouTube channel created just weeks earlier in February. A video featured a man identifying himself as “Sam Murphy,” a supposed real estate agent. Speaking with an accent that fluctuated and facial movements characteristic of deepfake software, “Murphy” claimed to have insider knowledge of a £20 million ($25 million) sale of Highgrove House, King Charles III’s private country residence, to Volodymyr Zelensky. To lend credibility to the lie, the video six anonymous “former employees” allegedly fired after the sale. It also referenced Grant Harrold, the King’s former butler. The script claimed Harrold confirmed the transaction details were finalized during Olena Zelenska’s visit to the UK on February 29, 2024.

The Incubator: The London Crier

Within 48 hours, the narrative moved from YouTube to The London Crier, a website designed to mimic a legitimate British local newspaper. Domain registration records show The London Crier was registered on March 26, 2024, just five days before the “Sam Murphy” video aired. The site published an article titled “Zelenskyy acquires Highgrove House, Former Residence of King Charles, for £20M.” The byline belonged to a non-existent journalist. The text did not cite official land registry documents instead the “Sam Murphy” video as its primary source. This circular sourcing is a hallmark of John Mark Dougan’s “CopyCop” network: a fake video validates a fake article, which is then used to validate the video.

The Spread: Automated Amplification

Once the article appeared on The London Crier, the Storm-1516 distribution activated.

Phase	Action	Key Actors	Reach Metric
Injection	YouTube video upload	“Sam Murphy” Channel	< 300 subscribers initially
Legitimization	Article publication	The London Crier	Indexed by search engines
Amplification	Mass social sharing	X (Twitter) Bots, Telegram Channels	~15, 000 reposts in 24h
Official Endorsement	Diplomatic sharing	Russian Embassy in South Africa	Global diplomatic audience

Russian state media outlets, including Pravda and Izvestia, picked up the story, citing The London Crier as a “British news outlet.” The Russian Embassy in South Africa shared the claim on X, giving it diplomatic weight. The narrative targeted specific audiences: UK taxpayers were told their money was funding foreign luxury, while Ukrainian citizens were told their leader was preparing for exile.

The Debunk: Reality vs. Fiction

The fabrication collapsed under basic scrutiny. * Land Registry: The UK Land Registry lists Highgrove House as property of the Duchy of Cornwall. Prince William, not King Charles, has held the title since the King’s accession in 2022. No sale record exists. * Grant Harrold: The former butler publicly denied the interview. His spokesperson stated, “This story is completely false and Grant has made no comment on this.” * Visual Evidence: Experts identified the “Sam Murphy” avatar as an AI-generated construct, noting unnatural eye blinking patterns and audio-visual sync errors common in low-cost deepfakes.

Connection to Storm-1516

This operation fits the exact fingerprint of John Mark Dougan’s network. The IP address history of The London Crier overlaps with other known Storm-1516 assets like DC Weekly and The Chicago Chronicle. The “Sam Murphy” video uses the same AI voice generation tools found in the network’s previous attacks on Olena Zelenska regarding alleged jewelry purchases in New York. The Highgrove House lie demonstrates the network’s reliance on “firehose” tactics: produce high volumes of fake content, launder it through look-alike western sites, and rely on partisan outrage to bypass fact-checking. Even after debunking, the story in closed Telegram groups and on platforms with lighter moderation, continuing to serve its purpose of eroding trust in Ukraine aid.

The Cameo Trap: Weaponizing Celebrity Messages

In July 2023, the Storm-1516 network initiated a psychological operation that Microsoft’s Threat Analysis Center (MTAC) later identified as a shift from text-based disinformation to “malign influence” via video. Operatives exploited Cameo, a platform where users pay celebrities for personalized video messages, to trick prominent American figures into recording statements that were subsequently weaponized against Ukrainian President Volodymyr Zelensky. Russian agents, posing as fans, solicited messages for a recipient named “Vladimir,” asking the celebrities to offer encouragement for someone struggling with substance abuse. The celebrities, unaware of the political context, recorded empathetic messages telling “Vladimir” to “get help” or “stop the madness.” Storm-1516 technicians then edited these clips, adding emojis, captions, and the logos of mainstream media outlets like TMZ or Reuters to frame the messages as direct pleas to Zelensky regarding an alleged cocaine addiction. Verified of the Cameo Campaign (July, September 2023): * Elijah Wood: The Lord of the Rings actor was paid to record a message saying, “I hope you get the help that you need.” The video was circulated on Russian Telegram channels with captions falsely contextualizing it as an intervention for Zelensky. * Mike Tyson: The former heavyweight champion recorded a message urging “Vladimir” to stop his “madness,” which Russian state media recontextualized as a critique of Zelensky’s war conduct. * Priscilla Presley: Tricked into sending a message about addiction recovery. * Dean Norris: The Breaking Bad actor provided a similar message, which was later watermarked with fake media branding. * Kate Flannery: The The Office actress was also targeted. * Shavo Odadjian: Bassist for System of a Down. * John C. McGinley: The Scrubs actor’s video was used to support a fabricated narrative that Zelensky was entering rehab. Microsoft reported that these videos were widely disseminated through pro-Russian social media ecosystems, marking a tactical evolution: rather than creating fake people, Storm-1516 manipulated real, trusted voices to validate Kremlin narratives.

The “Olena Bugatti” Deepfake (July 2024)

While the Cameo campaign relied on decontextualization, Storm-1516 also deployed advanced artificial intelligence to manufacture events entirely. In July 2024, the network launched a viral hoax claiming Lady Olena Zelenska purchased a Bugatti Tourbillon for €4. 5 million during a diplomatic visit to Paris. * The Asset: The campaign released a video featuring a man identifying himself as “Jacques Bertin,” an employee of the Bugatti dealership in Paris. * The Fabrication: “Bertin” claimed Zelenska had viewed the car two weeks prior and became its owner. The video was accompanied by a forged invoice. * The Debunking: Analysis by CBS News and other forensic experts determined the “Jacques Bertin” video was a deepfake created using AI. The subject’s facial movements, particularly the absence of blinking and unnatural head positioning, were consistent with generative AI avatars. * The: The real Bugatti Paris dealership issued a statement confirming the invoice was fake, noting incorrect prices and missing legal details, and filed a criminal complaint for forgery and identity theft. even with the debunking, the narrative generated millions of views on X (formerly Twitter) and Telegram, specifically targeting right-wing American audiences to characterize US aid as funding the Zelensky family’s luxury lifestyle.

The “Hamas Olympics” Video (2024)

In the lead-up to the 2024 Paris Olympics, Storm-1516 released a fabricated video purporting to be a threat from Hamas. The video featured a masked individual warning that “rivers of blood flow through the streets of Paris” due to French support for Israel. * Attribution: Microsoft identified this as a Storm-1516 production, noting the specific visual style and distribution pattern through the network’s “news” sites. * Objective: To stoke fear of terrorism in Europe and support for Western alliances. * Verification: Hamas officials publicly denied issuing the threat, and French intelligence agencies (VIGINUM) flagged the video as a Russian fabrication designed to disrupt the games.

Staged “Whistleblower” Videos

A signature tactic of Storm-1516, distinct from pure deepfakes, involves hiring actors to play the role of “whistleblowers.” These videos are frequently shot in low quality to mask the actor’s identity or use heavy blurring, they rely on human performance rather than AI generation. * The “Assassin” Hoax: In early 2024, a video circulated featuring a man claiming to be a former Ukrainian security officer who was ordered to assassinate American journalist Tucker Carlson during his visit to Moscow. The “whistleblower” was identified as a recurring actor in Storm-1516 productions. * The “Luxury Shopping” Narratives: Before the AI-generated Bugatti video, the network used actors to pose as employees of Cartier and other luxury brands in New York and Paris, claiming Olena Zelenska spent millions on jewelry. These videos frequently display forged receipts with basic arithmetic errors (e. g., wrong tax calculations or dates).

Metrics of Deception

Campaign Type	Primary Tactic	Target Audience	Est. Reach (Peak)
Cameo Trap	Decontextualized Celebrity Video	US/EU General Public	2. 2 Million+ (X/Telegram)
Bugatti Hoax	AI Deepfake Avatar	US Conservative Voters	18 Million+ (24 hours)
Olympics Threat	Staged Actor / Fake Terrorist	French/European Public	High Viral Spread (Telegram)

The shift to video—whether through manipulated celebrity cameos, AI deepfakes, or staged actors—demonstrates Storm-1516’s adaptation to a post-text social media environment. By creating visual “evidence,” the network bypasses text-based moderation filters and exploits the visceral impact of video to undermine public trust in Ukraine aid.

The Pivot to Video: MTAC Telemetry and the “Whistleblower” Engine

In late 2023, the Microsoft Threat Analysis Center (MTAC) detected a distinct operational shift within the Russian influence network tracked as Storm-1516. While the group’s earlier iteration, known as “CopyCop,” relied on a sprawling infrastructure of text-based fake news websites to launder narratives, telemetry indicated a strategic pivot toward high-velocity video content. This transition marked a departure from the “firehose of falsehood” text strategy toward a more visceral, emotionally resonant medium designed to bypass literacy blocks and exploit short-form video algorithms on X (formerly Twitter), TikTok, and Telegram. The primary driver for this shift, according to MTAC assessments, was the diminishing return of static text articles in an increasingly video- social media environment. Text-based disinformation requires a user to click a link and read; video disinformation requires only passive scrolling. Storm-1516’s operators recognized that a 60-second clip featuring a “human face” telling a scandalous story generated significantly higher engagement rates, shares, likes, and comments, than the most sensationalized written headlines. MTAC analysts identified a standardized production template referred to as the “Fake Whistleblower” pattern. Unlike other threat actors who rely heavily on AI-generated deepfakes, Storm-1516 prioritizes “cheapfakes”, videos featuring real human actors reciting scripted lines. This method evades automated AI-detection filters that platforms use to flag synthetic media. The actors, frequently recruited from the gig economy or Russian expatriate communities, pose as insiders: disgruntled employees of luxury brands, betrayed Ukrainian soldiers, or victims of crimes allegedly committed by Western politicians.

The “Matryoshka” Dissemination pattern

MTAC telemetry maps the dissemination of these videos through a three-stage laundering process, frequently compared to Russian nesting dolls (Matryoshka). 1. The Seed (The Inner Doll): A video is uploaded to a “burner” account on YouTube or X. The account has no history, a generic name, and a creation date within 48 hours of the upload. The video features the “whistleblower” delivering the narrative in English, frequently with a heavy accent or disguised voice. 2. The Wrapper (The Middle Doll): The video is immediately into articles on Storm-1516’s network of fake news sites (e. g., DC Weekly, The Boston Times, San Francisco Chronicle, a spoof of the real Chronicle). These articles provide a veneer of journalistic legitimacy, citing the burner video as “exclusive footage” or “leaked evidence.” 3. The Amplification (The Outer Doll): Russian state media outlets (RT, Sputnik) and high-profile influencers in the “MAGA” or “Z-blogger” ecosystems cite the fake news article. They do not link to the burner account; they link to the “investigative report” on the fake news site, completing the laundering pattern.

Primary Video Vectors and Campaign Telemetry

Between late 2023 and the 2024 U. S. election pattern, MTAC tracked over 50 distinct video operations attributed to Storm-1516. The following list details the most significant vectors, the specific fabrication techniques used, and the engagement metrics recorded.

1. The “Luxury Spending” Vector

This series of videos was designed to Western taxpayer support for Ukraine by portraying the Zelensky family as corrupt oligarchs hoarding aid money. * The Cartier Incident (October 2023): * The Asset: A video featuring a woman claiming to be a former employee of the Cartier store on Fifth Avenue in New York City. She displayed a fraudulent receipt dated September 22, 2023, totaling $1. 1 million, allegedly signed by Olena Zelenska. * The Fabrication: The receipt contained multiple formatting errors, and the “employee” was an actor. The store confirmed no such purchase occurred. * Telemetry: The video garnered millions of views on X within 24 hours. It was amplified by Russian diplomatic accounts and English-language conspiracist influencers. MTAC noted that the narrative in closed Telegram groups for months after being debunked. * The Bugatti Tourbillon Incident (July 2024): * The Asset: A video featuring a man claiming to be “Jacques Bertin,” an employee of a Bugatti dealership in Paris. He alleged that Olena Zelenska purchased the Bugatti Tourbillon for €4. 5 million during a diplomatic visit. * The Fabrication: The video was released shortly after the D-Day commemorations in France. The invoice shown was a crude forgery with incorrect tax calculations. Bugatti Paris issued an official denial, stating the invoice was fake and the employee did not exist. * Telemetry: The video was pushed heavily by the “AussieCossack” Telegram channel (a known pro-Kremlin proxy) and reached over 12 million combined views across platforms before the original uploads were suspended.

2. The “Black Market” Weapons Vector

Aimed at the Global South and U. S. isolationists, these videos attempt to prove that Western weapons sent to Ukraine are being sold to terrorists. * The Hamas “Thank You” Video (October 2023): * The Asset: A staged video purporting to show Hamas militants holding varied Western firearms and thanking Ukraine for the supply. * The Fabrication: MTAC analysis revealed the audio was dubbed, and the weapons were not identifiable as specific aid shipments. The accents of the “militants” were inconsistent with regional dialects. * Telemetry: Released immediately after the October 7 attacks on Israel, this video exploited the information chaos. It was translated into Arabic and spread rapidly through anti-Israel and anti-Ukraine networks simultaneously, achieving a “cross-pollination” of disinformation audiences.

3. The U. S. Election Interference Vector (2024)

As the 2024 election method, Storm-1516 pivoted its “whistleblower” engine to target Democratic candidates, specifically Vice President Kamala Harris and Governor Tim Walz. * The “Alicia Brown” Hit-and-Run Hoax (September 2024): * The Asset: A video featuring a woman in a wheelchair, identifying herself as “Alicia Brown.” She claimed to have been paralyzed in a 2011 hit-and-run accident caused by Kamala Harris in San Francisco. * The Fabrication: The story was entirely fictional. No police records, hospital records, or news reports from 2011 existed to support the claim. The website KBSF-TV (a fake outlet mimicking a San Francisco station) published the story. * Telemetry: The video was viewed over 5 million times. MTAC identified that the “news site” hosting the story was hosted on the same server cluster as other known Storm-1516 assets. * The Tim Walz Abuse Hoax (October 2024): * The Asset: A video featuring a man claiming to be “Matthew Metro,” a former student of Tim Walz, alleging sexual misconduct. * The Fabrication: The real Matthew Metro was located by legitimate journalists; he was not the man in the video and denied the allegations. The man in the video was an impersonator or paid actor. * Telemetry: This operation demonstrated Storm-1516’s willingness to use identity theft. The video circulated widely in “MAGA” ecosystems on X, with engagement spikes correlating to amplification by specific US-based anonymous influencer accounts.

4. The “French Connection” Vector

Coinciding with France’s increased military support for Ukraine, Storm-1516 targeted the Macron administration. * The “François Faivre” Surgeon Hoax: * The Asset: A video claiming that a plastic surgeon named “François Faivre” had evidence regarding Brigitte Macron’s gender history and was subsequently murdered to ensure his silence. * The Fabrication: The “surgeon” did not exist. The photo used to identify him was a stock image. The narrative was designed to reignite the “Jean-Michel Trogneux” conspiracy theory. * Telemetry: Viginum (the French foreign digital interference watchdog) collaborated with MTAC to attribute this campaign. The operation showed high penetration in French-language conspiracy circles on Facebook and VKontakte.

Operational Metrics and Impact Analysis

MTAC’s telemetry provides a quantitative view of Storm-1516’s video operations. The following data points illustrate the and velocity of the network’s output in 2024.

Metric	Data Point	Significance
Average Time to Viral	24-48 Hours	The time between the “burner” upload and amplification by a major influencer (e. g.,>100k followers) has decreased, indicating tighter coordination.
Language Spread	40+ Languages	Videos are frequently subtitled or dubbed into English, French, German, Arabic, and Spanish to maximize global reach.
Platform Dominance	X (Twitter) & Telegram	While YouTube frequently bans the burner accounts within days, X and Telegram serve as the primary viral engines where content remains accessible longer.
Production Cost	Low (<$500 per asset)	The use of amateur actors and stock scripts suggests a high-volume, low-cost “spaghetti on the wall” strategy rather than expensive, high-production value propaganda.

The “Actor” vs. “Deepfake” Strategic Choice

A serious finding in MTAC’s 2024 reports is Storm-1516’s deliberate preference for human actors over AI-generated avatars for their primary “whistleblower” assets. While the network uses AI for text generation (populating the DC Weekly sites) and occasionally for voiceovers, the core emotional hook—the victim—is almost always a human. This “human-in-the-loop” strategy serves two purposes., it defeats the current generation of deepfake detectors, which look for digital artifacts, unnatural blinking, or lip-sync errors. A bad actor is still a real human, and thus passes these technical checks. Second, the imperfections of a low-budget video—bad lighting, shaky camera work, nervous delivery—add a of “cinema verité” authenticity that slick, AI-generated news anchors absence. The “roughness” of the footage is a feature, not a bug, framing the content as a dangerous, clandestine leak rather than a state-sponsored production. The network’s ability to pivot rapidly between narratives—from Ukrainian corruption to U. S. election interference to French domestic politics—demonstrates a centralized command structure with access to a pool of participants. The telemetry suggests that as long as the “fake whistleblower” tactic continues to generate millions of views with minimal cost, Storm-1516 maintain this video-centric operational tempo, regardless of the frequency with which their narratives are debunked by fact-checkers. The goal is not enduring truth, transient viral pollution.

The Architecture of Deception: Inside the “CopyCop” Server Farms

The operational backbone of Storm-1516 is not a sophisticated military cyber-command, a sprawling network of low-rent, commercially hosted WordPress sites designed to mimic the aesthetic of American local journalism. Researchers at Clemson University and Microsoft Threat Intelligence have labeled this infrastructure “CopyCop” (or the “Dougan Network”), identifying it as a cluster of over 160 distinct domains that function as digital ghost towns. These sites possess the visual trappings of news, weather widgets, local sports scores, and “About Us” pages, absence any physical presence, editorial staff, or legitimate community connection.

The Zombie Domain: DC Weekly

The flagship of this fleet during the 2024 anti-Ukraine aid campaign was DC Weekly. Unlike purely fabricated domains, DC Weekly was a “zombie domain”, a legitimate URL once owned by a real media outlet that went defunct. The Storm-1516 network acquired the expired registration to inherit its domain authority and search engine trust. Forensic analysis reveals that DC Weekly hosted the network’s most viral fabrications, including the debunked claim that Olena Zelenska spent $1. 1 million on Cartier jewelry in New York City. To veneer this lie with credibility, the site employed fake journalist personas. The primary byline, “Jessica Devlin,” featured a biography describing her as an “accomplished foreign policy writer.” In reality, the profile photo was a stolen image of Judy Batalion, a legitimate Canadian-American author unrelated to the site.

The Chicago Chronicle Mirage

While DC Weekly relied on resurrected domains, The Chicago Chronicle represents the network’s second tier: completely fabricated outlets with names designed to sound historically significant. There is no Chicago Chronicle in Illinois. The site was registered anonymously in early 2024, using privacy protection services to mask its ownership. Technical scrutiny by Recorded Future and the Clemson Media Forensics Hub exposed the shared DNA between these sites. The Chicago Chronicle, New York News Daily, and Miami Chronicle frequently shared: * Identical IP Addresses: Hosting on the same shared servers, frequently routed through Cloudflare to obfuscate the origin server’s location (likely in Russia or a non-extradition jurisdiction). * Shared Analytics IDs: Google Analytics or Yandex Metrica codes that appeared across multiple sites, linking them to a single administrator. * Content Scraping Scripts: Automated tools that scraped thousands of articles from legitimate sources (like the AP or BBC) to bury the disinformation pieces. For every one fake story about Ukrainian corruption, the site would auto-publish 500 real stories about the Chicago Bears or local weather, diluting the fraud for casual browsers.

The “Narrative Laundering” Pipeline

The infrastructure exists solely to facilitate a specific laundering process. The Chicago Chronicle does not need a real audience; it needs to serve as a “citation source” for social media.

Storm-1516 Narrative Laundering method

Stage	Action	Technical Component
1. Injection	A fabricated story (e. g., “Zelensky buys Highgrove House”) is posted on a “burner” site like London Crier or DC Weekly.	WordPress CMS, AI-generated text (LLMs like Llama-3).
2. Validation	Fake “citizen journalist” accounts on X (formerly Twitter) and YouTube post links to the article as “breaking news.”	Bot farms, Deepfake video testimonials.
3. Amplification	Russian state media (RT, Sputnik) or unwitting Western influencers cite the “local report” from DC Weekly.	Telegram channels, Cross-platform linking.
4. Mainstream Entry	Western officials or mainstream media debunk the story, inadvertently spreading the claim to millions more.	Search Engine Optimization (SEO) exploitation.

Technological Evolution: The AI Shift

By late 2024 and early 2025, the infrastructure shifted from manual curation to “industrial ” automation. Microsoft Threat Intelligence reported that the network began using uncensored Large Language Models (LLMs) to rewrite scraped news articles, altering the tone to be more cynical or anti-establishment without human intervention. This allowed the network to expand rapidly; in September 2025 alone, Recorded Future observed the creation of over 200 new domains targeting France, Germany, and Moldova, all using the same template architecture as DC Weekly. The “Digital Ghost Town” model is because it exploits the collapse of local journalism in the West. When a user sees a link to The Chicago Chronicle, the name sounds plausible enough to bypass initial skepticism, allowing the Russian GRU-crafted narrative to slip into the information ecosystem unchallenged.

“These sites are not designed to be read by locals. They are designed to be screenshotted by influencers. They are props in a play, not newspapers.” , Darren Linvill, Clemson University Media Forensics Hub.

The Evolution of the Digital Witness

By 2024, the Russian disinformation apparatus known as Storm-1516 had evolved beyond simple text-based fabrication. The network, identified by the Microsoft Threat Analysis Center (MTAC) and Clemson University’s Media Forensics Hub, began deploying a sophisticated new asset: the phantom whistleblower. These were not anonymous sources in text; they were characters brought to life through video, featuring scripted actors, deepfake technology, and elaborate props. The objective was to create visceral, shareable “evidence” of Ukrainian corruption that would bypass the skepticism filters of Western audiences. Unlike static articles, these videos were designed to be watched, reacted to, and reposted on platforms like TikTok and X (formerly Twitter), where emotional engagement outpaces factual verification.

The operational pattern, dubbed “narrative laundering” by researchers at the Institute for Strategic Dialogue (ISD), followed a rigid sequence., a video would appear on a burner YouTube or TikTok account with zero history. The video would feature a person claiming to be a former employee, journalist, or insider, frequently with a blurred face or heavy disguise, presenting “exclusive” documents. Within hours, this video would be as the primary source by one of John Mark Dougan’s “CopyCop” websites, fake local news outlets like the Seattle Tribune or DC Weekly. From there, the story would be amplified by Russian embassy accounts and verified influencers, entering the mainstream discourse as a “breaking report” from an American or European news source.

Case Study: The Bugatti Tourbillon Hoax

In June 2024, just days before the NATO summit in Washington, a video surfaced purporting to expose a lavish purchase by Ukraine’s Lady, Olena Zelenska. The video featured a man identifying himself as “Jacques Bertin,” a supposed employee of the Bugatti dealership in Paris. Speaking in French, “Bertin” claimed that Zelenska had visited the showroom during D-Day commemorations and purchased the model of the new Bugatti Tourbillon for €4. 5 million ($4. 8 million).

The production quality of the hoax was higher than previous iterations contained fatal errors. The video showcased a “receipt” for the vehicle, yet the document was with anomalies. It was written in English, not French, even with being issued by a Parisian dealership. It absence mandatory French value-added tax (VAT) information and misspelled the dealership’s location as “Neuilly-sur-Seine” (missing a second ‘l’).

The video was initially hosted on a French-language website called Verité Cachée (Hidden Truth), a domain registered only days prior and linked to Dougan’s server infrastructure. even with the obvious flaws, the narrative was designed to trigger outrage among US taxpayers. The “Jacques Bertin” character was later identified by deepfake experts as likely being an AI-generated persona or a paid actor with facial manipulation. The Bugatti Paris dealership issued a formal denial, threatening legal action and confirming that no such transaction took place and no employee named Jacques Bertin existed. Yet, the video had already accrued millions of views on X, amplified by accounts previously flagged for spreading Kremlin-aligned narratives.

The Martyrdom of Mohammed Al-Alawi

Perhaps the most macabre fabrication of the Storm-1516 network was the creation, and subsequent “murder”, of an Egyptian investigative journalist named Mohammed Al-Alawi. The saga began in August 2023 reached its peak impact in early 2024, designed to disrupt aid discussions in the US Congress.

The initial video featured a man claiming to be Al-Alawi, presenting grainy documents alleging that President Zelensky’s mother-in-law had purchased a $5 million villa in El Gouna, a luxury resort town on the Red Sea. The documents were quickly debunked; the property belonged to an Egyptian family who had no connection to Ukraine and had not sold the villa. Orascom Development, the resort’s parent company, issued a statement confirming the documents were forgeries.

When the debunking threatened to kill the story, Storm-1516 escalated the narrative. In late December 2023, a new video appeared featuring a man claiming to be Al-Alawi’s brother. He alleged that Mohammed had been beaten to death by “Ukrainian special forces” in Hurghada as retribution for his reporting. This twist transformed a debunked corruption story into a human rights atrocity. The “murder” was reported as fact by the Luxor Front and other fake news sites in the Dougan network. Egyptian authorities, yet, had no record of a journalist named Mohammed Al-Alawi, no record of such a murder, and no body. The entire existence of the journalist, his investigation, and his death was a scripted fiction played out by actors to paint the Ukrainian government as a murderous regime.

The “Hitler’s Limousine” Fabrication

In October 2024, the network targeted the historical sensitivities of Western audiences with a claim that President Zelensky had purchased Adolf Hitler’s ceremonial Mercedes-Benz 770K for $15 million. The source of this claim was the Seattle Tribune, a website mimicking a local Washington state newspaper populated with AI-rewritten content and Russian propaganda.

The “evidence” provided was a photograph of the car parked in front of the Presidential Office in Kyiv. Forensic analysis by Agence France-Presse (AFP) and other fact-checkers revealed the image to be a crude composite. The car was cut from a 2014 photograph taken at a concours d’elegance in California, while the background was a stock image of the Kyiv administration building. The reflection in the car’s windows did not match the surroundings, and the lighting angles were inconsistent.

even with the absurdity of the claim, that a Jewish president would purchase a Nazi dictator’s parade car during a war for national survival, the narrative spread rapidly. It was tailored to resonate with the “denazification” pretext used by the Kremlin to justify the invasion. The Seattle Tribune article was by thousands of bot accounts, creating a “validity loop” where the sheer volume of repetition mimicked a verified news event.

The Pivot to US Elections: The “Former Student”

As the 2024 US election method, Storm-1516 pivoted its “whistleblower” tactics from Ukrainian corruption to American political, specifically aiming to damage the Democratic ticket. This shift demonstrated the network’s flexibility; the same infrastructure used to attack Zelensky was direct retargeted against Vice President Kamala Harris and Governor Tim Walz.

In October 2024, a video circulated featuring a man claiming to be a former student of Tim Walz. The individual alleged sexual misconduct dating back to Walz’s time as a teacher. Intelligence analysts at Microsoft and NewsGuard quickly linked the video to Storm-1516. The “student” was identified as a scripted actor, and the narrative bore the hallmarks of the group’s previous operations: a single, unverified video source, immediate amplification by the “CopyCop” network, and a absence of any corroborating police reports or court records. This marked a serious escalation, showing that the “phantom whistleblower” tactic was a primary weapon for direct interference in US domestic politics.

Forensics of a Fake

The videos produced by Storm-1516 in 2024 share specific forensic markers that allow researchers to identify them. The “whistleblowers” are frequently filmed in low-light environments to obscure facial features or mask the use of deepfake overlays. The audio frequently suffers from synchronization errors, a common artifact of AI dubbing tools.

also, the props used in these videos, fake invoices, land deeds, and passports, frequently betray their origins. In the Cartier jewelry hoax (claiming Olena Zelenska spent $1. 1 million in New York), the receipt displayed a date when Zelenska was publicly confirmed to be in Ottawa, Canada. The “employee” in the video spoke with a heavy accent inconsistent with a client-facing role at a Fifth Avenue luxury boutique. These errors suggest a production line method: quantity over quality, relying on the speed of social media to outpace the speed of verification.

The Cast of Phantoms (2023-2024)

The following table catalogs the primary “whistleblower” personas created by Storm-1516 to undermine Ukraine aid and the 2024 US election.

Fake Identity	Alleged Role	The Fabrication	Status
Jacques Bertin	Bugatti Paris Employee	Claimed Olena Zelenska bought a €4. 5M Bugatti Tourbillon in June 2024.	Debunked: Dealership denied existence; invoice was a forgery.
Mohammed Al-Alawi	Egyptian Journalist	Claimed Zelensky’s family bought a $5M villa in El Gouna; later “murdered.”	Debunked: Property owner denied sale; journalist does not exist.
“Jeanette”	Ex-Cartier Employee	Claimed Zelenska spent $1. 1M on jewelry in NYC while in Canada.	Debunked: Zelenska was in Ottawa; receipt date impossible.
Sabine Mels	BIM Employee (Germany)	Claimed Zelensky bought Goebbels’ former villa near Berlin.	Debunked: BIM (Berlin Real Estate Management) confirmed no such sale or employee.
“Matthew Metro”	Former Student	Alleged sexual misconduct by Tim Walz (Oct 2024).	Debunked: Impersonation of a real individual; linked to Storm-1516.
Anonymous “Hitman”	Chechen Soldier	Claimed to be hired to assassinate Zelensky to prevent peace talks.	Debunked: Video used stock audio; no corroborating intel.

The Distribution Pipeline

The effectiveness of these videos lies not in their quality in their distribution. Storm-1516 uses a “Matryoshka” (nesting doll) technique. The core lie is hidden inside a fake video, which is hidden inside a fake news article, which is then wrapped in a network of bot amplification. By the time a Western user sees the claim on X or Facebook, it appears to be a screenshot of a legitimate news story from a site like the Boston Times or London Crier.

Data from the Center for Countering Disinformation (CCD) indicates that the time gap between the upload of a fake whistleblower video and its appearance on a Dougan-controlled website has shortened from 24 hours in 2023 to less than 4 hours in 2024. This rapid cycling is designed to “flood the zone” before fact-checkers can intervene. The “Phantom Whistleblower” is no longer just a person; it is a, industrial process of manufacturing dissent.

The Legislative Weaponization of “High Life” Narratives

The synchronization between Storm-1516’s production pattern and the United States legislative calendar in late 2023 and early 2024 indicates a tactical evolution in Russian active measures. Moscow moved beyond general confusion to targeted legislative disruption. The network’s primary objective was not to smear Ukrainian leadership to provide specific, falsified “evidence” of corruption that American lawmakers could cite to justify blocking the $60 billion supplemental aid package. This strategy relied on the “High Life” narrative series, a collection of fakes depicting Ukrainian officials spending US taxpayer money on luxury goods.

In late November 2023, just as the US Senate prepared to vote on the emergency spending bill, Storm-1516 released a sophisticated hoax claiming President Zelenskyy used proxies to purchase two yachts, “Lucky Me” and “My Legacy,” for $75 million. The disinformation supply chain functioned with high efficiency: the story originated on a burner YouTube channel, was washed through the fake news site DC Weekly, and then amplified by verified accounts on X (formerly Twitter). Within days, the narrative breached the US Congress.

On December 21, 2023, Senator J. D. Vance, a vocal critic of the aid package, appeared on a podcast and explicitly referenced the fabricated narrative. “There are people who would cut Social Security, throw our grandparents into poverty, why? So one of Zelenskyy’s ministers can buy a bigger yacht?” Vance asked. Representative Marjorie Taylor Greene also amplified the corruption angle, posting on X that voting for aid was subsidizing a “corrupt foreign war scheme,” a statement appearing shortly after the yacht story went viral. The disinformation provided the specific ammunition needed to validate the “blank check” opposition argument.

The “Infection” of the House Floor

By April 2024, the penetration of Storm-1516 narratives into the Republican conference became so acute that party leadership publicly acknowledged the breach. In a rare admission, House Foreign Affairs Committee Chairman Michael McCaul stated in an interview that Russian propaganda had “infected a good chunk of my party’s base.” He noted that he heard specific Russian talking points being repeated by colleagues during strategy meetings.

House Intelligence Committee Chairman Mike Turner corroborated this assessment, confirming that narratives originating from the Kremlin were “being uttered on the House floor.” Turner’s warning highlighted a serious feedback loop: Storm-1516 fabricates a story (e. g., Zelenskyy buying a yacht), US influencers amplify it, constituents demand answers, and lawmakers repeat the falsehoods to justify legislative inaction. This pattern contributed to a six-month paralysis in US assistance, a delay that coincided with the fall of Avdiivka on the Ukrainian front.

Timeline: Storm-1516 Activity vs. US Legislative Delays

Date	Storm-1516 Fabrication	Legislative Context	Outcome
Oct 5, 2023	The Cartier Hoax: Fake receipt shows Olena Zelenska spending $1. 1M on jewelry in NYC.	House Speaker McCarthy ousted; aid talks paralyzed.	Narrative reinforces “corrupt elites” trope during leadership vacuum.
Nov 29, 2023	The Yacht Hoax: Claims Zelenskyy bought two yachts for $75M.	Senate negotiates border/Ukraine supplemental bill.	by US Senators/Reps in Dec; Senate blocks bill Dec 6.
Dec 2023	The Villa Hoax: Claims Zelenskyy bought Goebbels’ villa.	Congress enters winter recess without passing aid.	Solidifies “unaccountable spending” narrative among holdouts.
Feb 2024	Hitler’s Car Hoax: Claims Zelenskyy bought Hitler’s parade car.	Senate passes aid; House Speaker refuses to table it.	Keeps corruption chatter high during House stall.
Mar 2024	Danilov Deepfake: Fake video of Ukraine security chief claiming credit for Moscow Crocus City Hall attack.	House prepares for chance April vote.	Attempt to frame Ukraine as “terrorist state” to kill final vote.

The Border Pivot and Deepfake Escalation

When corruption narratives began to lose potency, Storm-1516 pivoted to exploit the US border emergency, the primary domestic sticking point for the aid bill. The network began circulating content suggesting that weapons sent to Ukraine were being trafficked back to Mexican cartels to use against US border patrol agents. This narrative was designed to pit American domestic security directly against Ukrainian military support.

The network’s most dangerous intervention occurred in March 2024, following the ISIS-K terrorist attack on the Crocus City Hall in Moscow. Storm-1516 operatives rapidly produced a deepfake video of Oleksiy Danilov, Ukraine’s then-Secretary of the National Security and Defense Council. In the manipulated footage, Danilov appeared to claim responsibility for the massacre. The video was broadcast on Russian state television (NTV) and immediately pushed to Western social media to frame Ukraine as a terrorist state. This operation aimed to make a “yes” vote on aid politically toxic for US Representatives just weeks before the final April showdown. While the deepfake was quickly debunked by researchers at Clemson and Microsoft, it demonstrated the network’s capability to deploy high-speed, event-driven disinformation to disrupt specific legislative windows.

Quantitative Correlation

Data from Microsoft Threat Analysis Center (MTAC) confirms the correlation between legislative milestones and Russian activity. MTAC reported a 70% increase in Storm-1516 traffic in the weeks preceding major Congressional deadlines. The network did not operate on a flat schedule; it surged resources specifically when the US Capitol was in session and debating foreign assistance. The six-month delay in aid was not solely a product of domestic political wrangling; it was actively encouraged and sustained by a foreign influence operation that provided the arguments, the evidence, and the public pressure required to hold the line against funding.

VIGINUM Intercepts: The French Counter-Offensive

The French government’s technical agency for digital vigilance, VIGINUM, released a landmark technical assessment in May 2024 that directly implicated the Storm-1516 network in 77 distinct information operations targeting France, Ukraine, and Western democracies. Unlike general warnings about “Russian interference,” the VIGINUM report provided forensic attribution, linking specific server clusters, IP addresses, and behavioral patterns to the Kremlin’s military intelligence apparatus. The agency identified Storm-1516 not as a content creator as a “Russian Information Manipulation Set” (IMS) that systematically uses third-party infrastructures, most notably John Mark Dougan’s “CopyCop” network, to launder fabricated narratives.

The “Portal Kombat” Infrastructure

In February 2024, VIGINUM exposed a sprawling network of 193 “information portals” designed to saturate the European digital space with pro-Russian content. Dubbed “Portal Kombat,” this infrastructure did not produce original journalism. Instead, it functioned as a massive automated relay system, scraping content from Russian social media accounts, news agencies, and official Kremlin statements, then translating and reposting it across localized domains.

The network operated through three primary ecosystems:

Ecosystem	Domain Pattern	Target Audience	Technical Signature
Pravda Network	pravda-fr. com, pravda-en. com, pravda-de. com	Western Europe (France, UK, Germany)	Hosted on IP range 178. 21. 15. XX
Regional News	kherson-news. ru, mariupol-news. ru	Occupied Ukrainian Territories	“ZOV” logo in source code
News. ru Clones	Various local news impersonations	Russian Domestic Audience	Shared favicon hash: -200225920

VIGINUM’s technical analysis traced the administration of these sites to TigerWeb, a web development company based in Crimea founded by Yevgeny Shevchenko. The agency found that the “pravda” ecosystem sites shared identical HTML structures and were hosted on a server cluster in Russia. Specifically, the site pravda-fr. com was hosted on IP address 178. 21. 15. 85. Investigators discovered a specific HTML tag, < div class="logo_big"> ZOV</div>, in the source code of 41 distinct sites, a digital fingerprint referencing the “Z” and “V” tactical markings used by Russian military vehicles in Ukraine.

Operation Matryoshka: The “Verify This” Trap

Beyond automated content farms, VIGINUM identified a more sophisticated psychological operation active since September 2023, which they “Matryoshka” (Russian Doll). This campaign specifically targeted Western journalists, fact-checkers, and public figures. The mechanics of the operation were distinct from previous brute-force methods:

• Step 1: Operators created fake reports, graffiti, or deepfake videos accusing Ukrainian officials of corruption or incompetence.
• Step 2: A network of “seeder” accounts posted this content on X (formerly Twitter).
• Step 3: A secondary of “quoter” accounts tagged major media outlets (e. g., AFP, BBC) and fact-checking organizations, politely asking them to “verify” the (fake) information.

This tactic aimed to force legitimate media organizations to engage with the disinformation, thereby amplifying its reach even if the content was eventually debunked. In one documented case from February 2024, the network circulated a deepfake video impersonating a France 24 journalist, claiming Ukrainian intelligence planned to assassinate President Emmanuel Macron. Another campaign used AI-cloned voices of renowned academics from Harvard and Cambridge to falsely advocate for Ukraine’s surrender.

The Doppelgänger Connection

VIGINUM’s investigations also mapped the intersection between Storm-1516 and the “Doppelgänger” (RRN) network. This operation involved the precise cloning of legitimate Western media and government websites to host fake articles. The agency identified 355 usurped domain names, including clones of Le Monde, Le Figaro, and the French Ministry for Europe and Foreign Affairs.

On June 25, 2024, French authorities seized several of these domains. yet, VIGINUM noted that the network displayed high resilience, frequently migrating to new domains within 24 hours. The content consistently pushed narratives regarding the “ineffectiveness of sanctions,” the “barbarity” of Ukrainian forces, and the alleged “Russophobia” of Western governments. The French Foreign Ministry publicly condemned these operations, stating that the involvement of Russian diplomatic networks in amplifying these campaigns constituted conduct “unworthy of a permanent member of the United Nations Security Council.”

Strategic Shift to Election Interference

The May 2024 report highlighted a serious evolution in Russian tactics: a shift from general chaos-mongering to direct electoral interference. VIGINUM observed a surge in Storm-1516 activity leading up to the European Parliament elections in June 2024. The network deployed fabricated corruption scandals against specific German politicians, including Foreign Minister Annalena Baerbock, and circulated fake audio recordings implicating former U. S. President Barack Obama in conspiracy theories. This targeted method indicates that Storm-1516 has moved beyond simple propaganda and functions as a precision weapon for political sabotage.

Clemson Media Forensics Hub: The Narrative Laundering Pipeline

The Clemson Media Forensics Hub, led by researchers Darren Linvill and Patrick Warren, has provided the definitive quantitative analysis of the Storm-1516 network. Their data, published in the “Writers of the Storm” (November 2024) and “Infektion’s Evolution” (December 2023) reports, exposes a mechanized “narrative laundering” system designed to inject Russian military intelligence (GRU) fabrications into the mainstream Western information environment.

The Mechanics of Laundering

Clemson researchers identified a three-stage process used by Storm-1516 to obscure the origins of its disinformation. This “laundering” technique mimics money laundering, moving information from illicit sources into the legitimate ecosystem. 1. Placement: The narrative originates on a “burner” account or through a paid influencer., this involves a video testimonial from a “whistleblower” or “insider” who is frequently a deepfake or a paid actor. 2. : The story is picked up by a network of fake news websites (the “CopyCop” network) that publish thousands of articles daily. These sites mix the disinformation piece with real news scraped from legitimate sources to create a veneer of credibility. 3. Integration: The narrative is amplified by real users, influencers, and sometimes unwitting mainstream media figures who cite the “news report” from the fake outlet, completing the pattern.

The “CopyCop” Infrastructure

The backbone of this operation is a sprawling network of over 300 fake news websites managed by John Mark Dougan. These sites are designed to look like local American or European news outlets. They use generative AI to rewrite legitimate news stories en masse, hiding the few targeted disinformation pieces within a flood of benign content. Verified “CopyCop” Network Domains (Partial List): * DC Weekly: The primary outlet for early Storm-1516 narratives. * The Chicago Chronicle: A frequent publisher of anti-Ukraine fabrications. * New York News Daily: Mimics the branding of established New York papers. * Miami Chronicle: Florida demographics. * Houston Post: Uses the name of a defunct legitimate newspaper. * Boston Times: Another generic “local” news front. * San Francisco Chronicle (Fake): A spoofed version of the real publication. * Atlanta Observer: Targeted Georgia voters during the 2024 election pattern.

Quantitative Impact Assessment

Clemson’s data analysis from August 2023 to October 2024 reveals the and efficacy of this network.

Storm-1516 Network Performance Metrics (Aug 2023, Oct 2024)

Metric	Value	Context
Distinct Narratives	52	Separate disinformation campaigns identified and tracked.
Mean X (Twitter) Posts	15, 814	Average number of posts discussing a narrative in the week after placement.
Discourse Share	3. 6%	Percentage of total conversation about President Zelensky or Olena Zelenska driven by Storm-1516 narratives during peak weeks.
Network Size	300+ Sites	Number of active fake news domains linked to the “CopyCop” infrastructure by late 2025.

Case Study: The “West African” Vector

A distinct feature of the Storm-1516 pipeline identified by Clemson is the use of African media assets for initial placement. The “Olena Zelenska Cartier” narrative, which falsely claimed the Lady of Ukraine spent $1. 1 million on jewelry in New York, was planted in the Nigerian outlet The Nation. * Origin: A burner Instagram account posted a fake receipt. * Laundering: The story was published by The Nation (Nigeria) and then by DC Weekly. * Amplification: US-based social media influencers shared the DC Weekly article, treating it as a verified report from a “Washington-based” publication. This geographic routing exploits lower verification standards in peripheral media markets to generate the initial “linkable” source required for Western amplification.

Technological Evolution

By late 2025, Clemson researchers observed the network shifting tactics to evade detection. The “CopyCop” operators began using self-hosted Large Language Models (LLMs), specifically derivatives of Llama 3, to generate content locally rather than relying on commercial APIs like OpenAI, which had begun banning their accounts. This shift allows for unrestricted generation of political disinformation without triggering safety filters. The network also began impersonating real journalists. In August 2025, a fabricated story was published under the byline of French journalist Audrey Parmentier, a contributor to Le Monde, adding a new of identity theft to the operation.

The Strategic Pivot: Target Washington

By late 2023, the operational directives of Storm-1516 shifted. While the network initially focused on discrediting the Zelensky administration to European support, the looming 2024 United States Presidential Election presented a more direct route to victory for the Kremlin. Intelligence assessments from the Microsoft Threat Analysis Center (MTAC) confirm that in August 2024, Storm-1516 executed a synchronized pivot. The objective moved from painting Ukraine as corrupt to framing the U. S. Democratic ticket, Vice President Kamala Harris and Governor Tim Walz, as criminally compromised. This strategy aimed to install an administration hostile to Kyiv, severing the aid pipeline at its source.

The network utilized John Mark Dougan’s “CopyCop” infrastructure to launder these narratives. Instead of Russian state media, the attacks originated from fabricated American local news outlets. These sites, bearing names like The Chicago Chronicle, DC Weekly, and the San Francisco Chronicle (a spoofed version), provided a veneer of domestic legitimacy to foreign disinformation. The content was then amplified by a network of “burner” accounts on X (formerly Twitter) and eventually picked up by unsuspecting or complicit US political influencers.

The “KBSF-TV” Fabrication: Targeting Harris

In September 2024, Storm-1516 launched one of its most audacious operations: a fabricated hit-and-run allegation against Vice President Kamala Harris. The network created a fake website for a nonexistent San Francisco television station, “KBSF-TV.” The site hosted a video featuring a paid actress, identified in the clip as “Alicia Brown,” who claimed she was paralyzed by Harris in a 2011 car accident. The actress provided detailed, tearful testimony, alleging that Harris’s team silenced her family.

Forensic analysis by Microsoft and the Clemson University Media Forensics Hub debunked the story immediately. No record of such an accident exists in San Francisco police files, “KBSF-TV” does not exist, and the website was registered in Iceland just days before the story broke. Yet, the narrative achieved its tactical goal. The video garnered over 2. 7 million views on X within 24 hours, circulated by high-profile accounts within the MAGA ecosystem who presented the “news” as a suppressed scandal. This operation demonstrated Storm-1516’s ability to manufacture “evidence” that bypasses traditional fact-checking filters by appealing to confirmation bias.

The “Matthew Metro” Impersonation: Targeting Walz

Following the Harris fabrication, the network targeted her running mate, Minnesota Governor Tim Walz. In October 2024, a video surfaced featuring a man claiming to be Matthew Metro, a former student of Walz. The individual in the video accused Walz of sexual misconduct during his time as a teacher. This operation introduced a tactic researchers call a “cheap fake.” Unlike deepfakes which use AI to swap faces, this involved identity theft and acting.

The real Matthew Metro, currently living in Hawaii, came forward to The Washington Post to confirm he was not the man in the video and that the allegations were entirely false. The imposter in the video bore a passing resemblance to Metro was distinct enough to be identified as a fraud by those who knew him. even with the debunking, the video was amplified by the same Storm-1516 distribution nodes, including the “Black Insurrectionist” account on X, a known conduit for Dougan’s narratives. The operation aimed to depress voter turnout among key Democratic demographics by associating the ticket with moral turpitude.

AI Weaponization: The Matthew Miller Deepfake

Beyond domestic scandals, Storm-1516 deployed advanced AI to manipulate foreign policy discourse. In mid-2024, the network released a deepfake video of U. S. State Department spokesperson Matthew Miller. The AI-generated clip depicted Miller suggesting that the Russian city of Belgorod was a legitimate target for Ukrainian strikes because “no civilians were left.”

The video was a digital forgery. The audio was synthesized, and the lip movements were synchronized to match the fabricated words. Russian officials, including Dmitry Rogozin, immediately the fake video as proof of American bloodlust, using it to justify intensified missile strikes on Ukrainian cities. This case exemplifies the “feedback loop” of Storm-1516: create a fake Western provocation, use it to justify real Russian military escalation, and then blame the West for the violence.

Timeline of Major Storm-1516 Election Interference (2024)

Date	Operation Name	Target	Fabrication Method	Reach (Est.)
May 2024	“Effigy Burning”	Donald Trump	Staged video of Ukrainians burning a Trump effigy to suggest anti-Trump sentiment in Kyiv.	2M+ Views
June 2024	“Belgorod Strike”	Matthew Miller (State Dept)	AI Deepfake of Miller approving strikes on Russian civilians.	Global State Media
Aug 2024	“Obama Audio”	Barack Obama	AI Audio claiming Democrats orchestrated the Trump assassination attempt.	Viral on X
Sept 2024	“KBSF Hit-and-Run”	Kamala Harris	Fake news site, paid actress claiming paralysis from 2011 accident.	2. 7M+ Views
Oct 2024	“Matthew Metro”	Tim Walz	Identity theft, imposter actor accusing Walz of abuse.	5M+ Views
Nov 2024	“Haitian Voter”	US Election Integrity	Paid actor ($100) claiming to vote multiple times for Harris.	High Viral Load

The “Liar’s Dividend” and the of Aid

The cumulative effect of these operations was not to smear individual candidates to create a “Liar’s Dividend”, a skepticism so that truth becomes irrelevant. By flooding the zone with high-production-value fakes, Storm-1516 made it politically costly for US legislators to support Ukraine. The narrative logic was simple: If the Ukrainian government is corrupt (Zelensky yacht fakes) and the US administration supporting them is criminal (Harris/Walz fakes), then the aid package is a fraudulent enterprise.

John Mark Dougan’s network remains active. Even after the 2024 election, the infrastructure of DC Weekly and its sister sites continues to churn out content. The pivot to US election interference proved that the network is platform-agnostic; it attacks whichever democratic institution poses the greatest threat to Russian military objectives. The exposure of Storm-1516 reveals a modern reality: the frontline of the war in Ukraine runs directly through the server farms of Moscow and the social media feeds of American voters.