Disinformation update: REST media turbulence, cracks in the Storm-1516 distribution network, Armenia remains in focus
Moldova is no longer targeted following the election while Armenia and Ukraine remain in focus, cracks in the Storm-1516 distribution network and REST Media's turbulence
Special highlights
REST media takedown and reincarnation
“REST Media” appeared in late-June as an anonymously-run “analytical” portal based in Serbia. For a long period of time “REST Media” leveraged the Storm-1516 distribution network for its promotion, so it was natural to assume that it could be associated with John Mark Dougan; however, further findings indicated otherwise. In late September 2025, DFRLab published an investigation, which exposed the REST Media’s association with a pro-Kremlin media project Rybar and a Serbian blogger Vesna Veizovic. Our team was able to establish similarities between REST and another “analytical” portal Eagle Eye Explore, which is also connected to Veizovic.
Under the weight of the published evidence, in an interview on a friendly “Informer” YouTube channel Veizovic acknowledged her integral role in REST Media and confirmed that REST received help from Rybar team. In the interview, in publication on the website and in her tweets, in attempt do deflect on the allegations, a bunch of conspiracy theories got spilled, in one she called us a “NATO organisation”. In a public X conversation with our team, she did not provide a definitive comment on connection between REST and GRU-backed Storm-1516 and decided to block our account instead.
Around October 31, 2025 domain restmedia[.]io ceased to function. The domain was registered with Njalla, and a curious part about Njalla, is that they own domains and not their customers; in the essence, if you do sketchy stuff - they’ll just pocket your domain. Most likely restmedia[.]io was taken down by Njalla as the evidence at hand is similar to an episode when John Mark Dougan’s domains, including his “crown jewel” fake media website dcweekly[.]org, were taken down by Njalla: NS records were changed to the ones owned by Njalla. Back then, the dissatisfaction with takedown from the Center for Geopolitical Expertise (CGE) and from Dougan got spilled in an associated Telegram channel “Отряд Ковпака“ (“Kovpak’s unit“) along with a myriad of conspiracy theories. This takedown was one of the early calls that the “REST Media” was unlikely to be associated with Dougan.
Surprisingly, we have not seen any public reaction to the “REST Media” takedown from any involved party; however, on the same day restmedia[.]st domain was registered and now is in the active use. Our team has also observed some OPSEC improvements in the infrastructure in comparison to the prior version of the website.
One may now make a joke that REST cycle is now completed: “Reveal, Expose, Subvert, Transform”.
Daniel Gugger’s Australian disinformation muse
Our team has observed several publications [1] [2] in the Daniel Gugger’s Telegram channel (attribution), which were forwarded to the channel directly from the personal Telegram account of Simeon Boikov, also known as “Aussie Cossack”. Both publications contained the materials associated with the Storm-1516 disinformation campaigns, both are part of today’s update: one is alleging that the recent drone-related airport shutdowns are a part of the false flag operation; and another one is alleging that the Ukrainian president Volodymyr Zelenskyy purchased the Pathfinder Ranches in the United States. Daniel Gugger, based in Switzerland, is probably the most prominent spreader of the Storm-1516 materials in German.
Boikov was one of the biggest influencers for many of the Storm-1516 campaigns until his X/Twitter account was indefinitely suspended by the platform in the days leading to U.S. Presidential Election and in November 2024 he was exposed to be paying for publications the Storm-1516 materials by a person behind AlfaFox78 X/Twitter in their interview with CNN:
The man said Simeon Boikov, a Russian propagandist podcaster known online as “AussieCossack,” offered him $100 to post the video, which he agreed to. A person with knowledge of the situation confirmed to CNN that multiple payments were sent from Boikov to the Massachusetts man.
Boikov is hiding in the Russian consulate in Syndey after he assaulted an elderly pro-Ukrainian protester in a demonstration in Sydney in late 2022. During 2023 and 2024, he was registered as a foreign agent of “Russia Today” and according to OCCRP investigation, he received help from Pravfond foundation, which is essentially a Russian intelligence front.
On December 6, 2024, Gugger published the materials related to the Storm-1516 disinformation campaign, which contained a fake testimony about the alleged sexual assault by Robert Habeck. While the tweet was later deleted, Gugger attempted to defend the publication for some time (automated translation):
I got this info from a journalist, though, and that girl in the video talks really convincingly. Why should everything be fake just because there’s no name and publisher? Hardly anyone would dare to do that anyway.
Considering the established facts, it’s very likely that the “journalist” in question is Simeon Boikov.
In September 2025 Gugger published a cease and desist letter from Robert Habeck’s lawyer in relation to this episode. Further developments are yet unclear.
Middleman of the Storm-1516 influencer network turns out to be a blogger based in Pakistan
A thread by TUA Research group uncovers the person behind “Vladimir Putin News” (vladimirputiniu) X/Twitter account: Mustanser Hussain, a blogger from Pakistan. Our team was able to find a tweet with hashtag “#NewProfilePic”, which includes Hussain’s photo. With 283 thousands followers, it’s not only a long term member of the Storm-1516 influencer network, but also a one of its facilitators.
A tweet by X/Twitter account “EdgarMendezE”, which promoted one of the Storm-1516 narratives, includes a screen capture video (slowed-down fragment is above), which captured a chat, where the video was received from. During the transition animation it’s visible that the said chat was with account named “Vladimir Putin News”. In our understanding, this account serves as a mid-level intermediary, and likely is not directly connected to the core Storm-1516 operators.
Sanya Florida: pro-Kremlin propagandist with a potential top secret U.S. clearance
An investigation by TUA Research group, published with UNITED24, sheds some light on Alexandre Ouraev (also known as “Sanya Florida”) background. Ouraev has a U.S. and Russian citizenship and he is living in U.S. since 2002. Before he moved to the U.S., he was living in Chelyabinsk and, according to himself, studied military science at the South Ural State University. Since he started the blogging career around 2018, his YouTube channel accumulated more than 1.2 million subscribers before it was taken down in January 2023, and at time of writing, his RUTUBE channel has 682 thousands subscribers and Telegram is close to a million. His Telegram channel is one of the major distributors of the Storm-1516 materials in Telegram up to this day [1] [2]. The publication also highlights his appearances on the Russian state TV channels.
According to the investigation, Ouraev has held several IT positions in the United States, including work as a network engineer and running a business partnered with a Florida law enforcement agency and a high-precision machining company. The biggest discovery is his employment since 2018 at Science Applications International Corporation (SAIC), a major US technology and defence contractor, where he worked as a principal network engineer. A listing for the same position in SAIC at a different location requires Top Secret/Sensitive Compartmented Information (TS/SCI) clearance, which brings up the concern that Ouraev could’ve had such clearance and access to the classified information related to the U.S. national security while running a blog full of a clearly pro-Kremlin propaganda. Regular distribution of the Storm-1516 disinformation materials further highlights the concern as the campaign is associated with the GRU unit 29155. It is not clear whether Ouraev is still employed by SAIC.
Storm-1516 campaigns
Moldova
Between the early July and mid-August 2025, Storm-1516 operators launched the network of at least 175 unique websites in .ro and .md zones (full list is available in the appendix). A TTP report (in Romanian) by Moldovan Stratcom center highlights the network among other vectors employed by Russia for the parliamentary election interference. The network may be classified into the two categories:
the first category with 75 websites was clearly amplifying Storm-1516 materials and some of these websites were mentioned in our previous disinformation update and in Alliance4Europe’s report on R-FBI and Storm-1516 activities prior to the election day.
the exact purpose of the second category with 100 websites is less clear; however, there indicators that it was used to amplify materials of “Moldova 24“, evedomosti[.]md, eurasia[.]expert, breakingnews[.]md.
It seems that the majority of the network was taken down in the days before the election on September 28, some websites are still operational to this day, but are not being updated.
PAS got the majority of the parliament seats with 50.20% of the votes, which allowed the party to form the government without going into a coalition with another parties. As result, PAS remains in control of the power in Moldova together with the sitting President Maia Sandu, who is also the founder of the party.
Following the election day, Storm-1516 operators ceased further campaigns against Moldova, with the exception of one election-related campaign on October 9. Other major Russian disinformation actors also lost interest in Moldova: according to the data shared with us by antibot4navalny team, Matryoshka nearly stopped any efforts towards Moldova few days after the election day; and according to the team behind RRN.world, Social Design Agency also practically stopped their efforts against Moldova. At the same time, “REST Media” continues to publish new materials targeting Moldova.
The broader context was covered in our previous disinformation updates: [1] [2].
(FAKE) video capturing the destruction of ballots with “wrong” votes
The campaign was launched on September 27 and includes a video with the alleged ballots with “wrong” votes being put in a bucket and burned on the street.
The campaign follows the established playbook, which includes the videos with the destruction of ballots which have the “wrong” votes in order to raise the doubts about the election’s integrity: [1] [2].
(FAKE) a video which captures the inside of an alleged “carousel voting bus”
The campaign, which was also amplified by RT, was launched on September 28 and includes a video which captures the inside of an alleged “carousel voting bus”. Only with a low confidence, we can attribute it to Storm-1516.
(FAKE) a video which captures the alleged vote falsification
The campaign was launched on September 28. Only with a low confidence, we can attribute it to Storm-1516.
(FAKE) same people voting at polling stations in Verona
The campaign was launched on September 28 and includes an alleged report from Verona where the same people allegedly voted in multiple polling stations. Only with a low confidence, we can attribute it to Storm-1516.
Additional analysis was performed by Matteo Pugliese, which points out that the photos were not taking on the day of the election.
(FAKE) videos of alleged voter count at the polling stations in Verona
The campaign was launched on October 9 and includes a multiple variations of edited dashcam footage near polling stations in Verona.
Armenia
While the conflict between the Armenian government and Armenian Apostolic Church (AAC) appears to have slowed down and the normalisation with Azerbaijan and Turkey appears to be on track, Armenia remains as a major target for the Storm-1516 operators. Some of the campaigns are attempting to push the false narrative of Armenia losing its sovereignty (or blatantly “selling out”) to Turkey. This may be interpreted as an indicator that Kremlin is not planning to back down from further hybrid and destabilisation operations towards Armenia.
Some of the campaigns targeting Armenia (and some older campaigns targeting Ukraine) are associated with publications by Okay Deprem, a Russian propagandist of Turkish origin, who is spending a lot of time in the Ukrainian territory occupied by Russia. A review of his activities was recently published by fip.am.
(FAKE) Armen Grigoryan, the Secretary of the Security Council of Armenia, killed his father
The campaign was launched on September 30 and contains a video with an alleged whistleblower who claims that Armen Grigoryan (the Secretary of the Security Council of Armenia) killed his father. The campaign also links to a publication on a fake media website armenianinsider[.]am.
(FAKE) a video “interrogation” of an alleged cook from Gabustan prison, who was allegedly paid to poison Vicken Euljekjian
The campaign was launched on October 9 and includes a video “interrogation” of an alleged cook from Gabustan prison, who was allegedly paid to poison Vicken Euljekjian, an Armenian national, who is currently detained in prison in Azerbaijan. The video is also trying to appear as a footage that was sourced from Azerbaijani state security service DTX.
The campaign also links to a publication on a previously used fake media website armenianinsider[.]am, which also links to a tweet by a now suspended X account “DTXAzerbaijan”, which attempted to mimic DTX official account.
(FAKE) Pashinyan negotiated to forfeit a significant part of Syunik province to Azerbaijan as part of the normalisation agreement between the two states
The campaign was launched on October 16 and includes a video collage which is alleging that Armenian prime minister Nikol Pashinyan negotiated to forfeit a significant part of Syunik province to Azerbaijan as part of the normalisation agreement between the two states. The campaign also links to a publication by Okay Deprem in OdaTV.
(FAKE) A block of historic buildings in central Yerevan will be replaced with a casino
The campaign was launched on October 22 and includes a video collage which is alleging that a block of historic buildings in central Yerevan will be replaced with a casino, which would be owned by Nikol Pashinyan’s brother-in-law Hrachya Hakobyan. The campaign also links to a publication in a recently created fake media website dailyarmenia[.]am.
Additional fact check and analysis may be found in the publications by fip.am.
(FAKE) Pashinyan has cancelled the construction of a large scale Jesus statue
The campaign was launched on November 8 and includes a video collage which is alleging that Pashinyan has cancelled the construction of a large scale Jesus statue in relation to the conflict between the government and Armenian Apostolic Church. The campaign also links to a publication in a recently created fake media website armeniadaily[.]am.
(FAKE) 10 mosques will be built in Armenia and the construction is to be funded by the government
The campaign was launched on November 14 and includes a video collage which is alleging that 10 mosques will be built in Armenia and the construction is to be funded by the government and that the project was allegedly inspired by the Turkish president. The campaign also links to a publication by Okay Deprem in OdaTV.
(FAKE) Electric Networks of Armenia is going to be sold to the Turkish company Aksa Energy
The campaign was launched on November 25 and includes a video collage which is alleging that as a result of the meeting between Ergogan in Pashinyan in June, Electric Networks of Armenia is going to be sold to the Turkish company Aksa Energy. The video is using the branding of the Armenian business news outlet “Business 24”. The campaign also links to a publication by Okay Deprem in haber[.]sol[.]org[.]tr
Ukraine
(FAKE) attacks on Ukrainian cities were false flag operations by the Ukrainian intelligence services
The Storm-1516/R-FBI crossover campaign was launched on October 2 and includes a video collage which is alleging that several attacks on Ukrainian cities were false flag operations by the Ukrainian intelligence services.
(FAKE) Ukraine is using child labour for weapon manufacturing
The Storm-1516/R-FBI crossover campaign was launched on October 17 and includes a video which is alleging that Ukraine is using child labour for weapon manufacturing. Ironically, Russia has a real program to involve children into the weapons design and production.
(FAKE) Zelenskyy purchased Pathfinder ranches in U.S.
The campaign was launched on October 27 and includes a video which is claiming that Zelenskyy purchased Pathfinder ranches in US. The campaign also links to a fake website swanlandco[.]us, which copies the website of a land realtor company “Swan Land Company”. The claim was refuted as fake by the Ukrainian Center for Countering Disinformation.
(FAKE) Flamingo “advertisement” and its debunk
The campaign was deployed in two parts: first is to place the almost certainly a fake advertisement for the Flamingo missile; and the second one is to debunk previously launched video.
The first part of the campaign was launched on October 30 with a video, which is essentially and advertisement for the Ukrainian cruise missile Flamingo with a framing that it will somehow lead to an escalation with Russia.
Our team wasn’t able to verify definitively whether the video is the original Storm-1516 material, but it includes images of burning Kremlin and it’s using the branding of the Ukrainian Ministry of Defence.
The second part of the campaign was launched on October 31 and includes a video, which attempts to “debunk” the original “advertisement”.
(FAKE) “Ukrainian” soldiers threatening Charlie Kirk’s widow Erika Kirk
The campaign was launched on November 6 with a video, which depicts the alleged “Ukrainian” soldiers, who are threatening Charlie Kirk’s widow Erika Kirk. The campaign continues the series of a similar campaigns, which involve the alleged threats by the alleged “Ukrainian” soldiers.
(FAKE) Zelenskyy signed a secret decree, which orders seizure of children from some families in order to put them into the military training
The Storm-1516/R-FBI crossover campaign was launched on November 8 and includes a video collage which claims that the Ukrainian president Volodymyr Zelenskyy signed a secret decree, which orders seizure of children from some families in order to put them into the military training.
(FAKE) Ukrainian army recruitment officers attempted to extort $100 000 from Angelina Jolie in order to release her bodyguard
The campaign was launched on November 11 and includes a video, which is alleging that the Ukrainian army recruitment officers attempted to extort $100 000 from Angelina Jolie in order to release her bodyguard. The video is also using the branding of the British tabloid “The Sun”, but not for the first time: it was also used in a prior campaign, which was alleging the purchase by Olena Zelenska of a dress, which belonged to the Princess Diana.
(FAKE) Zelenskyy owns luxury real estate in Moscow and has a Russian passport issued in Crimea
The campaign was launched on November 16 with a video alleging that Zelenskyy holds a Russian passport (which was allegedly issued in Crimea in 2015) and owns luxury real estate in Moscow. The video is using the branding of New Voice of Ukraine (NV) and makes a point that the information is based on a documents released by “Anonymous”.
The story was refused as fake by the editor of NV and by the Ukrainian Center for Countering Disinformation.
(FAKE) jewels, which were earlier stolen from Louvre, came up during the search of Mindich by the Ukrainian anti-corruption authorities
The campaign was launched on November 19 and includes a video collage, which is promoting the false narrative that some of the jewels, which were earlier stolen from Louvre, came up during the search of Mindich by the Ukrainian anti-corruption authorities NABU and SAP. The video is also trying to appear as an official press release by using a short intro with NABU and SAP logos. The timing of the campaign may be associated with a deal signed on October 17 for Ukraine to obtain 100 French-made Rafale warplanes.
(FAKE) corruption case involving social policy minister Denys Uliutin
The Storm-1516/R-FBI crossover campaign was launched around November 22 and includes a video collage which contains a faked screenshot of a publication in zn.ua with a made up story of a corruption case involving social policy minister Denys Uliutin.
Germany
(FAKE) Germany will accept up to 500 thousands immigrants from UK as a part of the alleged secret protocol to the recent treaty between the two countries
The campaign was launched on September 30 and includes a video which is alleging that Germany will accept up to 500 thousands immigrants from UK as a part of the alleged secret protocol to the recent treaty between the two countries. The campaign also links to a publication in a copycat website fr-24[.]de, which together with the campaign video is using the branding of the German newspaper “Frankfurter Rundschau”. Website’s technical implementation bears a lot of similarities with the website, which copied Correctiv website in one of the prior campaigns.
(FAKE) Recent drone-related airport shutdowns are a part of the false flag operation and is related to lobbying effort for Ukrainian-German enterprise “United Unmanned Systems”
The campaign was launched on November 3 and includes a video which is alleging that the recent drone-related airport shutdowns are a part of the false flag operation and is related to lobbying effort for Ukrainian-German enterprise “United Unmanned Systems”. The campaign also links to a publication in a copycat website sternplus[.]eu, which together with the campaign video is using the branding of the German magazine “Stern”.
France
(FAKE) Macron is building a 148 million euro luxury bunker
The campaign was launched on October 2 and includes a video which is alleging that the French president is building a luxury bunker, which costs 148 million euro. The campaign links to a publication in a fake media website brutinfo[.]fr, which is likely to pass as a real “Brut” French media outlet, but does not copy the branding exactly. The social media links on the website point to “Brut” accounts. The publication also was made under a stolen identity of a French journalist Benoît Vitkine from Le Monde.
Additional fact check and analysis may be found in the publications by AFP and Le Monde.
(FAKE) Macron organised a party with minors for the German chancellor Friedrich Merz at Fort de Brégançon
The campaign was launched on October 24 and includes a video which is alleging that that the French president Emmanuel Macron organised a party with minors for the German chancellor Friedrich Merz at Fort de Brégançon. It also links to a publication in a recently created fake media dzalgerie[.]com, which was made under the stolen identity of French journalist Meriem Amellal.
fondfbr.ru (R-FBI) campaigns
(FAKE) Ukraine’s Award Corruption and Nepotism Scheme: Zelensky awards his allies and profits from counterfeit the army
Fakesperts: Chay Bowes, Simeon Boikov
(FAKE) Armenian Patriots in Azerbaijani Prison: Pashinyan Accused of Torturing Defenders of Nagorno-Karabakh
Fakesperts: Movses Ghazaryan, Mika Badalyan
(FAKE) Armenia’s secret concentration camps: Pashinyan has turned the prison system into a tool for silencing opposition and torturing dissidents
Fakesperts: Chay Bowes, Thomas Röper
Appendix 1: domains associated with Storm-1516 campaign against Moldova
First network of 75 websites, which promoted Storm-1516 content
actualmd.ro
actualplus.ro
acumromania.ro
adevarcurat.ro
adevarnet.ro
adevarpefata.md
adevarromanesc.ro
analizapeloc.md
azionline.ro
cartierultau.ro
cetateviu.md
clarsisimplu.ro
clarsitare.md
datecurate.md
despretara.ro
dialogdeschis.md
dinloc.md
documentat.md
expressmoldova.ro
faradistors.md
faraetichete.md
faraminciuni.md
fararumori.md
faratacere.md
faraumbre.ro
forumlocal.ro
gandnou.md
hotcore.md
hotnews24.ro
infobun.ro
infocompact.ro
infolocalro.ro
infoveridic.ro
inorasultau.ro
insat.ro
intreabaputerea.md
lapasprin.ro
linadrepata.md
lumeaonline.ro
lumeareal.md
moldovaview.ro
noutatiplus.md
noutatirapide.ro
observatorurban.ro
ochiulpublic.ro
pefata.md
privimaltfel.md
pulaulregiunii.ro
pulsderegiune.ro
punctinfo.ro
punctuldevedere.ro
punctulrosu.md
punctulzero.ro
reactiata.md
realromania.ro
romaniaobiectiva.ro
spuneliber.md
stirilimpede.ro
stirirapide.ro
timpreal.ro
timpulazi.ro
totultransparent.ro
tuaivocea.md
tucontezi.md
tvmoldova.ro
updatezilnic.ro
viralpress.ro
voceacartierului.md
voceacivica.md
voiceasatului.ro
vorbimpebune.md
ziarcurat.ro
ziarsimplu.ro
ziarurban.ro
ziualinfo.mdSecond network of 100 websites
actualinfo.md
actualitati365.ro
actualpress.md
agendaonline.md
clipmedia.ro
comentarii247.ro
contextmd.md
cuvintuloradea.ro
dialogpublic.md
digitalbotosani.ro
directmd.md
directtvro.ro
dosarpublic.md
ecoziar.md
ecranlive.ro
emisiune365.ro
evenimentemd.md
flashpress.md
fluxsibiu.ro
gazetaarges.ro
gazetagalati.ro
infoazi.md
infocluj365.ro
infoecho.md
infoflux.md
infopolitica.md
informedia365.ro
informures.ro
infotargu.ro
infotimp.md
infototal.md
infotur.md
infotv247.ro
infotvr.ro
jurnalmd.md
jurnalurban.md
libertateapresei.md
mediahunedoara.ro
mediaiasi.ro
moldopress.md
monitorziar.md
newsfix.md
newstulcea.ro
observatororadea.ro
opinionpress.md
oraexacta.md
portalbihor.ro
presaazi.md
presaonline.md
presaonline247.ro
primastire.md
pulsul.md
punctinfo.md
radiobv24.ro
realitateamd.md
redactiasuceava.ro
regionalnews.md
repedeinfo.md
reportaje365.ro
reporterarges.ro
reportermd.md
reportervalcea.ro
republicainfo.md
ronews360.ro
stiriazi.md
stiribihor247.ro
stiribucuresti24.ro
stiricentrale.md
stiriclar.md
stiricompact.md
stiriconect.md
stiridirecte.md
stiriexpress.md
stirifresh.md
stirigalati.ro
stirimix.md
stirinet.md
stirinoua.md
stirinow.md
stiripentru.md
stirirapid.md
stirisociale.md
stiritotale.md
stiriurbane.md
stirivizuale.md
televiziunea24.ro
textualiasi.ro
timpulzilei.md
videomaramures.ro
vizualtv.ro
voceamaramures.ro
voceamoldovei.md
voceconstanta.ro
vocilezilei.md
ziarbrasov.ro
ziardeazi.md
ziaresibiu.ro
ziarpublic.md
ziarregional.md
zilnicnews.md