Disinformation update: election in Moldova, REST media and a familiar FSB agent
Moldova remains in focus along with the regular targets, "REST Media" gets exposed, Liane Kilinc turns out to be an FSB agent and more
Special highlights
REST Media is exposed to be closely associated with pro-Kremlin media project Rybar
“REST Media” appeared in late-June as an anonymously-run “analytical” portal based in Serbia. Their name is supposed to be an abbreviation from “Reveal, Expose, Subvert, Transform”, which makes their exposure quiet ironic. The project caught our attention when their publications started to be promoted through the influencer network associated with the Storm-1516 campaigns to a point when their materials were promoted more often than the campaigns associated with Storm-1516 and R-FBI. It also brings up the suspicion that the project may have ties and/or arrangements with the Russian military intelligence agency GRU, which is directing [1] [2] the Storm-1516 operations.
DFRLab investigation paints a clear connection between REST and the Russian pro-Kremlin media project Rybar and their Serbian associates. It also explores other social media channels, which were amplifying the REST content.
Rybar initially emerged as an anonymously-run Telegram channel in 2018 by programmer and self-proclaimed political scientist Denis Schukin and ex-military translator Mikhail Zvinchuk. Initially the channel was focused on the situation in the middle east. The channel was working closely with Yevgeny Prigozhin’s RIA FAN between 2019 and 2021-2022. Rybar pivoted following the Russian invasion of Ukraine to make regular and frequent situation reports on the battlefield, which lead the channel to an explosive success: the channel follower count skyrocketed from around 38,000 in the beginning of 2022 to over 1 million by the end of the year. The sudden success also brought attention from the civil society: in November 2022 Russian news outlet The Bell published a two part investigation (part 1, part 2), which exposed Rybar founders. Shortly after the exposure, Zvinchuk was appointed to be a member of the working group on issues of mobilisation and social support for combatants, which later became one of the primary reasons for sanction designation against Zvinchuk by EU. Since then, Zvinchuk became the face of Rybar, while Schukin remained to be primarily behind the scenes.
In 2024, the U.S. State Department announced Rewards for Justice campaign against Rybar in the relation to the TEXASvsUSA account on “X”, which U.S. State Department classified as an attempt to interfere in the 2024 U.S. presidential election.
DFRLab’s set of evidence to support the connection between Rybar and “REST Media” is undeniable, which corroborates with the independent research performed by our team:
“REST” has clear infrastructure overlap with other Rybar resources, such as choice of hosting, server and WordPress configurations
There are very definitive fingerprints in the metadata, the most prominent is existence of literal Rybar-REST reference (“C:\Rybar на С\REST\”) in the metadata of several media files
“REST Media“ social accounts state that the project is based in Serbia, which is true to a some degree. DFRLab was able to establish a link to a Serbian journalist Vesna Veizovic; however, there is more: Veizovic is also a contributor and almost certainly a co-founder of the “Eagle Eye Explore” (EEE). EEE was launched around May-June 2024 as anonymously-run “analytical” project. EEE is focusing largely on the same topics as REST, and the website structure is also very similar to REST. At the same time, EEE authors are primarily not anonymous and write under their real identities.
On April 20 of 2024, Veizovic published a photo, where she is depicted together with Serbian far-right politician Miša Vacić and Rybar founder Mikhail Zvinchuk. Published photo is also overlayed with the screenshots of their listings in “Myrotvorets“ database. Vesna wrote:
This is the cooperation with the Russian special services. At the dinner with Ribar, Mikhail Zvinchuk, to the regret of all the other Serbian elitists in the Writers’ Club. The photographer is also on the list, as well as a colleague who is not in the frame for some reason 🙂
PS. My list of activities is the most extensive, as can be seen from the attached.
A few days before this post, on April 16, Zvinchuk performed a master class as part “Rybar media school” in Balkans. While there is no clear evidence of her participation in the master class, the “REST Media” public statement in the response to the DFRLab investigation states:
In 2024, members of our team attended a media workshop organized by Rybar in Belgrade during their visit to Serbia
It also states that the project received assistance from Rybar team, including infrastructure, media content management and “practical assistance”. It also denies any editorial influence from Rybar or “any other entity”. At the same time it does not provide a comment why the influencer network associated with the Storm-1516 very actively promoted their materials.
Liane Kilinc turns out to be an FSB agent
A joint investigation by the Dossier Center and Süddeutsche Zeitung sheds light how Liane Kilinc was recruited by FSB and what kind work she did as an agent.
Liane Kilinc was in Russia when in September 2023 the Brandeburg police opened an investigation against Kilinc for “justification of crimes”, initially she unsucesfully attempted to apply for asylum. In May 2025 she was arrested in absence by the German authorities in connection of support of militias in so-called Donetsk and Luhansk “People’s Republics” by “Friedensbrücke - Kriegsopferhilfe” (“Peace Bridge - War Victims Aid”) association, which is headed by Liane Kilinc and Klaus Koch. According to an investigation by “The Insider”, the fund supplies Russian military under the guise of humanitarian aid and is actively collaborating with Russian neo-nazis.
The publication alleges that Kilinc has met her future handler a month earlier. She met Sergey Kolesnikov, KGB and FSB veteran, in a company of mutual acquaintances. Even though Kolesnikov is working currently working as a private investigator, he remains active contacts with the FSB. who began working her by “surrounding her with care”: offered to book a sanatorium, helped find an apartment and negotiate with the landlord, provided financial assistance, assisted with getting the doctors appointments and other bureaucratic issues. At the same time, he was straightforward that he wants something in return and their meetings were frequent.
According to the documents reviewed by the Dossier Center, her work with Kolesnikov included:
composing the reports about publicly available things like NATO management structure, drones used by the Ukrainian Armed Forces or open positions in Rheinmetall
some of her acquaintances in Germany were sending her photos of military convoys and military production sites, which she forwarded to Kolesnikov and some of them were also published in her Telegram channel
she allegedly convinced British national Ross McElvenny to join the Russian army, who lost an eye in the battlefield and received the Russian citizenship shortly after
she organised a “protest” funded by FSB in front of the German embassy in Moscow in May 2022, which was covered by the Russian federal media
Kilinc also has a role in the distribution of the Storm-1516 and R-FBI materials through the website okv-ev[.]de for an association “Ostdeutsche Kuratorium von Verbänden” (“East German Board of Associations”), which allegedly unites a number of associations which are not ready to admit the reality of re-unified Germany. The investigation does not provide any insights related to this aspect of her activities.
Even with all these efforts, Kilinc had a hard time in her attempts to get a Russian citizenship. The Dossier Center publication provides a quote by Kilinc:
They mock us, ridicule us, trample us underfoot, and yet they celebrate it,” Kilinch commented on the bill to grant residence permits to foreigners who have suffered for supporting the Kremlin, introduced in the State Duma in December 2023. “Any refugee in the EU receives 10 times more support: a roof over their head, money for living, health insurance, etc. This new law is a disgrace, a farce.” “I’m sick to death of the way they treat us... Bring your documents, a suitcase full of money, leave everything, sell your house, your car, your life, and come to Russia to spend it all there... And how many people will that suit, after they’ve taken away your job, your livelihood, closed your account... Oh, yes, I forgot, these are rich refugees who cross the border without a problem, then calmly organize their move, and receive a bouquet of flowers from Anna-Lena Baerbock or Olaf Scholz as a farewell. And be sure to speak Russian, otherwise you’ll get a return ticket to prison at your own expense.
In May 2025, she received the Russian passport in Nizhny Novgorod from the hands of its governor, allegedly with assistance from OKA Agency.
Recorded Future published their new report on Storm-1516
Recorded Future published a new report detailing their findings related to Storm-1516. Among the notable previously unreported findings are:
Storm-1516 operators are using the self-hosted and uncensored versions of Meta’s Llama-3-8b model to generate content for their websites
Reuters knockoff website reuters[.]uk[.]net, which was likely intended to be used for the campaign targeting Norway and “Internet Governance Forum”
further expansion of truefact network
websites related to John Mark Dougan’s personal projects: darkquasar[.]tech, skryty[.]ru, skryty[.]com, video[.]darkpulsar[.]ai and darkpulsar[.]ai, which at some point had login page with text “Shining information to websites worldwide, like a pulsar beacon”
Tara Reade Russian citizenship
Tara Reade, one of the most notorious Storm-1516 amplifiers, was granted a Russian citizenship by a presidential decree. According to her tweet, she received help with the citizenship from Mariya Butina and Margarita Simonyan.
Storm-1516 campaigns
Moldova
As the parliamentary election is just days away, Molvoda remains the primary focus for the Storm-1516 disinformation campaigns, for Kremlin propaganda machine and the Russian state-sponsored disinformation actors. It’s also one of the focus points for the recently exposed “REST Media”. A recent report by Recorded Future provides an overview of other actors involved in the informational war against Moldova and a recent investigation by BBC uncovered a troll farm connected to Ilan Shor’s “Evrazia”.
Leaked documents, which were reviewed by Bloomberg, also shed some light on the Kremlin’s alleged “multi-pronged strategy” for the parliamentary election in Moldova. The ultimate goal is to completely remove PAS party and Maia Sandu from the power. The plan includes vote buying (also in diaspora), staging of distruptive protests, disinformation campaigns and use of compromising material to pressure public officials to disrupt the electoral process.
The broader context was covered in our previous disinformation update.
Coordinated narratives pushed through the Storm-1516 influencer network
In the recent weeks, our team observed several narratives related to Moldova, which were amplified through the Storm-1516 influencer network, but do not fit into the parameters of a typical Storm-1516 disinformation campaign. Together with the Storm-1516 influencer network, these narratives were also promoted through DD Geopolitics account. One of the narratives is related to the alleged police raids and arrests of the people associated with Heart of Moldova party and with PCRM. Another two [1] [2] are related to the fearmongering in relation of the alleged military operation in Transnistria.
(FAKE) Maia Sandu declared a military emergency and prepares the country for mass mobilisation
The campaign was launched on September 4 and includes a poorly made video collage, which contains the alleged presidential decree, which bans the men aged between 25 and 50 from leaving the country. The video is also watermarked with the logo of Realitatea.md.
(FAKE) UK will send troops to Moldova and Ukraine to pursue its imperial ambitions
The campaign was launched around September 10 and includes another poorly made video collage, which is ultimately alleging that UK is going to send troops to Moldova and Ukraine due to an alleged UK “imperial plans” in the Black Sea region.
The video cites multiple times a publication on a poorly made website mynews24[.]co[.]uk, which doesn’t fit into the typical profile of the Storm-1516 fake media outlets. The same publication started circulating in the Russian Telegram channels since at least September 6, even though it was originally published in mid-August. While the website publications may be traced back to early 2024, it got the first significant traction only in February of 2025, when a story about the alleged American biological laboratories in Armenia was amplified by “ANNA News”, which was investigated by DFRLab.
Fake PAS party website
The campaign was launched on September 18 and includes an “advertisement” video and a knockoff website pas2025[.]eu. The campaign alleges that the party is planning to drastically increase taxes and retirement age, and to increase the duration of army conscription, while also including women into the obligatory army service. Similar campaigns were launched before the 2024 French legislative election and U.S. presidential election.
Additional fact check and analysis may be found in the publication by StopFake (in Ukrainian).
(FAKE) Moldova authorities are preparing to harshly suppress allegedly expected mass riots
The campaign was launched on September 19 and includes a poorly made video collage, which contains the alleged presidential decree which instructs the security forces to harshly suppress any unrest and to prepare the hospitals and detention facilities for mass arrests and clashes.
(FAKE) Several parties were removed from the alleged mail-in ballots for Moldovan voters in the U.S.
The campaign was launched on September 22 and includes three video variants with the same allegation: parties from Patriotic Electoral Bloc and Alternativa political alliances are missing from the alleged mail-in ballots for Moldovan voters in the U.S. The claim was refuted by Moldovan Central Electoral Commission as fake.
The campaign was also promoted through the Russian Telegram channels [1] [2] [3] with the links to a several fake media websites: fararumori.md, viralpress.ro, hotnews24.ro and adevarpefata.md.
(FAKE) Moldova will store toxic waste from France
The campaign was launched on September 24 and includes a video “investigation”. It also links to a publication on a recently created fake media website gbreporter[.]com, which was made under the stolen identity of The Guardian reporter Amelia Hill.
Additional fact check and analysis may be found in the publication by AFP (in French).
Armenia
(FAKE) Armenian prime minister Nikol Pashinyan purchased a mansion in Canada
The campaign was launched on September 10 and includes a video “investigation”. The campaign also links to a recently created fake media website timescanada[.]ca.
Additional fact check and analysis may be found in the publication by fip.am.
(FAKE) Armenian prime minister has issued an order to execute disloyal soldiers
The Storm-1516/R-FBI crossover campaign was launched on September 17 and includes a video collage, which contains the alleged secret decree.
(FAKE) Nikol Pashinyan runs a brothel network together with the Armenian defence minister
The campaign was launched on September 24 and includes a video “investigation”. The campaign also links to a fake media website armeniadaily[.]org.
Ukraine
Video comparing Zelenskyy with Hitler
The campaign was launched around September 2 and includes a video collage, which equalizes Ukrainian president Volodymyr Zelenskyy with Adolf Hitler, and claiming that Zelenskyy is “the evil”.
(FAKE) Ukraine is using civilians to clear the minefields
The Storm-1516/R-FBI crossover campaign was launched on September 5 and includes a video collage, which contains a fragment using the stolen identity of a Bellingcat member Galen Reich. The video fragment was taken from a video published in the University of Birmingham Alumni YouTube channel.
The video includes an alleged and obviously fake testimony using another stolen identity - Halyna Polyakova, the director of “Care for Older People in Ukraine”. The whole video is voiced over by a third person or AI-generated voice.
Additional fact check and analysis may be found in the publication by EuroNews.
(FAKE) Olena Zelenska spent more than a million euros on luxury shopping
The campaign was launched on September 19 and includes a fragment of the alleged video interview of the alleged shopping assistant.
The campaign links to a publication on obscure French-speaking media outlet lequotidien[.]com[.]tn. The whois contact for the domain points to a person with email address on alchourouk[.]com, another Tunisian outlet that was previously used on by the Storm-1516 operators for distribution of the campaign materials. The publication cites an interview on a YouTube channel “Interview réalisée par Ali Shehabi”, which contains only two videos related to the campaign.
Germany
(FAKE) Rape allegation against Friedrich Merz
The campaign was launched on September 4 and includes a video “testimony”.
France
(FAKE) “Islamic extremists” with Palestinian flag threatening to turn France into an “islamic state”
The campaign was launched on September 15 and includes a video with a group of the alleged “Islamic extremists”, who are threatening to make France an “islamic state” and are slashing the French flag in the end of the video. The story was distributed with the links to obscure Arabic-speaking websites elfagr[.]org and aboutmsr[.]com.
The campaign may have been inspired by a sudden re-appearance of an older Storm-1516 campaign, which included a video of the alleged HTS members, who were threatening to burn the Notre Dame. The re-appearance is unlikely to be related to the activity of the Storm-1516 operators.
Additional fact check and analysis may be found in the publications by RFI and AFP.
R-FBI campaigns
(FAKE) Sandu’s pedophile alliance: Moldova’s ruling party recruits minors for sexual exploitation through its youth unit
Campaign date: September 11, 2025
Fakesperts: Dmitry Sorokin
The “investigation” largely relies on the materials published on an obscure media portal dimineata[.]info in August. The original story was previously promoted through the pro-Kremlin Telegram channels.
(FAKE) Ukrainian President Zelensky destroys the bodies of fallen soldiers to deceive the relatives of the deceased and reduce the actual number of losses
Campaign date: September 25, 2025
Fakesperts: Stanislav Krapivnik