Disinformation update: good morning for everyone, except the Kremlin propagandists
Storm-1516 and fondfbr (R-FBI) campaign summary, John Dougan expands his network and brags about his work on French television, sanction designations and arrests for pro-Kremlin propagandists and more
Not a good day to be a pro-Kremlin propagandist
Alina Lipp and Thomas Röper sanctioned by EU
On May 20, the Council of the European Union imposed sanctions against Thomas Röper and Alina Lipp for their involvement in activities aimed at undermining the democratic political process in Germany.
Thomas Röper is the creator of “Anti-Spiegel” media portal. He participated in a number of CGE-affiliated conferences, which were aimed to beef up propaganda base around the Russian invasion of Ukraine [1] [2]. He also posed as an “expert” in several of fondfbr (R-FBI) campaigns [1] [2] and served as “observer” in the sham “referendum”, which was supposed to justify the illegal annexation of the Russian-occupied Ukrainian territories.
Alina Lipp is a German-speaking pro-Kremlin blogger. She has been one of the key distributors for Storm-1516 and fondfbr (R-FBI) campaigns. She participated in a number of CGE-affiliated conferences, which were aimed to beef up propaganda base around the Russian invasion of Ukraine [1] [2].
An investigation by “Important Stories” from March 2025 exposed that during 2023 and 2024 she received more than 600,000 rubles (little over $7,500 at the time of writing) as “salary” from a company “Fancy Nerds”, which is headed by Martin Held. Company’s income comes solely from Russia Today. According to the same publication, she received Russian citizenship in late 2022.
Alina Lipp and Martin Held are also co-founders of “Welcome to Russia” ogranization, which is purposed to help foreigners to relocate to Russia. Other co-founders are: Maria Butina, Sabrina Hare and Alexander Stefanesco.
Additionally, the website alinalipp[.]ru, which is being promoted by Alina Lipp after the imposed sanctions, is hosted on the same server, as other project associated with Martin Held, such as welcome-to-russia[.]com, vistaimmigration[.]ru, moyarossiya[.]com, mariabutinadiary[.]com and a news portal mainstream[.]news.
One of the websites - vistaimmigration[.]ru is associated with “VISTA immigration” law firm, which specialises in immigration to Russia. The firm is headed by Timur Beslangurov. He is also associated with “Moving to Russia” initiative with and he is the “First Deputy CEO” in “OKA“ immigration agency. “Welcome to Russia” specifies both “VISTA immigration” and “OKA Agency“ as their partners.
Liane Kilinc arrested in absence by German authorities
In late May, German media reported that police searches were conducted in the offices associated with “Friedensbrücke - Kriegsopferhilfe” (“Peace Bridge - War Victims Aid”) association in connection of their support of militias in so-called Donetsk and Luhansk “People’s Republics”, which are currently regarded by German Federal Public Prosecutor General's Office as a terrorist organizations. Additionally, arrest warrants were issued against the organization’s chairwoman Liane Kilinc and Klaus Koch. According to an investigation by “The Insider”, the fund supplies Russian military under the guise of humanitarian aid and is actively collaborating with Russian neo-nazis.
Liane Kilinc was born in a family of a Stasi employee. According to the publications Russian media, she was granted Russian citizenship in April 2025.
She is specified as a contact person for the website okv-ev[.]de for an association “Ostdeutsche Kuratorium von Verbänden” (“East German Board of Associations”), which allegedly unites a number of associations which are not ready to admit the reality of re-unified Germany. The website is occasionally used by Storm-1516 and fondfbr (R-FBI) operators for campaign placement. Latest instance was just a few weeks ago with campaign against Maia Sandu.
Klaus Koch is an ex-officer of NVA, DDR’s armed forces, who lives in Russia since mid-90s. A thread by Bluesky user “peter.agile-demokratie.org” provides a decent summary about his background and activities (in German).
On the sidelines
VIGINUM report on Storm-1516
In early May, VIGINUM released a large report on Storm-1516, which summarizes the current knowledge about Storm-1516 activities and connections with other actors.
ANR network
We recently published the complete list of currently known websites, which belong to ANR (Australian National Review) network, which is associated with Jamie McIntyre:
- anr[.]news (ex australiannationalreview[.]com)
- newzealandtimes[.]live
- londontimes[.]live
- cnbsnews[.]live
- goldcoastreview[.]comRaphael Machado exposed to be working with Social Design Agency
While we don’t usually cover the activities related to Social Design Agency (SDA), this one is an exception. A joint investigation by “t-online” and “Jüdische Allgemeine“ exposed a rather unusual activity: Raphael Machado arranges the interviews, which are then placed in the media network, which is operated by SDA. This episode is related specifically to the “HadashotIsrael”, which is targeting Israel.
Raphael Machado is the leader and one of the founders of a Brasilian chapter of Nova Resistência (NR). NR is ideologically aligned with Alexander Dugin’s “Eurasian Movement” and two are actively collaborating.
OCCRP investigation into Pravfond activities
In late May 2025, OCCRP released an investigation into the activities of the Pravfond “foundation”, which is almost certainly a front organisation for Russian intelligence services. Pravfond has a track record of supporting Russian spies and even killers, some of them are: Viktor Bout [1], Vadim Krasikov [1] and Tatyana Zhdanok [1]. The foundation was also used to finance the pro-Kremlin propaganda outlets “Golos.eu” and “Euromore”.
In one episode, the investigation describes the support provided by Pravfond to Semyon Boykov, who is also known as “Aussie Cossack”. The saga began when Boykov went into hiding in the Russian consulate after he assaulted an elderly pro-Ukrainian protester in a demonstration in Sydney in late 2022. According to the investigation:
Boikov’s wife applied for at least three rounds of legal aid from Pravfond, and the organization helped him at least once, describing him in internal documents and letters to various Russian diplomatic departments as unjustly persecuted for airing pro-Russian views.
Pravfond also pulled numerous strings on Boikov’s behalf. After his retreat into the consulate, Boikov complained of being mistreated by the consul, who, he wrote, “dreams of giving me up to the Australian police.” In response, Pravfond convened meetings with high-level Russian diplomats and wrote letters lobbying for Boikov’s interests.
Most significantly, it also appears to have pushed for his naturalization, resulting in a 2023 decree from President Putin granting him Russian citizenship. “I express my genuine gratitude for your help in solving this matter,” he wrote Pravfond. “This is a huge joyful event for which I have been striving for many years.”
It’s also worth noting that Boykov occasionally advertises immigration services provided by Timur Beslangurov: “VISTA Immigration” and “OKA agency”, which we mentioned in the earlier part of this text.
Semyon Boykov was one of the biggest influencers for many of the Storm-1516 campaigns until his X/Twitter account was indefinitely suspended by the platform in the days leading to U.S. Presidential Election. During 2023 and 2024, he was registered as a foreign agent of “Russia Today”. Based on a CNN interview with the person behind AlfaFox78 X/Twitter account (which was also posting Storm-1516 campaigns) from November 2024, Boykov paid him for posting Storm-1516 content in exchange for money:
The man said Simeon Boikov, a Russian propagandist podcaster known online as “AussieCossack,” offered him $100 to post the video, which he agreed to. A person with knowledge of the situation confirmed to CNN that multiple payments were sent from Boikov to the Massachusetts man.
In another episode, the investigation goes into the activities of “IMHOclub“ media platform. One thing caught our attention:
Documents in the email archive show that Pravfond has granted at least 6.4 million rubles ($65,800) to IMHOclub since 2022, including to host a virtual “anti-fascism conference” — attended by pro-Russian activists and politicians from multiple countries — that resulted in an anti-Ukrainian resolution meant for submission to the UN and other international bodies.
The partner publication by VSquare also highlights this episode. While we weren’t able to verify it, the confluence of facts indicates that it was highly likely the “antifascism.online” conference.
The conference website states that is was organized by so-called “Center for Geostrategic Studies” (“ЦГС“ / “CGS“) - a Serbian based “think tank”, headed by Dragana Trifcovic. CGS is very closely tied to many actors of “Eurasian” universe.
The conference website also lists its media partners:
IMHOclub - the media platform in question, which received continuous funding from Pravfond.
“International Union of Free Journalists” (IUFJ) - is headed by Nikolay Kostyrkin, an ex-editor of “gagauznews.md”. IUFJ website states that it received media support from Alexander Malkevich, Russia Today, IMHOclub, RIA FAN, fondfbr (R-FBI) and others.
strajk.eu - a Polish-speaking outlet, which is headed by Maciej Wiśniowski. According to another material by VSquare, Wiśniowski together with other strajk.eu contributors served as observers in presidential elections in Madagascar in 2018, and had their expenses paid by a Kremlin-controlled organisation “CIS-EMO“.
Global “Fact”-Checking Network (GFCN)
GFCN was announced by Timofey Vasiliev (also known as “Timofey V”) in late October 2024, and was presented at “Dialog about Fakes 2.0” conference in November 2024. In April 2025, Vasiliev announced opening of the network’s website. GFCN was co-founded by “ANO Dialog”, “TASS” and the “New Media School”. Among the network’s members are: Sonja van den Ende, Emmanuel Leroy and Lucas Leiroz.
GFCN is not the first attempt by ANO Dialog to create a “fact-checking” resource. Shortly after the Russian invasion of Ukraine, “War on Fakes” has emerged with their own website and a Telegram channel. In March 2023, Logically exposed its operator: Timofey Vasiliev, who is employed by ANO Dialog as “Head of Strategic Areas Development” since 2019. In September 2024, the U.S. Justice Department announced the seizure of 32 domains associated with campaigns operated by SDA, “Structura” and “ANO Dialog”, one of them was waronfakes[.]com. Following the seizure, Vasiliev openly admitted that “ANO Dialog” is behind the “War on Fakes” project and in December 2024 he filed the lawsuit against the FBI in attempt to regain the control of the domain, which ultimately failed as ANO Dialog itself is on SDN list. Telegram channel is still operational up to this day.
New John Mark Dougan’s fake media network
Our team was able to discover the new network of 36 fake media websites which are operated by John Mark Dougan. Additionally we found a single Swahili-speaking fake media website africa[.]truefact[.]news, which is also operated by Dougan.
More campaigns
Fake story alleging that Israeli retirees are being granted U.S. citizenship and are going to receive Social Security benefits without contributions
We were also able to establish an earlier campaign from mid-April, which wasn’t explicitly distributed and hence did not get any traction at all. The story was published on 35 websites, all of which belong to Dougan’s new network, such as usatimes[.]news and kphl[.]news .
Fear mongering of Russian retaliation after the SBU’s operation “Spider's Web”
Shortly following our publication, in the early morning of June 5, the Telegram channel “Отряд Ковпака“ (“Kovpak’s unit“), which is associated with CGE, posted the "news" story titled:
Western media reports that Russia is preparing a large-scale retaliatory strike on the territory of the former Ukraine
The story links to wval[.]news as source, which is a part of Dougan’s new network. The same story was subsequently posted by “UKR LEAKS” network: [1] [2] [3] [4] [5] [6]
The publication alleges:
The targets include large military and industrial facilities, as well as military and civilian government buildings in the cities of Kyiv, Lviv, Khmelnytskyi, Dnipro, and Kharkiv.
(…)
The plan includes the use of at least ten “Oreshnik” missiles, over 100 “Iskander,” “X-101,” and “Kalibr” missiles, as well as hundreds of “Geranium”-type munitions.
The story was later distributed through InfoDefense channels with links to silvercity[.]news and to a different article in wval[.]news: [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15]
“true fact” network expands
Since the publication, out team observed the expansion of “truefact.news” fake media network with two French-speaking websites:
fr.truefact.news - ex franceencolere[.]fr
france.truefact.news - ex veritecachee[.]fr
John Mark Dougan on France TV
On June 15, “France TV” aired a special episode of “C dans l’air” on war in Ukraine. A part of the film contains an interview with John Mark Dougan.
In one instance, he shows the framed front page from the Washington Post, which contains the article that exposed Dougan’s work with the “Center of Geopolitical Expertise” (CGE) to produce disinformation campaigns under order of GRU unit 29155. A similar framed page, but not clear whether it’s the same, could be seen in a photo inside CGE office from December 2024.
In another instance, he shows off some of his media websites:
citylinenews[.]com
africa[.]truefact[.]news
franceencolere[.]fr
veritecachee[.]fr
He also shows off his “AI server”. According to the sanction designation by U.S. Department of Treasury against Valery Korovin and CGE, the server was funded by GRU for disinformation operations:
CGE built a server that hosts the generative AI tools and associated AI-created content, in order to avoid foreign web-hosting services that would block their activity. The GRU provided CGE and a network of U.S.-based facilitators with financial support to: build and maintain its AI-support server; maintain a network of at least 100 websites used in its disinformation operations; and contribute to the rent cost of the apartment where the server is housed.
Campaigns
Storm-1516 campaigns
Germany: pre-election campaigns
There were a few campaigns related to German federal election, which weren’t included in our previous disinformation updates. The campaigns bear extreme similarities with the Storm-1516 campaigns during U.S. presidential elections and were likely intended to undermine the integrity of the election process.
(FAKE) AfD omitted from voting ballots in Leipzig
The campaign was launched around February 18, 2025 and includes several videos in German.
(FAKE) ballots with votes for AfD being destroyed at the polling station
The campaign was launched around February 20, 2025 and includes a video in German.
Germany: post-election campaigns
Following the elections, Storm-1516 operators took a hiatus in campaigns targeting Germany until the formation of the government under the leadership of Friedrich Merz.
(FAKE) Friedrich Merz plans to import millions of illegal immigrants
The campaign was launched around May 7 and links to a fake website friedrich-merz-cdu[.]de, which attempts to mimic Merz official website friedrich-merz.de .
(FAKE) Friedrich Merz enriches himself through the sale of Taurus rockets
The campaign was launched around May 27 and links to fake media website widerspruch-news[.]de .
France
(FAKE) allegations of sexual assault against Brigitte Macron by “former student”
The campaign was launched around February 28 and includes a video of a “testimony” of the alleged “student”. Additional fact check may be found in the materials by France 24 and by NewsGuard.
(FAKE) Zelenskyy purchased Milleis Banque in France
The campaign was launched around March 5. Additional fact check may be found in the AFP material.
(FAKE) lover of Emmanuel Macron died from AIDS
The campaign was launched around March 31. Campaign was also distributed with links to likely sponsored publications in actucameroun[.]com and senenews[.]com. Additional analysis may be found in the NewsGuard material.
(FAKE) Emmanuel Macron tries to arrest and imprison the leaders of opposition in France
The campaign was launched around April 30 and includes a video “investigation”. The video attempts to mimic a news reportage by "Front populaire”.
(FAKE) Armenia’s prime minister Nikol Pashinyan used the money funneled from French agency to purchase a villa in France
The campaign was launched around June 6 and includes a video “investigation”. It also links to a fake media website infofrancaisedujour[.]fr . Additional fact check may be found in the TF1 INFO material.
Other campaigns
(FAKE) Ukrainian soldiers burned an American flag with effigies of Donald Trump and key members of his administration
The campaign was launched around March 25 and includes a video of people in a military uniform burning the effigies of Donald Trump and key members of his administration.
It bears extreme similarities with another campaign from Spring 2024, which was attributed as Storm-1516 by Microsoft. Coincidentally, it was was re-launched simultaneously with the new one.
(FAKE) Zelenskyy purchased South African mining company Northam Platinum
The campaign was launched around April 4 and includes a “video” investigation. Campaign also links to a likely sponsored publication on newsday[.]co[.]zw.
The video attempts to mimic a news reportage on "SABC News", a news division of the South Africa's public broadcaster SABC. SABC News refuted the video as fake.
(FAKE) Zelenskyy’s wife spent several million dollars on Princess Diana’s dress
The campaign was launched around April 24 and includes video “investigation”. The video attempts to mimic itself as being originated from British tabloid “The Sun”. Additional fact check may be found in the material by LeadStories.
(FAKE) Maia Sandy embezzled millions of USAID funds
The campaign was launched around May 23 and includes a video “investigation”. Campaign also links to a recently created website insider[.]eu[.]com.
An article by DFRLab highlights the prevalence of the false narratives by different actors in Russian propaganda landscape which are leveraging on the USAID activities in Moldova, which occurred before Storm-1516’s campaign.
(FAKE) Zelenskyy purchased a luxury apartment in Dubai for his mother
The campaign was launched around June 4 and includes video “investigation”. The video attempts to mimic itself as being originated from “Al Arabiya“, Saudi state-owned media. It can be heard clearly that narration in English was performed by John Mark Dougan. Additional fact check may be found in the material by “provereno.media” (in Russian).
fondfbr (R-FBI) campaigns
(FAKE) Ukrainian inciters recruit German teenagers and migrants for terrorist attacks under false AfD flag
Campaign date: February 1, 2025
(FAKE) Members of the German federal government are preparing the largest fraud in modern German history for the upcoming parliamentary elections
Campaign date: February 20, 2025
Fakespert: Nina Popova
(FAKE) Macron’s Assassination Squad: The French Leader Commands a Secret Army of Professional Assassins to Eliminate Critics and the Opposition
Campaign date: March 4, 2025
Fakesperts: Arnaud Develay and Thierry Laurent Pellet
(FAKE) Pedophile ring: how Zelensky’s close associates sexually abuse kids on Richard Branson’s private island
Campaign date: March 21, 2025
Fakesperts: Semyon Boykov (“Aussie Cossack”) and Chay Bowes
(FAKE) Christian Democratic Union of Germany leader Friedrich Merz enriched through illegal drug trafficking in Germany
Campaign date: April 1, 2025
Fakesperts: Nina Popova and Sascha Clauss-Theisoh
(FAKE) Leaders of Ukrainian Neo-Nazi Azov brigade recruit and rape underage children
Campaign date: April 17, 2025
Fakesperts: Cyrille de Lattre and Miodrag Zarkovic
(FAKE) Western pharma companies test toxic military grade steroids on Armenian women, children and the disabled
Campaign date: April 30, 2025
(FAKE) The pedophile church of Ukraine: how the Ukrainian schismatic church became a molestation center for underage parishioners and sexual exploitation of novices
Campaign date: May 25, 2025
Fakesperts: Priest Gennadiy Shkil and Ruslan Kalinchuk
(FAKE) Child trafficking business: How Moldovan authorities, led by Maia Sandu, are exporting Ukrainian orphans to the West
Campaign date: May 30, 2025
Fakeperts: Ilya Kiselev and Vladimir Bukarski
(FAKE) Maia Sandu’s Shadow Empire: How Moldova’s President and Her Entourage Are Making Billions from Drugs, Weapons, and Human Trafficking
Campaign date: June 18, 2025
Fakesperts: Dmitry Sorokin and Chay Bowes