Disinformation update: Moldova in focus, full-blown media impersonations, sanctions, rewards and more
Moldova in focus, Storm-1516's media impersonation gets taken further, EU sanctions against disinformation actors, CGE employees receive Russian government rewards, fondfbr video campaigns and more
Special highlights
EU Sanction designations
On July 16, 2025 EU imposed sanctions against several persons and entities, which are associated with the Russian hybrid threats. The list includes people and entities, which are associated with RTRS, GPS jamming in Baltics, Russian influence in Africa and disinformation. Among them:
Center for Geopolitical Expertise - a “think tank” which was founded by Alexandr Dugin and is headed by his associate Valery Korovin. CGE is the entity, which is ultimately responsible for the Storm-1516 disinformation campaigns, with directions being received from GRU.
Foundation to Battle Injustice (fondfbr, R-FBI) - a "foundation" which was inaugurated by Yevgeny Prigozhin and emerged as a sibling project to storm-1516 shortly after his demise. Its activities are likely to be curated by the same GRU group, which oversees Storm-1516.
BRICS Journalists Association (BJA) - a journalistic "association", which is co-chaired by Mira Terada, Lucas Leiroz, Edvard Chesnokov and several other people. Recently, we highlighted the role of Leiroz in the distribution of fondfbr disinformation campaigns.
Simeon Boikov - Russian propagandist of Australian origin, was one of the biggest Storm-1516 influencers until his X/Twitter account was suspended. It was recently exposed by OCCRP that he received help from Pravfond foundation, which is notorious for providing legal and financial assistance for the Russian spies, who got caught in foreign states.
Tigerweb and Yevgeny Shevchenko - company and its founder, which are associated with the Pravda network, also known as “Portal Kombat”.
Storm-1516 goes on a full-blown media impersonation spree
In late July of 2025, Storm-1516 went on a spree of copycat campaigns. While they previously did campaigns, which were impersonating the websites of the real organisations, they previously didn’t impersonate the websites of the real media to run their materials. It’s worth mentioning that there were prior video-only campaigns, which were impersonating the real media outlets. Until now, this style of campaigns with copycat websites was typical primarily to the “Doppelgänger” operation by the Social Design Agency (SDA) and the video campaigns are more typical for Matryoshka operation. It is highly likely that the Storm-1516 operators took inspiration from these actors.
Dougan’s personal plays
BBC and Mike Wendling
In December of 2023, BBC ran a story co-authored by Olga Robinson, Shayan Sardarizadeh and Mike Wendling about John Mark Dougan’s founding role in DC Weekly, which at the time was the main platform for the Storm-1516 campaign content. The story also described some of the first successes of the Storm-1516 operations, as one of the disinformation campaigns about the alleged yachts owned by people close to Zelenskyy was published on Twitter by Marjorie Taylor Greene and referenced by JD Vance in a TV interview.
In January of 2024, John Mark Dougan made a post in his Telegram channel with a link to a publication on the website bbc-uk[.]news, most likely in attempt to discredit Mike Wendling. The publication was made to look like it would be on the BBC website, and as if it was authored by Mike Wendling.
NewsGuard
In another instance, Dougan created a website under the domain newsguard[.]tech in March 2025. The website does not copy the NewsGuard branding and is titled as “News Guard Parody”. Its whole purpose was apparently to resurrect Dougan’s favourite fake author Jessica Devlin.
Earlier copycat websites
There is also a good number of campaigns, which were leveraging the specially crafted websites to copy the real organisations:
March 2024: French army recruitment website
June 2024: French political coalition “Ensemble“
September 2024: Kamala Harris election campaign
November 2024: Bundeswehr - German armed forces
May 2025: Friedrich Merz website
Video-only campaigns
At some point, Storm-1516 operators began playing with the video formats, which were mimicking as being originated from the real media outlets:
April 2025: South African “SABC News”
April 2025: British tabloid “The Sun”
April 2025: French journal “Front Populaire”
August 2024: Romanian news TV channel “Digi24”
Same name, different branding
In May of 2025, Storm-1516 launched a campaign against Armenia under the name of British tabloid “The Daily Mail“. However, they did not copy the branding, likely in order to avoid the copyright claim and takedown.
Full-blown impersonation campaigns
In the previous report, we wrote about the new trend of using the stolen identities of the real journalists for the fake media websites:
These campaigns triggered a significant reaction from the affected journalists and media outlets, which was met with the interest by the media in general. The amount of the media coverage could have incited the Storm-1516 operators to take it further and steal the “whole look” from the real media outlets. For example, in one of the internal documents of a different actor - Social Design Agency (SDA), which were published as a part of U.S. DOJ legal case against SDA, SDA claims their effectiveness, likely to their bosses, based on the reactions from foreign media and government organisations.
July 24: France TV
For this campaign, which was targeting France and Ukraine, a fake media website tvfrance2[.]fr was created, which took the branding of the “France TV” channel. The publication on the website was published using the stolen identity of a real “France TV“ journalist Arnaud Comte. The campaign also includes a video reportage, which is using the branding of “France TV” and of “Journal 20h00” program.
It is worth noting that Storm-1516 and John Mark Dougan were previously featured on “France TV” programs:
"Journal 20h00" on France 2 (part of France TV) aired an episode on Storm-1516 disinformation campaigns
In mid-June, France TV aired the in-person interview with John Mark Dougan in relation to his involvement in disinformation campaigns
July 30: OK! Magazine USA
For another campaign, now targeting Moldova, a fake media website okmagazine[.]us was created, which took the branding of the U.S. edition of “OK!“. The publication on the website was published using the stolen identity of a real “OK! USA“ contributor Rebecca Friedman. The campaign also included a video, which also used the “OK!“ branding.
August 1: Correctiv
In the last episode of the spree, which targets Germany, the Storm-1516 operators created a fake media website corrrectiv[.]org (with 3 ‘r’s), which was aimed to copy the German investigative outlet Correctiv. In this case, the website wasn’t built as a typical fake media outlet, which are usually filled with the AI-rewritten stories, even the index page wasn’t functional. All efforts went into crafting of the publication pages in English and German, which were published using the stolen identity of the real Correctiv reporter Jean Peters.
It is worth noting that Correctiv previously published on the Storm-1516 disinformation campaigns on several occasions. In January of 2025, our team together with Correctiv and NewsGuard exposed a network of more than 90 fake media websites associated with Storm-1516, which were created and subsequently used [1] [2] for the campaigns, which were targeting the German federal election.
Conclusion
This approach came with some significant downsides for the Storm-1516 operators: such stories are easily refuted as false by the real media outlets, and content takedowns are trivial on the copyright basis. These are likely the reasons why the following campaigns shifted back to more established approaches.
CGE employees received the government award
In early August, the messages started to appear by Valery Korovin, Natalya Makeyeva and John Mark Dougan that they were awarded the medals of order “For Merit to the Fatherland”: first class for Korovin, second for Makeyeva and Dougan.
According to the booklets, which were also published by the receivers, all the medals were awarded by the presidential decree from the same date. Korovin and Makeyeva only wrote that the details why they were awarded are secret.
Dougan wrote the following:
[…] For what? I can only assume that it was for my work in the information sphere, for educating the West about what is really going on here, and for my fight in the information war. The ceremony was very interesting: I had to read a long text in Russian, words that I can barely pronounce. And then I had to drink the vodka in which the medal was dipped. Other details of the ceremony are a secret. Well, I am grateful for such an honor from my new country. Russia will win, glory to Russia!
fondfbr (R-FBI) video campaigns
In the recent months, our team has observed a number of video-only campaigns under the brand of the “Foundation to Battle Injustice” (fondfbr, R-FBI). The materials are usually distributed in the video form through the same distribution network as used by the Storm-1516 operators without any corresponding materials being published on the foundation’s website. Some of the campaigns also follow the structure of the Storm-1516 videos, which further blurs the line between the two operations.
(FAKE) Testimony of an alleged Kit Kat club manager
The campaign was launched in early January 2025, most likely as part of the broader campaign of interference in 2025 German federal election.
(FAKE) Testimony of an alleged Ukrainian journalist who died after suffering injuries from Ukrainian soldiers
The campaign was launched around June 1.
The campaign may have been a counter-reaction to the real story of Ukrainian journalist Victoria Roshchyna, who was tortured to death in the Russian detention center in 2024. Her body was returned to Ukraine in February 2025 as “unidentified man” and missing several internal organs. It took some time to establish her real identity and for the first reports to come out in late April 2025. On August 7 2025, she was buried in Kyiv.
Ukrainian authorities are accusing the head of pre-trial detention center number 2 of Taganrog for organsation of torture of Roschyna. Per report by Mediazona, this detention center became “one of the most brutal places of detention for Ukrainians”.
(FAKE) Video alleging crackdown on journalists in Moldova
The campaign was launched around June 27.
(FAKE) Testimonies of forced evictions in the Armenian province Tavush
The campaign was launched around July 24.
(FAKE) Zelenskyy hired a hitman to get rid of Kyrylo Budanov
The campaign was launched on August 6.
It's worth noting that this campaign bears extreme similarities with the Storm-1516 video formats. It also alleges that the materials were uncovered by Anne Applebaum, who refuted the story as fake.
(FAKE) Zelenskyy involved in CSAM production and distribution
The campaign was launched on August 16.
John Dougan personal “investigation”
On July 24, Dougan published in his Substack what he called an “investigation” into the alleged properties of Rustem Umerov in the United States. Shortly after, the publications started popping up on his fake media network, for example on Turkish version of “truefact”, flga[.]news, and one of his older websites clearstory[.]news.
But it did not stop there, only a few days later, on July 29, Dougan went to a talk-show on Zvezda TV channel, which is owned by the Russian MOD, to talk about this “investigation”. In the course of the discussion, the host also cited one of the earliest Storm-1516 disinformation campaigns, which was hosted on “DC Weekly” website, which was also operated by Dougan.
In early August, the story was shared by some Russian telegram channels [1] [2] with a link to allstatesnews[.]us, which belongs to Dougan’s fake media network.
On August 29, the story was shared by Alina Lipp on X/Twitter and in her Telegram channel, along with a video narrated by Dougan.
Natalya Makeyeva praises herself through the “American” website operated by John Mark Dougan
As a Russian saying goes: "if you don't praise yourself, no one will". Supposedly, Natalya Makeyeva had the same idea in mind when she posted about a flattering publication in the "American" media about so called "Z-poets", in her post she really makes a point about "Americans" writing about "Z-art" and "Z-poetry" specifically. After all, she claims to be a poet. Unfortunately for her, so called "Z-art" is so irrelevant in the Russian society even among the ardent warmongers.
At the same time, they managed to shove in this graphomania into the anthology named “Heroic Pages of Russia” for the extracurricular reading for middle school students, which was presented by the CGE-affiliated Telegram channel “Отряд Ковпака“ (“Kovpak’s unit“).
The sad part is that the publications comes from walx[.]news, a website, which was exposed by our team to be a part of John Mark Dougan's fake media network. Together with Makeyeva, Dougan works in the Center for Geopolitical Expertise. In a later post, she complains that Facebook is now allowing her to publish the link to Dougan’s fake media website.
Campaigns
Storm-1516 campaigns
Focus is shifting to Moldova as the parliamentary elections come closer
Parliamentary elections in Moldova are planned to be held on 28 September of 2025. Moldova is a parliamentary republic, the system, which is common for many European states, makes the parliamentary election the most important one. It is also worth mentioning that the sitting president Maia Sandu is a founder and the former leader of the ruling party “Party of Action and Solidarity” (PAS), which currently has the majority of the seats in the parliament. The current cabinet is headed by the independent pro-EU politician Dorin Recean, and consists primarily of independents and PAS members.
Russia has a long history of attempts to seize the control of political leadership in Moldova. Currently, the major Russian-affiliated parties are associated with ex-president Igor Dodon and a fugitive oligarch Ilan Shor, who got most of his fortune through a large scale bank fraud. Ilan Shor has been accused of electoral fraud in form of a mass vote buying during the 2024 presidential election, which is expected to recur for the 2025 parliamentary election. In July, Maia Sandu named electoral corruption and illegal external financing from Russia as the biggest threats to the upcoming parliamentary election.
In the 2024 presidential election Sandu won with 51.74% in the first round and with 54.29% in the second round. The election was also united with a refendum on whether the country should amend the constitution to include the Moldovan citizens wish for EU membership. While the referendum was technically successful, it was on a very thin margin, as 50.35% of voters chose to say “yes”. On July 4, 2025 the first ever EU-Moldova summit was conducted.
Storm-1516 may be latest Russian FIMI actor to join the wider campaign against Moldova ahead of the parliamentary election. Russian state-affiliated campaign “Matryoshka” has been targeting Moldova since at least April 2025, per report by NewsGuard. Moldovan national security adviser Stanislav Secrieru declared that Russia is actively focusing its disinformation efforts on the Moldovan diaspora, which traditionally makes up a significant part of pro-European votes. Moldova and Maia Sandu also became a target in several fondfbr (R-FBI) “investigations”, beginning from late May of 2025: [1] [2] [3].
(FAKE) Maia Sandy embezzled millions of USAID funds
The campaign was launched around May 23 and includes a video “investigation”. Campaign also links to a recently created website insider[.]eu[.]com. The publication on the website was made under the stolen identity of the Romanian journalist Radu Dumitrescu.
(FAKE) Soros Foundation gave Maia Sandu €10 million to Promote LGBT in Moldova
The campaign was launched on July 21 and includes a poorly made video collage. It also link to a recently created website proudeurope[.]org.
Additional fact check may be found in the material by France 24 (in French).
(FAKE) Maia Sandu spent $400,000 on sperm samples from celebrities
The campaign was launched on July 30 and includes a video reportage. It also links to a recently created knockoff website okmagazine[.]us.
Additional fact check may be found in the materials by Myth Detector and France 24 (in French).
(FAKE) Moldova is selling electricity to the Romanian mining company Verde Magnesium as part of the corruption scheme
The campaign was launched on August 4 and includes a video “investigation. The video includes a comment, which is using the stolen identity of an expert Eugen Muravschi.
The campaign links to a recently created website eufiles[.]com. The publication on the website was made under the stolen identity of Marius Tian from Romanian TV news station “Digi24”.
(FAKE) Greek fearmongering campaign
The campaign was launched around August 5, the social media posts were linking to a publication Greek-speaking “analytical” website militaire[.]gr, which cites neostrategy[.]gr as the original source. A currently inactive “analytical” portal oneworld[.]press, which was believed to be associated with the GRU unit 54777 (and specifically InfoRos), listed “militaire.gr” as one of its partners.
A week later, some pro-Kremlin resources reported [1] [2] about a “protest” in Greece against NATO and military support for Moldova, the same reports also mentioned recent publications on the militaire[.]gr websites about the “dangers of Greek involvement with Moldova“. Some of the similar “protests” in January 2024 [1] and in April 2023 [1] [2] [3] in Greece were organised by the “Dostoevsky Institute”, which is headed by Andreas Zafiris.
The Greek vector may be associated with a recent arrest of Ilan Shor associate Vladimir Plahotniuc in the Athens airport. Plahotniuk was a key person in the 2014 Moldovan bank fraud and is believed to be involved in the Russian/Moldovan Laundromat scheme.
(FAKE) Testimony of an alleged electoral worker in Chisinau showing the ballots being pre-marked for the ruling party PAS
The campaign was launched around August 18 and includes a video “testimony”.
(FAKE) Parliament speaker and PAS leader Igor Grosu calling Moldovan people “flock of sheep”
The campaign was launched on August 25 and includes a vertical video, whch is using the branding of the Romanian news TV station "Digi24", which was also referenced in one of the prior campaigns.
Armenia
Armenia remains in the focus of the Storm-1516 operators. In the previous disinformation update we reported on 6 disinformation campaigns against Armenia.
In the previous report we went into the potential reasons why Armenia could have became a focus for the Storm-1516 campaigns. Since our previous report, there was a significant development: August 8, with mediation from U.S. and the American president Donald Trump, the president of Azerbaijan Ilham Aliyev and the Armenian prime minister Nikol Pashinyan signed the agreements, which are aimed to pave the way for the long-term peace and normalisation between two countries. The nature of agreements is also implying that U.S. will significantly increase its influence and involvement in the region, while the Russian influence is being diminished.
(FAKE) Testimony of an alleged protester, who was allegedly beaten and raped by the police
The campaign was launched around July 19 and includes a video “testimony”.
Additional fact check may be found in the material by fip.am (in Armenian).
(FAKE) Anna Hakobyan funnelled millions of dollars from the "City of Smile" charity foundation
The campaign was launched on August 14 and includes a video “investigation” and links to a recently created website euleaks[.]eu. The publication on the website was made under the stolen identity of a former France 24 journalist James Creedon.
Additional fact check may be found in the material by France 24 (in French) and fip.am.
(FAKE) Nikol Pashinyan has sold the "Spear of Longinus" from an Armenian monastery to the French billionaire François Pinault
The campaign was launched on August 28 and includes a video “investigation” and links to a recently created website newsofarmenia[.]am.
Ukraine
(FAKE) Zelenskyy imposed sanctions against prominent American political and media figures
The campaign was launched on July 28 and includes a vertical video, which is using the branding of “The Kyiv Independent”. The story was refuted as fake by the Kyiv Independent.
The campaign alleges that Volodymyr Zelenskyy imposed sanctions against Marjorie Taylor Greene, Steve Bannon, Tucker Carlson, Elbridge Colby, Mike Lee, Mike Flynn and Donald Trump Jr.
The campaign may be considered as a success for the perpetrators, as it was quoted by Mike Flynn.
(FAKE) NABU whistleblower exposing Zelenskyy’s corruption
The campaign was launched on August 25 and was distributed with a link to a recently created website londontelegraph[.]uk.
France
(FAKE) 51% of French electrical company EDF sold to Oleksiy Chernyshov for 1 euro
The campaign was launched on July 24 and includes a video “reportage” and links to a knockoff website tvfrance2[.]fr.
The reportage also includes a fragment with a real reporter. We believe it’s extremely likely that it is the same person, who played a reported in several prior Storm-1516 campaigns targeting France.
Additional fact check may be found in the material by AFP (in French).
(FAKE) Macron launched a special program to ease migration from African countries
The campaign was launched on August 21 and includes a video “advertisement”. The story was sometimes being distributed with a links to the likely paid publications on obscure African news websites actucameroun[.]com and 237actu[.]com. This is not the first time when actucameroun is being used for the Storm-1516 campaign content distribution: in one case it was a video of an alleged threat from HAMAS to attack Paris Olympics; and in another, it was about an alleged lover of Emmanuel Macron who died from AIDS. The campaign also employs a specially created X/Twitter and YouTube accounts.
It is worth mentioning that the immigration is becoming a recurring themes for the Storm-1516 disinformation campaigns against the western countries: [1] [2] [3].
Additional fact check may be found in the materials by AFP (in French) and KNWLDG Media (in French).
Germany
(FAKE) Friedrich Merz prevented a vote of no confidence against EU Commission President Ursula von der Leyen as part of the corruption scheme
The campaign was launched on August 1 and includes a vertical video, which is using Correctiv brand. It also links to German and English articles on a knockoff website corrrectiv[.]org.
Additional fact check may be found in the material by Correctiv (in German).
fondfbr (R-FBI) campaigns
(FAKE) Bloody Ukrainian Scam: Zelensky and His Close Circle Profit by Exploiting Disabled Veterans and Taking Part in Their Extermination
Campaign date: July 29, 2025
Fakesperts: Simeon Boikov
(FAKE) Armenian Jeffrey Epstein: How Speaker of the Armenian Parliament Alen Simonyan built a pedo-empire for high-ranking officials
Campaign date: August 20, 2025
Fakesperts: Chay Bowes and Movses Ghazaryan
(FAKE) The bloody alliance of Sandu and Zelensky: Moldovan executioners in the service of the Kiev dictatorship
Campaign date: August 29, 2025
Fakesperts: Raphael Machado and John Varoli