Disinformation update: stolen identities, Armenia in focus, first campaign to target Norway
Storm-1516 is focused on Armenia; why target Norway; Storm-1516 operators began using the stolen identities of the real journalists; role of Lucas Leiroz in Storm-1516 and R-FBI distribution and more
Special highlights
Storm-1516 and stolen identities
Recently, our team has discovered four episodes when Storm-1516 operators used the identities of the real journalists for publications on their fake media websites. One in campaign against Moldova, two simultaneously targeting France and Armenia and one targets Germany through a “Canadian” website.
Preamble: the case of Jessica Devlin
To our knowledge, the Storm-1516 operators haven’t previously used the stolen identities of journalists in this manner, but one vaguely similar case comes to mind. In the early days of Storm-1516, when campaigns were primarily published on a limited set of websites operated by John Dougan, the persona of Jessica Devlin was used very actively. The persona was used with a photo of a book author Judy Batalion.
And Dougan was really committed to this identity. Apart from disinformation campaigns, the identity was used in March 2024 to publish Dougan’s reponse to NYT publication on Storm-1516 activity during that period. Shortly after, she was “killed”, which didn’t stop the publications under her name. And in March 2025, she was “resurrected”.
Moldova: Radu Dumitrescu and “Romania Insider”
We covered this campaign in our previous report, but the author’s identity didn’t caught our attention. The article on insider[.]eu[.]com was published under the identity of Radu Dumitrescu.
The real Radu Dumitrescu appears to be an editor in “Romania Insider”, which also explains inspiration behind the name for the fake media website.
France: Romain Fiaschetti, “Public” and “Voici”
The article on courrierfrance24[.]fr was published under the stolen identity of Romain Fiaschetti, who is an author in “Public”. This episode was initially covered by TF1 INFO.
Other stolen identities of “Public” contributors:
Other stolen identities of “Voici” contributors:
Based on the profile’s URL path, there is an indication that the author profiles were renamed after their creation. For example, path for “Clément Garin” is “/author/gilles-emmanuel-jacquet”, which we were able to trace (along with the other identities) to Stratpol, a French-speaking and pro-Kremlin “analytical” website, which was created by Xavier Moreau:
Clément Garin (“/author/gilles-emmanuel-jacquet“) was Gilles Emmanuel Jacquet
Victoria Buisson (“/author/hakim-ouchene“) was Hakim Ouchene
Sophie Varon-Vollet (“/author/hedi-ennaji“) was Hedi Ennaji
Inès Denne (“/author/mike-werbrouck”) was Mike Werbrouck
Faustine Renaud (“/author/nicolas-dolo”) was Nicolas Dolo
We also found several other authors stolen from Stratpol, which weren’t renamed:
France: Audrey Parmentier and “StreetPress”
The article on enquetedujour[.]fr was published under the stolen identity of Audrey Parmentier, who is an author in “StreetPress” and contributor to “Le Monde”. This episode was initially covered by franceinfo, Le Monde and StreetPress.
Other stolen identities of “StreetPress” contributors:
Canada: Toronto Star
A website with “Canadian” backstory torontojournal[.]ca was used in the recent campaign to target German chancellor Friedrich Merz. In this episode, the Storm-1516 operators decided to publish the material under the neutral account “Torontojournal”, but its front page specifies real journalists from “Toronto Star” as authors:
Lucas Leiroz and fondfbr (R-FBI)
In the recent time, Lucas Leiros became the key spreader for campaigns originating from the “Foundation to Battle Injustice” (fondfbr, R-FBI).
Samples: [1: VT / X] [2: VT / X] [3: VT / X]
The foundation was inaugurated by Yevgeny Prigozhin in 2021 and is headed by Mira Terada (also known as Oksana Vovk). The foundation’s began making the fake "investigations" shortly after Prigozhin’s demise in 2023. It’s also one of a few Prigozhin’s projects to outlive him.
The pattern goes as follows:
fondfbr makes the publication on the main website
it's published by Lucas Leiroz on vtforeignpolicy[.]com
it's distributed with the link to vtforeignpolicy through the same social media networks, which are used to spread the Storm-1516 campaigns
Some of the storm-1516 campaigns were also published by Leiroz on vtforeignpolicy, primarily from December 2024 to January 2025: [1] [2] [3] [4] [5] [6], and some on his twitter account: [1] [2].
vtforeignpolicy[.]com is the current address for “Veterans Today”, a conspiracy oriented and largely antisemitic website associated with Gordon Duff. Another website associated with Duff, “The Intel Drop” (theinteldrop[.]org) for a long period was one of the major platforms for placement of Storm-1516 and fondfbr campaigns.
Leiroz seems to take part in numerous initiatives:
He is a founding member of Brazilian branch of Nova Resistência, a movement, which is ideologically aligned with Alexander Dugin’s “Eurasian Movement”. Movement’s leader Raphael Machado was recently exposed for working with the Social Design Agency (SDA). SDA is the organisation behind multiple disinformation operations on order by Russian Presidential Administration. Their most widely known campaign is Doppelgänger.
He is an "expert" of "Global Fact-Checking Network", which was recently co-created by ANO Dialog and TASS. Of course, no fact-checking is performed here.
He is a “chairman of the committee for cooperation with BRICS” in the “Center for Geostrategic Studies” (CGS, geostrategy[.]rs), a Serbian think-tank headed by Dragana Trifkovic. CGS is very closely tied to many actors of “Eurasian” universe.
He is among of chairmen of “BRICS Journalists Association“ together with Mira Terada and others.
He is a member of recently founded Brazilian think tank “Sovereignty Association“ (sovereignty[.]com[.]br).
He played a fakespert for one of the fondfbr campaigns against Ukrainian president Volodymyr Zelenskyy in April 2024.
He writes for InfoBRICS, Strategic Culture Foundation and Russia Today.
His wife, Catarina Leiroz, also seems to be a member of Nova Resistência. Her X/Twitter account links to her profile on geopolitika[.]ru, an “analytical” portal operated by the Center for Geopolitical Expertise.
Campaigns
Storm-1516
Armenia in the crosshairs
Our team has discovered a series of disinformation campaigns against Armenian political establishment and specifically against Armenian prime minister Nikol Pashinyan.
The earlier campaigns may be linked to the recent developments in the relationship between Armenia an Azerbaijan. In March, it was reported that a peace treaty between the two countries was “ready to be signed”.
The campaigns intensified following the escalation of the conflict between the Armenian government and Armenian Apostolic Church (AAC) after May 28. According to the available analysis, AAC became de-facto the main opposition force in the recent years. One campaign is targeting this rift directly.
On June 20, Nikol Pashinyan visited Turkey and met with Turkish president Recep Tayyip Erdogan as part of his approach to normalisation of complex relationships with the neighbouring countries. This approach also implies the country’s gradual shift outside of the Russian sphere of influence.
Two campaigns also include France as a second target. France continuously remains probably the biggest western ally of Armenia. On May 26, it was announced during the visit by French foreign minister to Armenia that two countries are preparing the “strategic partnership” agreement.
(FAKE) Rape allegation against Nikol Pashinyan
The campaign was launched around April 24 and includes a “tiktok” video with a testimony with the rape allegation against Armenian prime minister. Additional fact check and analysis may be found in the publication by fip (in Armenian).
(FAKE) Azerbaijan’s president Ilham Aliyev awarded Order of Friendship (“Dostlug”) to two armenian officials
The campaign was launched around May 15 and includes a video “reportage”, under the “DailyMail” name, it also links to a fake media website dailymail[.]uk[.]net under the same brand. While it’s using the DailyMail name, the logo doesn’t match the original, possibly to avoid being taken down for the copyright infringement.
(FAKE) Armenia’s prime minister Nikol Pashinyan used the money funneled from French agency to purchase a villa in France
The campaign was launched around May 29 and includes a video “investigation”. It also links to a fake media website infofrancaisedujour[.]fr . Additional fact check may be found in the TF1 INFO material.
(FAKE) Pashinyan performed a ritual with burning of the cross with the photos of key people of Armenian church
The campaign was launched around June 19 and includes a video of a “ritual”, which includes a person, who looks like the Armenian prime minister, and the burning of the cross with the photos of key people of Armenian church.
(FAKE) French nuclear fuel cycle company Orano will store nuclear waste in a national park in Armenia
The campaign was launched around June 26 and links to the recently created websites greenarmenia[.]org and courrierfrance24[.]fr:
greenarmenia[.]org attempts to pose itself as an Armenian “environmental NGO“
courrierfrance24[.]fr is a fake media website, which used the stolen identities of the real journalists from “Public” and “Voici”
The claim was publicly rejected by Orano. Additional analysis and fact checking may be found in a publication by TF1 INFO.
(FAKE) Anna Hakobyan, Pashinyan’s wife, spend $100,000 on vacation in Turkey
The campaign was launched around June 26 and links to a publication by Okay Deprem on dikgazete[.]com. The same narrative also appeared on OdaTV by the same author.
The campaign is likely linked to Pashinyan’s visit to Turkey on June 20, which included a meeting with Turkish president Recep Tayyip Erdogan.
Earlier campaign from July 2024, which alleged that Zelenskyy purchased hotel and casino "Vuni Palace" also originated from a publication by Okay Deprem in OdaTV.
France
(FAKE) French surgeon died in connection to Brigitte Macron’s alleged transgender identity
The campaign was launched around July 1st and links to a recently created fake media website enquetedujour[.]fr, which used the stolen identities of the real journalists from “StreetPress”. Additional analysis and fact checking may be found in publications by franceinfo, Le Monde and StreetPress.
Norway and “Internet Governance Forum”
(FAKE) Mass death of wildlife caused by high concentration of deuterium in the Nitelva river in Norway
The campaign was launched around June 15 and includes a video reportage and links to a recently created website ndc[.]eu[.]com. The website poses as an “environmental NGO”.
The campaign materials allege that cancellation of “Internet Governance Forum” is possible due to the pollution, which may be the actual motivator behind the campaign. Russia placed the bid to host the 2025 forum as early as 2020 and Russian authorities even alleged the confirmation from the forum organizers to host the forum. In April 2023, Norwegian government announced their bid to host the forum. In the end, Norway was picked over Russia and the forum was conducted in Oslo from 23 to 27 June.
Germany
(FAKE) Friedrich Merz killed a polar during a hunting tour in Canada
The campaign was launched around July 4, and includes a video “investigation” with a testimony from an alleged local inhabitant. It continues the series of campaigns, which began after the formation of government in Germany under the leadership of Friedrich Merz.
The campaign also links to a publication in a recently created fake media website torontojournal[.]ca, which is also using the stolen identities of “Toronto Star” journalists.
fondfbr (R-FBI) campaigns
(FAKE) Moldova on the Brink of a Bloodbath: Maia Sandu Legalizes the Killing of Citizens by Officials
Campaign date: July 3, 2025
Fakesperts: Ilya Kiselyov and Alexander Mitryuk