Recent Social Design Agency leak points to Storm-1516 coordination with the Presidential Administration
The leaked documents and communications point to Storm-1516 coordination with the Presidential Administration (PA), and may indicate a degree of coordination between GRU and PA
A recent leak of the Social Design Agency (SDA) documents includes a trove of documents and captures communications originating from SDA-associated resources. Among the documents are proposals for SDA influence operations against Armenia, Ukraine, Israel, and EU countries. The leak also includes a series of screenshots capturing some of SDA’s technical infrastructure, as well as screenshots from the “VK Teams” (Russian “Slack” alternative) server, which appears to be associated with SDA. According to the user directory, which is also a part of the leak, among known “VK Teams” server users are SDA employees, Internet Development Institute (IRI) chief Alexei Goreslavskiy, and Stanislav Starostin, who is involved with both IRI and ANO “Dialog”, another PA’s subcontractor for propaganda and disinformation. The user directory also includes Sofiya Zakharova, an official from the Russian Presidential Administration (PA), and her subordinate Margarita Klimanova. By our assessment, the scope of the “VK Teams” server may not be limited to SDA alone, but is likely to include the entire ecosystem of propaganda and disinformation for export, which lies under the control of PA. The chats were very likely captured from the perspective of the “Kristin Killer” account, which, according to the user directory, belongs to Sofiya Zakharova.
In one of the conversations, Zakharova sent a list of questions to a person codenamed “Immanuel Kant”:
Questions for Ilya:
1. For what purpose did you take notes on all the closed meetings on the international project (IP)?
2. Did you plan to share them with anyone? With whom?
3. Did you plan to publicise the IP materials internationally? For what purposes?
4. Do you work for foreign intelligence agencies, government agencies, legal entities, or individuals? Which ones?
Questions for Nikolai:
1. You are responsible for information security at your company. How did it happen that a foreign intelligence agency easily penetrated your team’s computer network and extracted all of the company’s classified information?
2. Did you intentionally or unknowingly give foreign organisations access to the company’s classified data?
3. After installing “virtual machines,” someone else’s account, under the username N21, attempted to log into the network and access other Teams user accounts. Are you aware of this incident? Who is behind it?
4. Do you work for intelligence agencies, government agencies, or private companies/individuals in foreign countries? If so, which ones?
“Immanuel Kant” is likely one of Zakharova’s assistants, as she is asking them to print the documents and other texts. The questions were destined for Ilya Gambashidze and Nikolay Tupikin, the men behind SDA operations. While Tupikin technically heads a different organisation, “GK Struktura”, it is de facto an integral part of SDA’s operations. The questions, as well as another report, refer to an earlier SDA hack in 2024. SDA became one of the Presidential Administration’s favourite tools for producing propaganda and disinformation for export. SDA is behind a network of media brands websites, Doppelganger operation, and a handful of ad hoc projects. SDA also routinely develops plans for election interference; among the recent ones is an unsuccessful plan to keep Viktor Orban in power, reportedly endorsed by Putin, and ongoing plans for election interference in Armenia, which are also partially present in the leak. The whole “disinformation for export” ecosystem is evidently coordinated by Sofiya Zakharova, an official from the Presidential Directorate for the Development of Information and Communication Technology and Communication Infrastructure, which is a part of the Russian Presidential Administration.
One of the captured conversations was with “Edward Bernays”, an unidentified person codenamed after an Austrian-American pioneer in the field of public relations and propaganda. Most of the available messages from their conversations concern plans for sabotage operations in Western countries aimed at disruptive media coverage. In one case, Zakharova’s chatmate, adding that “they’re writing about us”, sent a link to a DW article regarding the arrest of several people in Germany, who were suspected of plugging the exhaust pipes of several hundred cars and placing “Be greener!” stickers to create the impression that the Greens were responsible for the attack. The messages and documents also contain plans and reports for several sabotage operations in France. One of the reports describes the execution of the “Pig Head” operation from September 2025, in which the pig heads with “Macron” inscription were placed next to mosques and islamic cultural centres in Paris. According to a “Dossier” center source in the Presidential Administration, a similar sabotage operation, during which blue Stars of David were painted on several buildings in Paris, was organised by GRU agents. According to VIGINUM, one of the main channels for distributing photographs for the “Stars of David” diversion was bots associated with SDA. The information about the sabotage operation also reportedly appeared on at least one SDA media brand website. The same “Dossier” center publication states that other similar sabotage operations aimed at media coverage were organised by a group of GRU officers led by Denis Smolyaninov. It was later reported that Smolyaninov heads a department within the GRU’s “Special Activities Service” (SSD), which absorbed Unit 29155, previously the primary unit for sabotage operations abroad. It is highly likely that “Edward Bernays” is connected to the GRU, and through this contact, the intelligence service is approving similar sabotage operations in Western countries aimed at generating disruptive media coverage with the PA representative Sofiya Zakharova.
With the same chatmate, Zakharova shared a report detailing “successes in Armenia” related to the disinformation campaign about “Pashinyan’s mansion in Marseille”, and a report on the “Zelenskyy corruption” campaign. Both campaigns were previously attributed to the Storm-1516 group by our team, and the reports themselves were certainly composed by the Storm-1516 team. The reports also mention 17-19 “counterparties” that spread the narratives, underlining that publications by these counterparties alone generated millions of views for these materials. The reports also devote special attention to debunks and their reach. The correspondence implies that the activities of the Storm-1516 group are, at a minimum, coordinated with Sofia Zakharova from the Presidential Administration.
In one of the messages, “Edward Bernays” also sent out a specification for an information campaign for the Internet Governance Forum (IGF) 2025. Among the proposed disinformation campaign options, one idea was to promote a narrative that the forum would be held without representatives from developing countries due to “risks of illegal migration”, and another was related to the impossibility of hosting all forum visitors in Lillestrøm, the city near Oslo where the forum was held. The set goal was to “provoke a political scandal related to the organisation of the IGF forum in Norway” and “discredit Norway as the organiser and damage its reputation”. In June 2025, Storm-1516 conducted a disinformation campaign, albeit with a slightly different narrative: it promoted a false narrative of an “environmental disaster” in a river near the forum site. The reason behind the intent to disrupt the forum is simple: Russia placed a bid to host IGF 2025 as early as 2020, and Russian authorities even alleged that they had received confirmation from the forum organisers to host the forum. In April 2023, the Norwegian government announced their bid to host the forum. In the end, Norway was picked over Russia, and the forum was conducted in Lillestrøm from 23 to 27 June.
If the assumption about the involvement of “Edward Bernays” with GRU turns out to be correct, it further confirms the coordination of the Storm-1516 group operations with the GRU, although the GRU’s exact role in the group’s operations is not entirely clear. Previously, the U.S. Treasury Department reported in a sanction designation press release that a GRU unit that “oversees sabotage, political interference operations, and cyberwarfare targeting the West” provided the financial support and guidance for the Center for Geopolitical Expertise (CGE) and their U.S.-based facilitators (almost certainly John Mark Dougan - GP) to build an AI server and a network of 100 websites. John Dougan was one of the key contractors for the Storm-1516 group in the run-up to the U.S. presidential election, at least from late 2023 until late 2024, as he was responsible for the operation of the fake media websites during that period; however, our team found no clear evidence of Dougan’s involvement in the website operations starting from 2025. According to a Washington Post article in October 2024, Dougan and CGE, a “think tank“, headed by Valeriy Korovin, were working under the guidance of an officer of the GRU unit 29155, Yuriy Khoroshenky. CGE had been collaborating with Khoroshenky since at least 2021, the same year when Dougan joined the CGE team. At the same time, Dougan is likely still involved in the content production for Storm-1516 group, as one of the campaigns’ narration clearly featured his voice.
Since 2025, Storm-1516 has shifted their tactics to deploy throwaway websites unique to each narrative, except for the larger scale strategic campaigns, like the parliamentary elections in Germany and in Moldova. For the German parliamentary election in 2025, Storm-1516 operators set up a network of 100 fake media websites, which were exposed by our team, together with NewsGuard and Correctiv. For the parliamentary election in Moldova, Storm-1516 operators set up a network of at least 175 websites, a part of which was dedicated for Storm-1516 materials, and another part was likely responsible for the amplification of materials from specific pro-Russian media resources.