MEBRO

DISINFO DESK

International

Storm-1516: Inside Russia's Most Prolific AI Disinformation Operation

Microsoft, the European Union, and independent researchers have each separately tied Storm-1516 to Russia's GRU military intelligence service — and the EU sanctioned its lead operative in December 2025.

TRUE ✓

FILED OCT 5, 2026 · UPDATED OCT 5, 2026 · 10 SOURCES

Operation Overview

Storm-1516 is a real, well-documented Russian influence operation, not a single fabricated claim. Microsoft's Threat Intelligence team named Storm-1516 as one of several Kremlin-aligned actors pushing content against the Harris-Walz campaign during the 2024 U.S. election cycle [1].

The European Union's own sanctions regulation, adopted in December 2025, states that reports from Western authorities and independent investigators link operative John Mark Dougan's activities to Russia's military intelligence agency, the GRU, through his support of Storm-1516 [2].

Independent researchers at the Atlantic Council's DFRLab separately found that the operation's web and social-account infrastructure carries "signatory patterns characteristic of those... attributed to the Main Intelligence Directorate (GRU)" [3].

NewsGuard independently describes Storm-1516 as "a Russian influence operation that includes the efforts of John Mark Dougan, a former Florida deputy sheriff granted asylum in Moscow turned Kremlin propagandist that uses AI to create and spread false claims" [10].

2025–2026 Campaigns

The operation's 2025–2026 campaigns ranged from fabricated celebrity-politician scandals to staged anti-corruption videos. Threat-intelligence firm EclecticIQ assessed with high confidence that Storm-1516 very likely created AI-generated images falsely depicting UK Labour leader Keir Starmer, French President Emmanuel Macron, and German Chancellor Friedrich Merz possessing illegal drugs, timed to their May 2025 visit to Kyiv [4].

Meduza documented a long-running Storm-1516 narrative accusing associates of Ukrainian President Volodymyr Zelensky of diverting Western military aid, including a 2023 fabrication that they bought two yachts worth $75 million — a claim later repeated publicly by then-Senator JD Vance — and a November 2025 fake video mimicking Ukraine's anti-corruption bureau [5].

Ahead of Germany's February 2025 federal election, VSquare found the network had built more than 100 fake news sites pushing fabricated accusations against Green politician Robert Habeck, Foreign Minister Annalena Baerbock, Bundestag defense-committee chair Marcus Faber, and CDU leader Friedrich Merz [6].

Techniques Used

AI-generated audio, video, and images are the operation's signature — though not every fabricated clip is a technical "deepfake"; some instead rely on stolen media branding. The EU's sanctions listing describes Storm-1516-linked sites spreading "fabricated stories and AI-generated deepfake content" [2].

In August 2026, a fabricated video carrying stolen Deutsche Welle and Handelsblatt branding falsely claimed Merz planned to resign; a security source told AFP the video's creator was "probably Storm 1516" [7].

The operation seeds stories on Telegram before amplifying them through coordinated X/Twitter accounts: DFRLab found Telegram "played [a] significant role in amplifying the falsehoods," while VSquare traced distribution through specific Telegram channels with six-figure follower counts alongside Twitter bot networks [3][6].

Key Operatives

John Mark Dougan is the operation's best-documented human face, and he is now under EU sanction for it. Dougan, a former Palm Beach County, Florida sheriff's deputy who fled to Russia in 2016, was added to the EU's Russia sanctions list in December 2025 for operating the "CopyCop" network of fake news sites and "supporting Storm-1516 activities" [2].

France's disinformation-monitoring agency VIGINUM, cited by fact-checking outlet StopFake, separately identified a "potential officer of the GRU Unit 29155," Yury Khoroshenky, as "publicly accused of financing and coordinating Storm-1516" [8].

NewsGuard named Dougan its 2024 "Disinformer of the Year" for producing fabricated local-news reports and fake whistleblower testimony distributed through his site network, according to the disinformation-tracking group MEDDMO [9].

Conclusion

Multiple independent investigators now converge on the same picture. Microsoft, the European Union, France's VIGINUM, the Atlantic Council's DFRLab, NewsGuard, and independent outlets including Meduza and VSquare have each separately documented Storm-1516 as a real, GRU-linked Russian influence operation that has used AI-generated content, fabricated documents, and fake whistleblower personas against Ukraine-aid narratives and Western politicians since 2023, with new fabrications continuing into 2026 [1][2][3][5][6][8][9].

SOURCES · 10

  1. [1]*Microsoft*: Russian election interference focuses on Harris-Walz — blogs.microsoft.com

    72/100 · blogs.microsoft.com

  2. [2]Council of the EU: Sanctions Regulation 15726/25 (Dougan listing) — consilium.europa.eu

    72/100 · data.consilium.europa.eu

  3. [3]*DFRLab*: Storm-1516 operation targets the Baltic states — dfrlab.org

    72/100 · dfrlab.org

  4. [4]*EclecticIQ*: Storm-1516 deploys AI-generated media against European leaders — blog.eclecticiq.com

    72/100 · blog.eclecticiq.com

  5. [5]*Meduza*: Storm-1516 is flooding the West with fake stories — meduza.io

    72/100 · meduza.io

  6. [6]*VSquare*: Hacking Democracy — Russia's Digital War on German Elections — vsquare.org

    72/100 · vsquare.org

  7. [7]*The Local Germany*: Russia-linked group blamed for fake Merz resignation video — thelocal.de

    72/100 · thelocal.de

  8. [8]*StopFake*: Analysis of the Russian Information Manipulation Dataset Storm-1516 (citing VIGINUM) — stopfake.org

    72/100 · stopfake.org

  9. [9]MEDDMO: Who is John Mark Dougan, sanctioned by EU for disinformation? — meddmo.eu

    72/100 · meddmo.eu

  10. [10]*NewsGuard*: Russian propaganda campaign targets France with AI-fabricated scandals — newsguardtech.com

    86/100 · newsguardtech.com

MEBRO · DISINFO DESK · mebro.app

Investigative report — not a user-submitted fact-check.

AI-built, source-verified. Every claim here was checked against the sources cited above before publishing — but don't just trust us: follow any citation to its source and confirm it yourself. That's the whole point.