# Storm-1516 Storm-1516 is a Russian influence operation, first identified by the [[Clemson Media Forensics Hub]] in late 2023, that manufactures fake scandals. Its standard product is a staged video: an actor posing as a whistleblower, a victim or an eyewitness, sometimes with forged documents or AI-altered audio. The video is first posted by a throwaway account or an obscure "news" site, then laundered through fake local-news websites and large anonymous accounts until it reaches real influencers and, occasionally, real politicians. Where [[Operation Overload]] floods fact-checkers with quick fakes, Storm-1516 makes fewer, more elaborate fabrications built to be repeated as news. ## Names - **Storm-1516** — Microsoft's designation. Bloomberg reports that Microsoft named the operation in 2024 and later relabeled it **Neva Flood** under its newer naming scheme. - **CopyCop** — [[Recorded Future]]'s name. Its September 2025 report describes CopyCop as "also known as Storm-1516." - The network of fake American local-news sites run by [[Mark Dougan]] — DC Weekly and similar outlets — is one of the operation's main distribution channels, not a separate operation. ## Who is behind it The attribution record has converged on Russian military intelligence, working through a Moscow think tank and remnants of the old troll factory: - **The Internet Research Agency's successors.** Researchers trace its staff to the [[Internet Research Agency]]. Clemson's Darren Linvill called it "IRA 2.0. It's the same people, it's the same network, it's the same old ownership" (NPR, Nov 2024). Clemson also links it to the Foundation to Battle Injustice, an outfit founded by [[Yevgeny Prigozhin]]. - **The [[GRU]].** In October 2024 the Washington Post reported documents, obtained by a European intelligence service, showing that Dougan "was provided funding by an officer from the GRU." Payments to his Moscow bank account began in April 2022. The officer, using the cover name Yury Khoroshevsky, was identified by two European security officials as Yury Khoroshenky of GRU [[Unit 29155]] — the unit also tied to sabotage and assassination operations in Europe. Recorded Future (2025) likewise describes the operation as run with support from the GRU and the Center for Geopolitical Expertise. Bloomberg (2026) reports a Ukrainian intelligence assessment that Unit 29155 paid for the network's servers and AI tools. - **The [[Center for Geopolitical Expertise]].** A Moscow institute founded by [[Alexander Dugin]] and headed by Valery Korovin. Per the Post's documents, Khoroshenky served as its deputy director under his cover name. Dougan dealt with Korovin. Korovin dismissed the documents as "accidentally combined moments of information," and [[Alexander Dugin]] called any suggestion of GRU affiliation "completely unjustified." Dougan told the Post that "no one sends me money for anything." **Government action.** France's [[VIGINUM]] published a report on the operation in May 2025, counting 77 operations since 2023 and naming Khoroshenky as its central figure. France's foreign ministry condemned it on May 6, 2025. The U.S. Treasury sanctioned the Center for Geopolitical Expertise and Korovin on December 31, 2024 for interfering in the 2024 election. The European Union sanctioned the institute on July 15, 2025, the UK sanctioned it along with Dugin on December 9, 2025, and the EU sanctioned Dougan on December 15, 2025 for supporting CopyCop/Storm-1516. ## Signature fabrications | Date | Fabrication | Outcome | |---|---|---| | Oct 2023 | Video of a supposed Hamas fighter thanking [[Volodymyr Zelensky]] for weapons | No such shipments occurred | | Nov–Dec 2023 | Claim that Zelensky's associates bought two yachts worth $75 million with Western aid | Brokers said the sale documents were fake; repeated by [[JD Vance]] and [[Marjorie Taylor Greene]] | | 2023–2024 | Claim that Olena Zelenska bought a Bugatti with U.S. aid | Debunked; carried on [[Mark Dougan]]'s sites | | July 2024 | Video of supposed Hamas threats against the Paris Olympics | Microsoft assessed it as consistent with Storm-1516; Hamas denied producing it | | Sept 2024 | Story that [[Kamala Harris]] paralyzed a girl in a 2011 San Francisco hit-and-run | The "victim" was a paid actor, the X-ray came from a medical journal, the "KBSF-TV" station does not exist, and police said no such accident happened | | Oct 2024 | Allegations that [[Tim Walz]] abused a former student | Federal officials attributed it to Russia; Wired found one video was a deepfake; Dougan's network republished it widely | | Oct 24, 2024 | Video purporting to show mail ballots destroyed in Bucks County, Pennsylvania | Bucks County said the materials were not authentic; federal officials attributed it to Russia | | July 2026 | Video of hooded "Hezbollah" fighters threatening a Bastille Day attack in France | Researchers said it was possibly Storm-1516; AFP traced its spread to pro-Russian accounts | The yacht story is the clearest case of a Storm-1516 fabrication reaching a sitting U.S. senator. Per the BBC's December 2023 reporting, Vance, discussing budget priorities, said: "There are people who are willing to cut social benefits, condemn our grandparents to poverty, and for what? So that Zelenskiy's ministers can buy bigger yachts?" Bloomberg's 2026 investigation found Vance — now vice president — cited the claim while opposing further aid to Ukraine, and that Greene posted it too. ## Scale and machinery - **Volume.** Bloomberg identified more than 190 fabricated stories from August 2023 through March 2026. More than 40% aimed to undermine support for Ukraine, and about a third targeted elections in other countries. In Q1 2026 the operation put out more than twice as many narratives as in Q1 2025. - **Websites.** Recorded Future found at least 200 new CopyCop sites in 2025. With 94 German-targeting sites reported in February 2025, that comes to at least 300 for the year. - **AI.** Dougan's sites originally used commercial tools such as ChatGPT. By 2025, Recorded Future found the network running self-hosted, uncensored [[Large Language Model]]s built on Meta's Llama 3 — infrastructure the GRU reportedly helped fund after Western AI providers became harder to use. - **Reach.** [[NewsGuard]] estimated in October 2024 that content from Dougan and associated Russians had drawn 64 million views since September 2023. - **Amplification.** Bloomberg found that the top-posting account, "Johnny Midnight," had more than 630,000 followers. X banned it after Bloomberg's inquiry and reinstated it a week later. ## Targets since 2024 - **United States, 2024.** The [[2024 Presidential Election]] wave of fabrications against Harris and Walz. In the campaign's final days, ODNI, the FBI and CISA attributed several fake videos to Russian influence actors — including the Bucks County ballot video and a Georgia "Haitian voters" video — calling the activity part of "Moscow's broader effort to raise unfounded questions about the integrity" of the election. - **Europe, 2025.** Germany's February federal election and Moldova's elections (Recorded Future; Bloomberg). France, Canada and the EU also appear among Recorded Future's targets. - **2026.** "Several dozen" items during [[Hungary]]'s April parliamentary election, which [[Viktor Orbán]] lost to [[Péter Magyar]]. More than 25 items aimed at [[Armenia]]'s June elections and [[Nikol Pashinyan]]. Fabrications about [[Emmanuel Macron]]. Bloomberg expects activity to intensify before the [[2026 Midterm Elections]]. ## Connection to the KB Ecosystem - **[[Mark Dougan]]**: the American node — a former Florida deputy whose fake local-news network is the operation's main laundering channel. - **[[Doppelganger]]** / **[[Operation Overload]]**: sibling Russian operations. Doppelganger clones whole news sites, Overload floods fact-checkers with short fakes, and Storm-1516 stages longer scandals. They sometimes push the same narratives. - **[[Internet Research Agency]]** / **[[GRU]]**: the institutional lineage — the 2016 troll factory's people, now financed by military intelligence. - **[[Kremlin Disinformation]]** / **[[Election Interference]]**: the frameworks it sits inside. - The yacht case shows the pathway the vault tracks across foreign operations: a fabricated story becomes a talking point for American politicians who already oppose aid to Ukraine. The fake doesn't create the position. It supplies ammunition for one already held. ## See Also - [[Operation Overload]] - [[Doppelganger]] - [[Mark Dougan]] - [[Russian Influence]] - [[Kremlin Disinformation]] - [[Internet Research Agency]] - [[GRU]] - [[Deep Fakes]] - [[Disinformation Hub]] - [[Unit 29155]] - [[VIGINUM]] - [[Center for Geopolitical Expertise]]