Discussions of Russian disinformation often get stuck on individual fakes or isolated campaigns. But that misses the bigger picture. Behind them sits a web of interconnected networks, built up over years, quietly shaping a global ecosystem of Russian information influence.
In late April, Bloomberg published an investigation into Storm-1516, a Russian disinformation network that the authors described as the Kremlin’s “most powerful covert weapon” in the information war. The detailed feature pointed to videos featuring actors posing as whistle-blowers, fake websites designed to mimic well-known media outlets, and anonymous influencers helping to amplify fabricated narratives. Taken together, these components form part of a broader system of information influence operations built around the large-scale distribution of false content across social media platforms worldwide.
The scale of Storm-1516’s activity is striking. In the first quarter of 2026 alone, the Microsoft Threat Analysis Center (MTAC) recorded more than 1,000 artificially generated videos produced for the network’s dissemination efforts — more than 10 fake videos a day. Over 40% of the narratives identified in these videos were aimed at undermining support for Ukraine, while roughly a third focused on interference in electoral processes in other countries. Some of the content reached audiences in the millions: a single post containing a fabricated story about Moldovan President Maia Sandu drew at least 2.3 million views and remains live on the social media platform X without any warning label indicating the content is false.
Bloomberg’s investigation traces how the ecosystem operates from the inside. Citing research by Ukrainian intelligence, the report says the network’s servers and the artificial intelligence tools used to produce its videos were financed by GRU Unit 29155, headed by Oleg Kushnir. Coordination between Storm-1516 and the hacker group Ember Bear was handled by GRU officer Yuri Khoroshenkiy. The network also received support from John Mark Dougan, a former American sheriff who now lives in Moscow. The EU sanctioned him in December 2025 for running a network of fake websites. In the same month, Russia awarded him the Medal of the Order “For Merit to the Fatherland”, ostensibly for his “fight in the information war”.
Storm-1516 operates through a well-honed three-step process. It begins with a supposed “whistle-blower” or “citizen journalist” posting a video on a newly created channel. The content is then picked up by a global network of ostensibly independent websites before being amplified by Russian émigrés, officials and sympathisers. By the time the story reaches audiences in the United States and Europe, its origins have often been obscured entirely. The scale of the operation is striking. In 2025, Storm-1516 generated more false content than RT and Sputnik combined.
In reality, this network is only the latest — and perhaps the most sophisticated — iteration of the information influence infrastructure Russia has spent years building. In an age shaped by social media, such networks have become powerful tools: emotionally charged content spreads fastest and attracts the most engagement, regardless of whether it is true, false or artificially generated.
At their core, these networks are coordinated infrastructures in which each component plays a distinct role while reinforcing the others. Content producers sit at the foundation — companies generating videos, articles and images, often with the help of actors, artificial intelligence, or even genuine writers who may not realise whose agenda they are advancing. That material is then pushed through proxy or fake media outlets, ranging from ostensibly independent publications willing to publish unverified claims to cloned versions of established media brands. These outlets give false content a veneer of legitimacy: familiar layouts and branding mean readers rarely question where it originally came from.
Next come the amplification networks — bots, purchased accounts and real users who are drawn, knowingly or not, into sharing and boosting the material. It is this layer that turns a single post into a viral narrative. At the top sits a coordination layer that sets themes, timing and objectives, while synchronising the activity of all other elements. This function can be carried out by a state body, a private contractor, or a hybrid of the two.
What sets this type of disinformation network apart from traditional propaganda is its decentralised structure and the plausible deniability it creates. Once content has moved through dozens of ostensibly independent platforms, tracing its true origin becomes extremely difficult — even for experts in media literacy.
Olgino, Internet Research Agency and first major scale-up
The first Russian structure dedicated to producing disinformation and promoting Kremlin-approved narratives was the Internet Research Agency (IRA), better known as the “troll factory” or the “Olgino trolls” — named after the location of its office, identified by journalists. The IRA’s activities were widely linked to Yevgeny Prigozhin, the late head of the Wagner Group.
The operation ran on a relatively straightforward model. Young employees were paid substantial salaries to post content and artificially boost likes and view counts. At first, the Olgino trolls mainly targeted a domestic audience, with the aim of shaping the “correct” narrative within the Russian internet. By 2014, however, after analysing the social media pages of American activist groups, they began creating fake profiles designed to imitate real members of those communities. This approach not only obscured the true origins of the content but also allowed operators to embed themselves within existing networks of civic activism.
According to the US Senate, by 2015 the agency had grown to around 400 staff working in two 12-hour shifts. Roughly 80 of them were focused specifically on influencing the American political process.
Posing as “concerned American citizens”, they posted on Facebook, Twitter and YouTube on issues such as race relations, gun rights, immigration and, ultimately, the 2016 presidential election. When Special Counsel Robert Mueller unveiled the 2018 indictment against 13 Russian nationals and three affiliated companies, it was the first time the operation came into full view — exposing its real scale.
Shady ecosystem: how many networks are there really?
Storm-1516 is not a single network, although it is currently the most prominent and widely recognised. It specialises in videos featuring supposed whistle-blowers and pseudo-journalists. The typical output is a clip showing an unidentified individual on camera speaking in grave terms about a “document leak” or a “scandal”. Most of these actors are filmed in St Petersburg, but are presented as, for example, a “Hungarian citizen” or an “American veteran”. In some cases, even the faces are generated using artificial intelligence.
Storm-1679 is another structure producing pseudo-documentaries styled after American investigative films and presented as the work of non-existent “independent production companies”. Its best-known example is the fabricated documentary Olympics Has Fallen (2023), which mimicked a Netflix production, featured an AI-generated imitation of Tom Cruise’s voice-over, and included fake reviews attributed to The New York Times and the BBC.
Over time, Russian information influence operations have become increasingly sophisticated, moving well beyond often low-quality video content. One objective has been to undermine media literacy efforts that encourage audiences to verify original sources. Storm-1099 was behind the well-known Doppelganger operation, which involved cloning reputable news websites and using them to spread propaganda and disinformation. GRU-linked hackers created near-identical copies of legitimate media sites, using web addresses that closely resembled the originals and replicating their visual design, while replacing the content with material promoting Kremlin narratives. In Germany, for example, such clones were created for Der Spiegel and Bild, while in France similar copies appeared for Le Monde. Networks of fake profiles on X and Facebook then amplified links to these cloned sites, and many readers never realised they were consuming counterfeit content.
Two other examples are Ruza Flood and Volga Flood — networks of fake social media accounts that do not generate their own content, but instead amplify material produced by other influence operations. The FBI seized 32 domains linked to Ruza Flood in 2024 alone, yet the network had already shifted its content to new web addresses within days.
Ghostwriter is another operation directly linked to the GRU and active since 2017. Its core tactic involved hacking into websites and email accounts belonging to real individuals, then publishing fabricated material under their names. One of the most striking examples was a forged letter purportedly written by the commandant of the Polish War Studies Academy, calling on Polish military personnel to “resist the American occupation”. At the time, Polish authorities officially classified the incident as an information operation.
China: different approach, similar outcome
No discussion of large-scale information influence operations is complete without Beijing. China’s counterpart is known as Spamouflage, or Dragonbridge, and has been described by Meta as “the largest known covert influence operation” on social media. The campaign has been tracked since 2019, when it first emerged with the aim of discrediting Hong Kong’s pro-democracy movement. Over time, its scope widened to include promoting Beijing’s narratives on the origins of COVID-19, targeting dissidents abroad, and seeking to deepen divisions within American society ahead of the 2022 and 2024 elections. In 2023, Meta and US federal prosecutors concluded that Spamouflage was run by a unit of China’s Ministry of Public Security known as the “912 Special Project Working Group”.
Paradoxically, China’s approach has generally proved less effective than Russia’s. Researchers describe Spamouflage as often “shouting into the void”: it produces vast volumes of content but generates limited organic engagement, largely because it prioritises scale over substance. Its accounts frequently misuse English idioms and often come across as artificial. Where the Internet Research Agency sought to imitate the American “soul”, Spamouflage operates more like an assembly line — more accounts, more posts, but without the nuanced understanding of audience sentiment that has often defined Russian influence operations.
AI era of information influence operations: easy to create, hard to detect
Until 2022–2023, disinformation networks still depended heavily on human labour. They needed content creators, people to boost engagement metrics, translators working across multiple languages, and administrators to run and coordinate accounts. The arrival of ChatGPT shifted that equation fundamentally. The cost of producing content fell sharply – a convincing AI-generated video featuring a supposed “whistle-blower” no longer required an actor or a director. At the same time, the barrier to entry for new actors dropped significantly. What was once largely the preserve of well-resourced states is now, in principle, within reach of almost anyone.
Last year, experts were already documenting the consequences of this shift. Research by NewsGuard, for instance, found that disinformation generated by Storm-1516 outperformed content produced by state-backed outlets RT and Sputnik. The same material has also contributed to the poisoning of AI models, which are increasingly used as a source of information.
The mechanism is relatively simple: a fabricated story appears on a fake website, gets indexed by search engines, and is then reproduced by an AI model in response to a user query. In this way, the narrative gains a veneer of verification, becoming a seemingly legitimate part of the public agenda and the wider information ecosystem.
Identifying problems in the creation and spread of this kind of content is extremely difficult. Each step in the chain, taken on its own, is legal and appears entirely legitimate. Yet the sequence of actions used to circulate these false narratives points clearly to a coordinated operation. Most social media platforms that try to tackle disinformation still tend to focus on individual pieces of content, rather than the influence networks behind them. In recent years, though, tech companies have begun paying closer attention to those networks themselves, particularly after the exposure of the Doppelganger operation.
A striking example of how these networks operate in Ukraine can be seen in the bot activity that has intensified on TikTok over the past year. Analysts at Texty.org.ua identified a bot farm of 629 accounts, known collectively as UA_REVIVAL, whose purpose was to discredit mobilisation efforts and erode trust in both the Armed Forces of Ukraine and the government. The videos follow a tightly repetitive format: sombre images or short clips set to music, paired with emotionally charged captions such as “Dad died at the conscription office” or “Zelensky betrayed the fallen heroes”. The accounts also rely heavily on hashtags — both political and entirely unrelated ones like #winter or #blackfriday — to maximise reach. Researchers estimated that false narratives relating to Ukraine’s Territorial Recruitment Centres (TCC) alone accumulated around 920,000 views.
Among the most common formats are both genuine and staged videos showing confrontations involving TCC personnel, fabricated clips designed to provoke negative sentiment towards military servicemen, and content produced by self-styled “TikTok lawyers” spreading misinformation about mobilisation rules. Other recurring themes include false claims about the mobilisation of teenagers and women. A separate category consists of fabricated “street interviews”, in which AI-generated “ordinary Ukrainians” describe the war as “pointless”, oppose mobilisation, and promote the narrative that there is no need to retake occupied territories.
Confronting disinformation hydra
Storm-1516, Doppelganger, Ghostwriter and similar networks have long operated as parts of a wider information influence ecosystem. They evolve quickly, scale fast, and constantly shift tactics and tools, making them exceptionally difficult to identify and dismantle.
Bloomberg has described Storm-1516 as one of the Kremlin’s most powerful information operations. But a more accurate framing may be that it is simply one of the few networks studied in sufficient detail. Undoubtedly, other, less visible structures are operating in parallel, built on the same principles and using the same technologies.
In practice, tackling this kind of informational damage has to look different. It can’t stop at flagging or removing individual pieces of disinformation. What’s needed is coordinated action from platforms and tech companies — from sharing signals on coordinated campaigns to building systems that can automatically detect network patterns and synthetic content — if it’s to have any real impact. As long as these systems remain fragmented, each new iteration of disinformation networks gains a built-in time advantage. That is why the key question today is not whether new “Storms” will emerge — they almost certainly already exist. The real question is how quickly they can be detected, and whether democratic societies can adapt to an environment in which the boundary between real and artificially generated content is becoming increasingly blurred.
