Storm 1516: Unpacking Russia's Sophisticated Disinformation Operation Targeting Ukraine and Allies

Understanding Storm 1516

• 🎯 Storm 1516 is the name given by Microsoft to a Russian disinformation operation active since at least August 2023.
• 🇫🇷 French authorities identified nearly 80 disinformation campaigns conducted by this operation between August 2023 and March 2025.
• 🇺🇦 The primary targets of these campaigns are Ukraine and its allies, with the goal of eroding Western support for Ukraine.

Tactics and Content

• 💔 35 campaigns specifically aimed to damage the image of Ukraine and its leaders, including false claims of theft of Western aid and accusations against the president's wife.
• 🌍 The operation also targets Ukraine's allies like Germany and France, often coinciding with major events such as the Paris Olympics and election periods.
• 💸 An example includes a fake French political website offering a bonus for votes, aiming to mislead and delegitimize the electoral process.

Distribution Methods

• 🤖 False content is created using methods that can involve AI or paid actors.
• 📱 This content is then distributed through controlled social media accounts, including paid ones.
• 📰 Articles containing false content are published in foreign media, mainly in the Middle East and Africa, sometimes marked as sponsored content.
• 🔍 Once debunked, these false articles are often deleted by the media outlets.
• 📢 Finally, the false stories are amplified by pro-Russian actors.

Key Figures and Links

• 🔗 While exact responsibilities are unclear, links between Storm 1516 and Kremlin-affiliated individuals/organizations have been confirmed.
• 💰 Yuri Korosenki, believed to be an officer in Russian military intelligence, is thought to have funded and coordinated the operation.
• 🇺🇸 John Mark Dugen, a former American police officer exiled to Russia, is accused of sharing Storm 1516 narratives on his network of websites called Copycop.

Spotting Disinformation

• ⚠️ Sophisticated methods make spotting disinformation challenging, but awareness is key.
• 👤 Be conscious of who is sharing the content and its original source, such as the identified X account 'Johnny Midnight'.
• 🌐 Double-check domain names to avoid imitation sites like those in the Copycop network, which often mimic reputable news outlets.
• 🔗 Further tips and lists of identified accounts and domains can be found on the France 24 website's Truth or Fake section.