Storm-1516, a Russian influence operation that Western governments tie to military intelligence, released fake videos accusing three Democratic Senate candidates of sexual assault or violence in the fortnight before Tuesday's midterm vote.
James Talarico in Texas, Sherrod Brown in Ohio and Troy Jackson in Maine are running in races that could decide control of the Senate. The Talarico videos borrowed the name and likeness of a real former pupil. The Brown and Jackson videos took genuine local news broadcasts and dubbed new words over them with synthetic voices. The former pupil, two former Brown staffers named in one clip and both television stations say the claims are false.
Storm-1516 smeared Kamala Harris and Tim Walz in 2024 and staged fraud videos claiming Trump votes were being destroyed. In Europe it attacked the opponents of Germany's AfD and of Viktor Orbán's Fidesz. JD Vance, Elon Musk and Donald Trump Jr. have each repeated fabrications that researchers trace to the operation or to another Russian network.
The U.S. Treasury found in December 2024 that the GRU paid a Moscow think tank founded by Alexander Dugin to run an AI server and more than 100 fake news websites, and the British government sanctioned that centre a year later for coordinating support for Storm-1516. No published evidence shows contact between the operation and the Trump campaign or any Republican body.
What Storm-1516 is
Clemson University researchers Darren Linvill and Patrick Warren spotted the campaign in late 2023. New YouTube channels had begun posting videos of supposed whistleblowers describing corruption in Ukraine, each with a similar look, script and set of accounts pushing it. Microsoft, which names emerging state-linked groups with the prefix "Storm" and a four-digit number, gave the activity the label Storm-1516 in April 2024. It later renamed the group Neva Flood once it judged the activity to be the work of a Russian state actor.
France's foreign interference service, VIGINUM, counted 77 Storm-1516 operations between August 2023 and March 2025. Thirty-five targeted Ukraine's leaders and about 20 targeted elections in Europe and the U.S. Each followed a three-stage route. A fake is first posted by a throwaway account or a paid stranger posing as a witness. Websites dressed as news outlets then republish it as a report. Russian state media, Russian embassies and other Russian networks finally push it to a wider audience.
Storm-1516 works alongside other Russian operations but is tracked separately. CopyCop, a network of fake news sites run by the former U.S. police officer John Mark Dougan, gives many of its fakes a website to sit on. The Foundation to Battle Injustice, a pseudo-human-rights group that Yevgeny Prigozhin founded in 2021, has repeatedly republished its videos. Matryoshka, a separate effort, floods platforms with cheap clips falsely credited to outlets such as the BBC and tags fact-checkers to waste their time.
Who runs it
Storm-1516 grew out of the Internet Research Agency, the St Petersburg troll factory Prigozhin ran until his death in August 2023, and absorbed some of its staff. Its video team likely works from an office in the same city, NBC News reported. Linvill's team found that it has repeatedly hired West African migrants living in St Petersburg as actors; the man tearing up ballots in a 2024 Pennsylvania fake appeared to speak with a West African accent. In more than half of the operations VIGINUM studied, people were recruited to record voiceovers, play whistleblowers or stage scenes, often in disguise and in deliberately rough footage.
Dougan, a former Palm Beach County deputy sheriff who fled to Russia in 2016 and now holds Russian citizenship, runs many of the websites where the fakes first appear. Before the 2024 U.S. election he ran about 170 English-language sites with local-sounding names such as DC Weekly. From November 2024 more than 100 German-language sites registered to the same network sat dormant until they were needed for Germany's election. The EU sanctioned Dougan in December 2025 for running CopyCop and supporting Storm-1516. He has denied spreading disinformation.
Lucas Leiroz, a founder of the Brazilian branch of the Dugin-aligned Nova Resistência movement, republished Storm-1516 stories on the site VT Foreign Policy between December 2024 and January 2025. His wife writes for geopolitika.ru, a portal run by Dugin's Center for Geopolitical Expertise. VIGINUM named Leiroz and the movement's leader, Raphael Machado, among Dugin's foreign associates who took part in Storm-1516 operations.
The Talarico videos
An X account called @Zyon_Lewis_5 posted two videos on 20 October, the day after Texas opened early voting. A young man using the name of a real former pupil said Talarico had sexually assaulted him at a San Antonio middle school in 2012, when Talarico taught there. The account had been created in September and listed Romania as its signup country, according to X's own data. It had posted four times before the allegation.
The real Zyon Lewis said the man in the videos was not him and that Talarico had been a good teacher. He had praised Talarico publicly on Facebook in February. San Antonio police said they held no report matching the claim. An AI-detection tool scored both clips above 99 per cent likely to be synthetic, a result that supports but does not prove fabrication. Linvill said the operation's signature in 2026 is a real actor whose face has been swapped with AI to look like someone else; in 2024 it relied on actors reading scripts in their own faces.
Graphika assessed with high confidence that Storm-1516 made the videos and that they were very likely deepfakes. The post sat largely unnoticed for about 12 hours. Three large X accounts that had pushed earlier Storm-1516 material then shared it, and one video reached about 857,000 views within 24 hours. Talarico's spokeswoman Kate Poltrack said the claim was "totally baseless and false." By 21 October Google's AI Overview, Gemini and Microsoft's Copilot were repeating the accusation as fact when asked about the two names. X suspended the original account by 22 October, after copies had spread to other accounts.
Storm-1516 ran the same script against Tim Walz in October 2024. A man posing as a former pupil from Walz's teaching years accused him of sexual abuse, and the video drew almost five million views on X in 24 hours before it was deleted. Researchers called the Talarico fake almost identical.
Brown and Jackson
A pro-Russian X account, @X_Global_tv, posted a video on 26 October dressed as a report by Cleveland 19, an Ohio station. The anchor appeared to say four former Brown staffers had accused him of sexual assault between 2019 and 2024, and the clip displayed their names and photographs. The footage came from a genuine 21 October broadcast on an unrelated subject. The reporter's lip movements and words had been altered and new audio dubbed over the top. Brian Sinclair, the station's news director, said: "We have reported no such thing." Two of the former staffers named in the clip said the allegations were invented. Brown is challenging the Republican senator Jon Husted.
The Brown post drew 18,700 views, six likes and three reposts before X suspended the account the next morning. A Dartmouth College deepfake specialist, Hany Farid, called it a fairly low-tech fake. Brown's campaign did not comment.
A third video was on X by 29 October. It reused a July segment by WABI, a Bangor station, about complaints that Jackson had angry outbursts, including throwing a water bottle in a 2021 meeting, while he was president of the Maine Senate. A synthetic voice had the anchor say Jackson threatened to kill any insubordinate staffer with an axe. WABI vice president Kim Petry said the station did not produce, air or authorise it. Jackson, who is challenging the Republican senator Susan Collins, did not comment.
On 28 October fewer than 7,000 people mentioned Jackson on X, but about a quarter of them were discussing the axe story, Linvill said. Researchers tied both videos to Storm-1516 by their format and by the accounts that spread them. Linvill said overall engagement is lower than in 2024, which he linked to the smaller audience for midterm races, and that he expects the operation to push claims about the integrity of the vote on and after polling day.
The 2024 presidential race
Storm-1516 moved its main effort from Ukraine to the U.S. presidential race in late August 2024, Microsoft found. On 2 September a paid actor in a wheelchair said Harris had paralysed her in a 2011 hit-and-run in San Francisco. The video ran on KBSF-TV, a station that does not exist and whose website had been set up days earlier with articles copied from real outlets. Its X-ray images came from medical journals and its car crash photo from a 2018 accident in Guam. It drew about seven million views on X. A second video showed supposed Harris supporters beating a woman at a Trump rally. Simeon Boikov, the Sydney-based blogger known as Aussie Cossack, helped spread both.
In the last fortnight of that campaign the operation turned to election fraud. On 24 October 2024 a video showed a supposed Bucks County, Pennsylvania election worker opening mail-in ballots and tearing up those marked for Trump; the envelopes and ballots did not match the county's real ones. On 31 October two men presenting themselves as Haitian immigrants held up Georgia identity cards and said they would vote several times for Harris. The ODNI, FBI and CISA attributed both videos to Russian influence actors within a day or two. Georgia's Republican secretary of state, Brad Raffensperger, called the Haitian video fake and asked X to remove it.
U.S. intelligence officials said through 2024 that Russia wanted Trump to win, and in September an official said Russia was using covert operations to build support for him. Every candidate Storm-1516 smeared that year was on the Democratic ticket. Its fraud videos told Trump voters their ballots were being destroyed and that immigrants were voting illegally for his opponent, echoing claims of cheating and illegal immigrant voting that Trump made throughout his campaign.
The money
Treasury sanctioned the Center for Geopolitical Expertise and its director, Valery Korovin, on 31 December 2024 and listed the centre as linked to the GRU. Treasury said the GRU paid the centre and a network of U.S.-based helpers to build and run an AI server, maintain at least 100 websites and cover part of the rent on the Moscow flat where the server sat. The centre built its own server so that Western hosting companies could not cut it off. That designation dealt with the 2024 election and did not use the name Storm-1516. The British listing in December 2025 did, saying the centre was tied to Russian intelligence and had coordinated support for the operation.
Documents from a European intelligence service, reported in October 2024, show how money reached Dougan. His handler was Yury Khoroshenky, who used the cover name Khoroshevsky, an officer in GRU Unit 29155. The unit is best known for sabotage and assassination operations in Europe. The documents record payments from Khoroshenky to Dougan's Moscow bank account from April 2022 and regular meetings among Khoroshenky, Dougan and Korovin. They also record the launch of a new server in summer 2024, after Dougan's sites lost access to Western AI tools. Dougan denied knowing either man and later said he was "never a key player."
VIGINUM separately identified Khoroshenky as the likely financier and coordinator of Storm-1516 from its first operation and said he paid Dougan directly, though it could not confirm his role in the operation itself. A Ukrainian intelligence assessment says Unit 29155, under Oleg Kushnir, paid for the operation's servers and AI tools. German intelligence links the operation to the GRU, the Center for Geopolitical Expertise and the Double-Headed Eagle movement funded by the Orthodox oligarch Konstantin Malofeyev, according to ISD.
Two European intelligence officials said Sergei Kiriyenko, first deputy head of the Russian presidential administration, directs Russia's information campaign against the West. No published document shows him tasking Storm-1516. Russia's 2026 federal budget sets aside about US$1.8 billion for state media and online propaganda. Dmitry Peskov, the Russian president's spokesman, declined to comment on the operation.
How the fakes are made
The first videos used real people. A Cameroonian woman living in St Petersburg played a supposed Cartier intern in an October 2023 TikTok video claiming Olena Zelenska spent US$1.1 million on jewellery in New York. The receipt she showed was dated a day when the Zelenskiys were in Canada. Later videos moved to AI-generated faces and voices laid over actors. A December 2024 deepfake accusing Germany's Robert Habeck of sexual assault combined synthetic imagery with a lookalike of a Russian figure skater.
Invoices, bank transfers, emails and court papers forged by the operators appear as proof in most stories. A March 2026 video tying Volodymyr Zelensky to Jeffrey Epstein used emails dated 3 January 2010, a Sunday, which appear nowhere in the released Epstein files. A story about a €148 million Macron bunker cited a forged €50 million payment to a real German bunker builder.
Since April 2025 the operation has copied real news brands, including Euronews, the BBC, E! News and local U.S. stations, and in some European cases has published under the names of real journalists. Throwaway websites support each campaign. Before Hungary's April election, Storm-1516 stories ran on ecij.org, registered 20 January 2026, timesofukraine.net, registered 1 February, and oknyomozoriport.hu, registered 18 February. On 25 October 2026 it cloned Euromaidan Press to blame Ukraine for a Russian missile strike on Kramatorsk.
How the fakes spread
Operators post first from throwaway accounts on YouTube, Instagram, X, Facebook, TikTok and Rumble. Websites in Africa and the Middle East then republish the fakes as news, which lets later posters cite a "report" rather than an anonymous video; VIGINUM assessed with high confidence that the operators pay these sites. In April 2026 CGTN Turk, a Chinese state outlet, ran two articles linked to the operation about Armenia, the first documented use of a Chinese state outlet for the purpose.
Johnny Midnight, posting as @its_The_Dr to about 633,000 followers, shared almost 60 Storm-1516 stories between August 2023 and March 2026. The account has paid for a blue checkmark since February 2024, which lifts its posts in X's rankings and makes them eligible for X's revenue sharing. X suspended it in March 2026 and restored it a week later without explanation.
Other regular carriers include @MyLordBebo, with about 799,000 followers, which said its mistakes were unintentional and that it is not paid; the Swiss influencer Daniel Gugger; Chay Bowes, an Irish RT correspondent based in Russia, who denied any link to an influence operation; and Boikov, sanctioned by the EU in 2025. Some carriers know what they are amplifying and some do not, Linvill said, and the operation pays particular influencers to push stories tailored to particular countries. French officials describe many amplifying accounts as very probably paid. No transaction records for any individual influencer have been published.
Earlier operations
More than 40 per cent of Storm-1516's stories have targeted Ukraine, most of them aimed at persuading Western voters that aid is stolen. Zelensky and his wife have been accused of buying yachts, a Bugatti, villas, a Courchevel hotel and a Dubai flat with Western money, of links to Epstein and of hanging a stolen Cézanne in his office. A Zelensky spokesman said every one of the stories was invented.
France has been a target since before the 2024 Paris Olympics, when a fake Hamas fighter threatened the Games. In July 2024 the operation built a copy of the Renaissance party website on a look-alike domain promising voters €100 to vote for Macron's party. A February 2026 fake tying Macron to Epstein drew about 1.1 million views, and in July 2026 the operation spread false health claims about the declared presidential candidate Édouard Philippe, a first against a French presidential contender.
Moldova's September 2025 parliamentary election brought 14 fake stories, all aimed at President Maia Sandu and her pro-European party. One, on a cloned OK! Magazine site, falsely claimed Sandu had bought sperm from celebrities and drew at least 2.3 million views. Armenia, where Prime Minister Nikol Pashinyan has pulled his government away from Russia, was the operation's most frequent target from April 2025 to April 2026, with more than 25 stories before the June election. In August 2026 accounts tied to it spread four falsehoods about the Baltic states. Output in the first quarter of 2026 was more than double the same period a year earlier, with almost daily releases in late March and early April.
The European right
Storm-1516 spent three months on Germany's February 2025 election. It targeted the Green ministers Robert Habeck and Annalena Baerbock, the CDU leader Friedrich Merz, whom it portrayed as mentally unstable, and the FDP's defence spokesman Marcus Faber, whom it cast as a Russian agent. A site in Dougan's network claimed Germany would bring in 1.9 million Kenyan workers, a story built on the AfD's main campaign theme of immigration.
In the final days the operation added fraud claims that suited the AfD. A video posted by Bowes claiming AfD ballots were being shredded drew about 500,000 views; officials showed the ballot papers in it were the wrong colour and lettering. Accounts that had shared Storm-1516 sites also spread fake Leipzig ballots with the AfD missing, and Saxony's criminal police opened an inquiry. The AfD won almost 21 per cent, its best federal result. Leaked Russian presidential administration documents from 2023 had set a 20 per cent goal for the party.
Before Hungary's April 2026 election, Storm-1516 published at least a dozen stories against Péter Magyar and his Tisza party. They linked Tisza figures to the Epstein files and to a rape trafficking network, accused Magyar of sending EU money to Ukraine and said he would bring back conscription. Orbán's Fidesz repeated the conscription claim, and its candidates campaigned on the premise that Tisza would drag Hungary into the war. A fake news report had Magyar calling Trump senile and promising to undo deals with the U.S. government, casting Orbán's rival as hostile to Orbán's closest foreign ally.
The Hungarian campaign used likely paid influencers and a network of commercial marketing accounts linked to Africa. Magyar said in March that Fidesz was preparing a disinformation drive with Russian political strategists. Fidesz has not been shown to have commissioned any Storm-1516 fake. Tisza won 138 of 199 seats.
The U.S. right
In November 2023 Storm-1516 claimed associates of Zelensky had bought two yachts worth US$75 million with Western military aid; the yacht brokers named in the story denied it. JD Vance, then an Ohio senator and now vice-president, repeated the claim while arguing against further aid to Ukraine, and the then representative Marjorie Taylor Greene shared it. Senator Mike Lee of Utah shared a debunked November 2024 video of supposed Ukrainian soldiers burning an effigy of Trump after Derrick Evans, a former West Virginia legislator who pleaded guilty over the 6 January 2021 Capitol attack, had reposted it to 4.2 million views.
In February 2025, as the Trump administration was dismantling USAID, Elon Musk and Donald Trump Jr. reposted a fake E! News video saying the agency had paid Ben Stiller, Angelina Jolie and other actors to visit Ukraine. E! News said the video was not its work, and Stiller said he paid for his own trip. Linvill said several of the first accounts to share it regularly spread Storm-1516 material; other researchers attribute the video to Matryoshka. In the same weeks, after Trump called Zelensky a dictator on 19 February, Russian networks pushed fakes aimed at widening the rift between the two presidents.
Linvill said Russia's choice of U.S. targets follows its interest in the war in Ukraine, and that a Republican-controlled Congress would give Trump a freer hand, and that Trump had pulled back support for Ukraine in recent months. Joseph Bodnar of the Institute for Strategic Dialogue said the administration had been friendly towards Russia, which could help Russia's aims if Trump's allies stay in power.
All three known targets of the 2026 midterm videos are Democrats in competitive Senate races. A U.S. official said in October that most Russian content seen so far targeted Democrats, while adding that intelligence assessments did not name one party as Russia's target. No Republican candidate has been the subject of a known Storm-1516 fake this cycle. Neither the Trump campaign, the White House nor any Republican committee has been shown to have had contact with the operation, and the politicians who repeated its stories have not been shown to know where they came from.
Reach and effect
Most reach figures are platform view counts recorded by researchers at different times, which measure exposure but not belief. Storm-1516 stories drew hundreds of millions of views from August 2023 to March 2026. Single posts passed two million: 2.9 million for the March 2026 Zelensky-Epstein video, 2.7 million for a fake Euronews report on Magyar and more than 7.6 million across two accounts for the Macron bunker story. Fewer than one in five of the fakes carried an X community note correcting them.
Sandu's party won just over 50 per cent in Moldova, Tisza defeated Fidesz in Hungary, and no published study has measured whether Storm-1516 content changed a ballot anywhere. AI assistants repeated the Talarico allegation as fact within a day. Local stations in Ohio and Maine had to disown broadcasts they never made, and named former staffers had to deny allegations made in their names. Germany summoned the Russian ambassador in December 2025 over 10 cases of interference.
Responses
Russia's Foreign Ministry spokeswoman Maria Zakharova said the British sanctions on Dugin showed the UK had "outdone itself." The Center for Geopolitical Expertise, Korovin, Dugin and Dougan have not answered the specific findings in the UK and EU listings. The sanctions freeze assets and bar dealings with named people and entities; none is a court finding, and no criminal charge naming Storm-1516 has been made public. Romania refused Bowes entry in May 2025.
X suspended the accounts behind the Talarico and Brown videos within a day and suspended 20 other tracked accounts earlier in 2026. The European Commission fined X €120 million under the Digital Services Act, a penalty Vance and Secretary of State Marco Rubio criticised as an attack on U.S. technology companies.
The State Department's Global Engagement Center, which tracked foreign disinformation, closed at the end of 2024. Attorney General Pam Bondi disbanded the FBI's Foreign Influence Task Force in February 2025, CISA put its disinformation staff on leave the same month, and Director of National Intelligence Tulsi Gabbard cut the ODNI budget by more than US$700 million in August 2025 and narrowed its Foreign Malign Influence Center. The two senior Democrats on the congressional intelligence committees said in October that they were preparing for Trump to claim foreign meddling if the results go against his party.
Between 25 October and 4 November 2024 the ODNI, FBI and CISA issued three joint statements naming Russian fakes, each within a day or two of the video appearing, and warned voters that more would come through polling day and in the weeks after. No such statement has been issued in 2026. Polls open on Tuesday 3 November with the Talarico, Brown and Jackson videos still unattributed by any U.S. agency, and with the researchers who did attribute them expecting Storm-1516's next videos to claim the vote itself was rigged.
