Storm-1516 — Anatomy of the Russian Information Operation

Context and scope of the report

Against a backdrop of war returning to Europe and the intensification of foreign hybrid operations targeting Western democracies, France set up VIGINUM in 2021. Placed under the authority of the SGDSN¹, the service is tasked with detecting, qualifying, and documenting foreign digital interference threatening the integrity of public debate.

In May 2025, VIGINUM published an analysis of the Russian information operation Storm-1516, active since at least August 2023. The report describes its main characteristics and the risks it poses to French-speaking and European information spaces.

Targets and preferred narratives

Storm-1516 focuses primarily on Ukraine and its political environment. Nearly half of the content identified by VIGINUM directly targets Kyiv, with a clear objective: discrediting the Ukrainian state in Western audiences in order to weaken the political, military, and financial support provided by its allies in the context of the war.

In parallel, the operation targets Western leaders and their relatives, particularly in France, the United States, and Germany, with marked intensification during electoral periods. It also targets democratic processes themselves, seeking to influence several major elections in 2024 and 2025. The aim is to harm candidates seen as hostile to Russian interests and to favour those likely to relay pro-Russian positions. Storm-1516 also targets the Russian opposition in exile, in order to weaken its credibility and limit its influence.

The narratives mobilised largely reuse material that has been part of Russian propaganda since 2014. They portray Ukraine as a corrupt and dangerous state, evoking ties to terrorist organisations or the misappropriation of Western aid by Ukrainian elites. On a separate front, the campaign weaponises highly polarising topics in Europe such as immigration, while relaying conspiracy theories in the United States targeting the federal administration.

Diffusion pattern and operational methods

Storm-1516’s modus operandi rests on a complex, structured, and evolving setup, designed to maximise the credibility and reach of the content distributed. VIGINUM identifies a five-stage sequence: planning, primary diffusion, laundering, amplification, and reuptake.

1. Primary diffusion

Primary diffusion is the initial release of the narrative. It is carried out mainly through burner accounts, paid accounts, or accounts belonging to the CopyCop network, already involved in pro-Russian information operations. These accounts inject the narrative into the information space.

2. Laundering — the core signature

The laundering phase, which VIGINUM considers the core signature of the operation, then transforms this initially manipulated content into information presented as legitimate. To do so, Storm-1516 operators write articles reproducing the key elements of the narrative and publish them in foreign outlets, often based in Africa or the Middle East. These publications then serve as external evidence, lending an appearance of independence and credibility to the information.

3. Amplification and reuptake

The setup then enters an amplification phase: the laundered articles are picked up by coordinated relays, affiliated websites, pro-Russian social media accounts, and influencers. Finally, the reuptake phase sees this content reinjected as secondary reference sources, consolidating its perceived legitimacy.

Technical tooling

This mechanism is reinforced by sophisticated technical tooling. Storm-1516 makes use of:

• automated content generation through artificial intelligence,
• the production of videos featuring amateur actors,
• the creation of audio and video deepfakes,
• photo manipulation.

Content is systematically adapted to the language, national context, and sensibilities of the audiences targeted.

Actors and network structure

Storm-1516 relies on a structured ecosystem of actors tied to Russian power circles, combining individuals, media infrastructure, and influence relays. VIGINUM identifies in particular:

• proximities with the Prigozhin and Dugin spheres;
• the likely involvement of profiles from the Russian intelligence services, including Yury Khoroshenky, publicly presented as a GRU officer who may have contributed to the coordination and funding of the operation;
• a central role attributed to John Mark Dougan, a former American police officer in exile in Russia, who distributes and relays Storm-1516 narratives through the CopyCop network.

The latter is an information infrastructure used in a coordinated manner and confirmed as a regular pillar of the operation.

So what? Stakes for public debate

Storm-1516 is a particularly structured and adaptable information operation, with substantial means. According to VIGINUM, it proves effective at spreading anti-Ukrainian and, more broadly, anti-Western narratives among Western audiences.

Beyond its immediate effects, it fits within a long-term Russian strategy aimed at polarising democratic societies and eroding trust in institutions. As such, Storm-1516 represents a significant threat to the integrity of French and European digital public debate, and fully meets the criteria of a foreign digital interference.