Authors
Saman Nazari, Alliance4Europe
Eto Buziashvili, DFRLab
Victoria Olari, DFRLab
Sophie Sacilotto, Debunk.org
Ania Logvynova, IPHR (International Partnership for Human Rights)
Hannah Schimmele, Polisphere
Thomas Smelter, Alliance4Europe
Ewan Casandjian, Alliance4Europe
Mihaela Tănase (Context.ro)
Vasile Popa (Probe Point Analytics)
Deniz Dirisu (Probe Point Analytics)
Matteo Pugliese, PhD, Debunk.org
Christian Haag, Fojo Media Institute
Joel Haglund, Alliance4Europe
Larissa Doroshenko, Alliance for Securing Democracy, German Marshall Fund
Andrea Nicolai, DEN
Key Takeaways
- Storm-1516 is a Russian influence operation which focuses on the dissemination of false stories, often via fabricated and impersonation websites. These stories are initially spread by pro-Russian influencers, anonymous “news” accounts, and parody/fan accounts.
- The primary objective of Storm-1516 has traditionally been shown to be the discreditation of Ukraine and the undermining of European and Western support for the country, while also targeting these countries and their leaders directly, especially during election periods. Researchers have now observed behavioural patterns consistent with Storm-1516 taking aim at the Moldovan parliamentary elections.
- Analysis of the studied content shows that the content focuses on undermining support for Moldova amongst Western audiences, and attacks the ruling PAS party and president Maia Sandu in particular, leveraging a number of false narratives such as (false allegations of) political corruption, political repression, judicial corruption, pedophilia, and identity-based discrimination. Crucially, the political angles provided in the content vary greatly from left-wing to right-wing attack perspectives, but all serve to harshly discredit Moldova’s government, President Sandu, and the broader Western collective.
- Storm-1516 content is amplified through a number of inauthentic websites, underpinned by mass-generated AI content posing as legitimate, and is shared by a network of influencers and key accounts. Some of these accounts are fake, posing as real individuals and journalists, while some key amplifiers are real, pro-Russian influencers.
- The operation relies on a set of social media accounts which systematically amplify Storm-1516 and R-FBI articles. Some are known Russian collaborators, while others are anonymous accounts portraying themselves as news websites. Fan accounts portraying famous political figures, such as Ivanka Trump, were also used to systematically spread the content to millions of followers.
1. Introduction
Storm-1516 is a Russian information operation, which, in the case of the Moldovan elections, aims at systematically discrediting the Moldovan ruling Party of Action and Solidarity (PAS) and, specifically, President Maia Sandu. This effort is not limited to shaping perceptions inside Moldova, and is also directed outwards, seeking to undermine Moldova’s reputation internationally at a moment when the country benefits from the strongest political and financial support in modern history, as the country currently enjoys unprecedented backing from the EU, US, and regional partners.
Storm-1516 weaponises fabricated corruption scandals, staged allegations of electoral fraud, and invented extremist policy pledges to erode Sandu’s legitimacy and discredit PAS as a governing force. Domestically, these narratives aim to weaken public trust. Internationally, they are tailored to a Western conservative and far-right audience, portraying Moldova’s leadership as corrupt, authoritarian, or destabilising Moldova’s alliances with its international partners, undermining the rationale for ongoing assistance, and polarising global audiences.
This approach mirrors the Kremlin’s longstanding playbook against Ukraine. Since 2014, Russia has consistently pushed narratives of “corrupt elites,” “fraudulent elections,” and “Western puppets” to weaken Kyiv’s credibility abroad. The same formula is now being deployed against Moldova. Just as Russian operations continuously seek to erode Western resolve to support Ukraine, Storm-1516 is designed to chip away at international solidarity with Moldova.
2. Background
2.1 The IRA and R-FBI
The Internet Research Agency (IRA) is a Russian government-affiliated public relations and social media company affiliated with their late founder, Yevgeny Prigozhin, who also led the Wagner mercenary group until his death. The organisation is known to have been used to sow dissent during the 2016 US Presidential Election, and now seems to have resurrected under a new pseudonym: “The Russian Foundation to Battle Injustice” (R-FBI).
Drawing from the Soviet military doctrine “Maskirovka”, which translates to “masking” or “camouflage”, the naming convention of the R-FBI is consistent with other naming conventions of previous public initiatives that have sought to conceal malicious activities behind strategically chosen branding (e.g., “Special Military Operation” in Ukraine and “Peace Enforcement Operation” for the Russo-Georgian War in 2008.
The Russian Foundation to Battle Injustice (R-FBI) has been documented regularly disseminating Kremlin talking points, generally rallying followers against two targets: Ukraine, as well as the broader West and those two groups’ respective governments.
The R-FBI deploys a consistent narrative playbook touching on several frequent themes: Political Corruption, Political Repression, Judicial Corruption, Pedophilia, and Identity-Based Discrimination. The graphic below shows the degree to which these different rhetorical themes are used by the R-FBI based on an analysis of the group’s published reports between April 2021 and March 2024 by the Media Forensics Lab at Clemson University.
Figure 1: Figure taken from “Writers of the Storm: Who’s Behind the Ongoing Production of Pro-Russian False Narratives” (2024). Media Forensics Hub Creative Inquiry Reports.
R-FBI works by weaponising emotional persuasion techniques to put pressure on psychological weak-points, regardless of the political valence of the arguments. For example, when utilising the “Identity-Based Discrimination” tactic, the R-FBI promotesthemes meant to evoke an emotional reaction from the audience, with the narrative-frames ranging widely in ideology, from both right- and left-wing perspectives.
Take these article titles published by R-FBI, which are aimed at manipulating a largely left-wing audience: “Zelensky’s witch hunt: Women in Ukraine are subjected to violence and sadistic torture committed by the military, police and members of nationalist battalions” and “Western governments are intensifying the persecution of citizens for critical statements against the LGBT community.”
Then consider this article title, which was conversely crafted to appeal to the other, right-wing end of the spectrum: “The substitution of traditional values is the result of the purposeful work of those who want to undermine the values of the American nation: The first part of the interview of the head of the Foundation to Battle Injustice with pastor, politician and Christian activist Stephen Broden from the USA.”
By noting this strategy – taking advantage of the whole ideological spectrum to polarise – it can help shed light on the motives behind the initiative. Based on this observation, and in addition to the further evidence and articles, it can reasonably be concluded that the organisation is not interested in promoting any one particular viewpoint, but rather to exploit vulnerabilities in the psychological and emotional states of citizens in the West. This is further underpinned by the R-FBI’s consistent publishing of content in English, German, Russian and French, all aiming at eroding trust in elected leaders and democratic processes and institutions.
2.2 Storm-1516
Closely related to R-FBI is the Russian influence operation Storm-1516, which has been active since August 2023.
According to the French government inter-ministerial analysis unit VIGINUM, Storm-1516 has conducted at least 77 information operations between its start and March 2025. Its primary objective is to discredit Ukraine and undermine European and Western support for the country while also targeting these countries and their leaders directly, especially during election periods. The operation focuses on the dissemination of false stories, often via deepfakes. These stories are initially spread by burner or paid accounts, and the content is often also laundered through foreign media.
Notable examples of Storm-1516 activity include the 2024 US Elections and the German election in 2025, where distribution patterns indicated a close connection between Storm-1516 and R-FBI.
After the collapse of the previous German government, the so-called ”traffic light coalition” at the end of 2025 and the snap parliamentary elections being called in Germany, more than a hundred fabricated news sites, all purporting to be legitimate German media outlets, were created en masse. Staged or AI-manipulated videos were spread on these sites as well as via influencers. The primary targets were the conservative CDU as well as the Green Party, both staunch supporters of Ukraine, aiming to discredit prominent politicians through allegations such as sexual violence against minors. Additionally, the campaign aimed to undermine trust in electoral processes with fake claims of election fraud
On July 15th 2025, the European Council implemented sanctions against R-FBI through
Council Implementing Regulation (EU) 2025/1444 of 15 July 2025. This implementing regulation added to the list of sanctioned entities under Implementing Regulation (EU) 2024/2642 concerning restrictive measures in view of Russia’s destabilising activities.
These sanctions entail the freezing of funds and economic resources of, and the prohibition to make funds and economic resources available to R-FBI. Furthermore, as clarified by a Question and Answers document published by the European Commission, “economic resources” include providing hosting services, having the content on social media, or any other means of amplification or facilitation of content produced by the sanctioned entity.
With these regulations and clarifications from the Commission in mind, R-FBI’s activities, including Storm-1516, are violations of EU sanctions if not addressed by the social media platforms.
3. Infrastructure Analysis
3.1 Attribution
On August 4th, the German language X account @daniel_gugger shared an article from the website eufiles[.]com accusing PAS of corruption. The account had previously been identified as an amplifier of Storm-1516 in CeMAS and Alliance4Europe’s report on the operation targeting the German elections.
Before ceasing operations, the website eufiles[.]com displayed several indicators linking it to Storm-1516: the authors listed were impersonated, the website ran on WordPress and was newly created (2025-07-31), additional filler articles were AI-generated to make the website seem authentic, and cover images were copied from authentic news articles. A day before stopping publishing these AI-generated articles, the website also published a seemingly hand-written article containing a video with a text-to-speech voice-over, which was likely the purpose of the website.
By identifying accounts that reposted the EUfiles article accusing PAS of corruption, a list of potential Storm-1516 amplifiers was compiled. Then, using the social listening tool Meltwater, looking at the period between June 19, 2025, and September 25, it was confirmed that these accounts indeed reposted the same content, by way of articles, videos and posts related to Moldova with little to no variation.
3.2 Impersonated Authors of EUfiles[.]com
One of Storm-1516’s notable key behavioural patterns is to impersonate journalists from authentic media. In this case, all the authors of the articles were attributed to the editor and journalists working at the Romanian newspaper Digi24.ro.
| Impersonated Journalists | Description |
| Marina Constantinoiu | Editor of the Romanian publication Digi24.ro |
| Andreea Ghiorghe | Journalist working for Digi24.ro |
| Christina Sava | Journalist working for Digi24.ro |
| Alexandru Costea | Journalist working for Digi24.ro |
| Alexandra Albu | Journalist formally working at Digi24.ro |
| Matthew Garvey | Journalist working at Digi24.ro |
| Marius Tian | Journalist working at Digi24.ro |
The profile pictures used for the accounts are taken either from the social media profiles of the impersonated people or, when no such images exist, from people with similar names.
Screenshot of a LinkedIn profile impersonating a journalist from a reputable media outlet. (Source: Cristina Sava via LinkedIn)
Other journalists were also impersonated through other Storm-1516 websites, including one impersonating OK Magazine, which is described below.
3.3 AI-generated Articles
Between Jul 31, 2025 and Aug 5, 2025, EUFiles[.]com published around 200 articles.
We ran a random sample of 10 articles through the AI-detectors ZeroGPT and Gptinf, both of which indicated that all the articles were likely AI-generated. The topics covered in the articles mirrored those of mainstream outlets such as the BBC or Euronews, published around the same period. A script was likely used to rewrite existing articles to populate the website in order to make it look authentic. Thereafter, the 200 articles were checked manually.
Out of the 200 articles, only one was an original, which is the article amplified by the influencers. This article was the one that contained the antagonistic narrative and the text-to-speech video. All others kept to the same format.
After the article was published, the website continued publishing reports for one day before stopping its activities. Due to this distinct pattern of behaviour, it was possible to track similar videos and websites being amplified by the influencers who also amplified that story.
3.4 Websites and Accounts Participating in the Influence Operation
The operation is relying on a set of social media accounts that are systematically amplifying articles of Storm-1516.
Below is a list of websites that are being used by the influence operation to spread their content. They are divided into R-FBI amplifiers and Storm-1516 websites.
R-FBI: Vtforeignpolicy[.]com
VTForeignPolicy describes itself as a “uncensored independent alternative foreign policy media”, and describes itself as financially independent, the authors not being paid for their work, and managing their own content. VT claims not to have any editorial control over the content published by the authors.
The author who is publishing the R-FBI content on VTForeignPolicy is Lucas Leiroz, who is described as VT International Correspondent in Brazil.
It seems like the website is a platform for amplification rather than an active producer of content, considering its editorial guidelines.
R-FBI: Londontimes[.]live
Londontimes is a website previously attributed as an R-FBI amplifier by the DFRLab, and belonging to a larger network that has laundered RT content. The DFRLab showed potential technical ties between the website and RT.
R-FBI: Theinteldrop[.]org
The Intel drop is claiming to be an Icelandic website run by volunteers. The website has been flagged in relation to past R-FBI cases by, amongst others, the French Counter-Foreign Interference Agency VIGINUM.
Storm-1516: Eufiles[.]com
Screenshot of the front page of Eufiles[.]com. (Source: Eufiles.com/archive)
EU Files was the first website we identified as being part of the Storm-1516 operation targeting Moldova. The website is a fabricated news website, using AI to populate itself to look legitimate in order to amplify a specific piece of content.
The website is linking to an X account called “The European Files”. The account links to an authentic website, europeanfiles.eu, an authentic entity likely being impersonated by the operation. The attempt is poor, as the operation is relying on WordPress templates “The Fox”.
The domain was registered on the 31st of July, while the oldest article seems to have been published on the 24th of July. This publication date is likely also a fabrication, aimed at making the website seem more credible. Only one of the articles published by the website was seemingly amplified by the operation, while the rest were produced to make it seem legitimate.
The domain is registered with Hostinger, a domain provider headquartered in Lithuania.
Storm-1516: Gbreporter[.]com
Screenshot of the front page of Gbreporter[.]com. (Source: Gbreporter.com/archive)
The website Gb Reporter is using the same pattern of behaviour and persona as EU Files and is yet another Storm-1516 website.
The domain was registered via Hostinger on September 21st, the first article was published on July 24th, and it uses the same WordPress template as EU Files. Both websites were populated using the same type of AI rewritten articles before they published the content they wanted amplified.
The website is populated with over 800 AI-rewritten articles about various topics. and one handwritten article, which was the operations informational payload.
The website is trying to pose as a Great Britain-related news website, having the UK flag as a logo.
Storm-1516: OKmagazine[.]us (Down)
Screenshot of the front page of OKmagazine[.]us. (Source: Okmagazine.us/archive)
The OK Magazine website is impersonating the British OK Magazine, a weekly magazine that primarily specialises in royal and celebrity news.
This Storm-1516 clone website acted much like the other Storm-1516 websites, populating itself with AI-rewritten articles, in this case, attributing the articles to real journalists working for OK.
Similar to the other websites, OK Magazine stopped posting after its payload was published and is, at the moment, taken down.
The domain was registered on July 28th, published its payload on July 30th, but is now offline.
Storm-1516: Proudeurope[.]org
Screenshot of the front page of Proudeurope[.]org. (Source: Proudeurope.org/arhcive)
The Proud Europe website is a fabricated LGBTIQ publication by Storm-1516. The domain was registered via Navicosoft Pty Ltd, an Australian domain registrar and hosting provider, on July 15th. The website’s first published article is labelled as being published on the 31st of January.
The website produced 34 articles, of which only one was the operation’s informational payload.
This website was built using the WordPress Theme Soledad, which differs from the other websites.
Similar to the other websites, Proud Europe stopped posting after its payload was published.
Storm-1516: PAS2025[.]eu (Offline)
Screenshot of the front page of PAS2025[.]eu. (Source: PAS2025.eu/archive)
The Pas2025.eu website stands out amongst the Storm-1516 websites as it is actively impersonating an existing website belonging to the Party of Action and Solidarity, Pas2025.md.
The impersonation website is a near clone of the Pas 2025 campaign website, with the expectation of having a new campaign promise page that outlined the fabricated claims that the operation later used in their video.
The domain of the website is registered with Hostinger. The website is no longer accessible.
Storm-1516: Romanian Language Websites
Screenshot of the front page of the Romanian language website Hotnews24[.]ro. (Source: Hotnews24.ro/archive)
While the other websites were all in English, we identified a series of 8 websites in Romanian, spreading four of the Storm-1516 articles with adjacent videos (with one exception which only spread three of them). These websites all followed the same pattern as the English website, where they published a wide range of articles to make the website seem legitimate before posting their payload. In this case, they did not only post one article, but up to four. These articles were the same across the board
| Domain | Registration | Hosting Provider |
| hotnews24[.]ro | 2025-07-28 | Ovh Sas |
| infobun[.]ro | 2025-08-13 | Hostinger De |
| noutatirapide[.]ro | 2025-08-13 | Hostinger De |
| adevarpefata[.]md | 2025-07-29 | Hetzner Online Ag |
| reactiata[.]md | 2025-07-30 | Hetzner Online Ag |
| acumromania[.]ro | 2025-08-16 | Hostinger Gb |
| punctinfo[.]ro | 2025-08-13 | Hostinger De |
| adevarnet[.]ro | 2025-08-16 | Hostinger Fr |
Table: websites part of the Romanian branch of the network.
All of the websites with a .ro domain had their domains registered with Instra Corporation Pty Ltd, an Australian domain registrar.
The websites with a .md domain had them registered through the allegedly UK-based Regery domain broker.
The websites have near-identical site-maps, showing that their structure is very similar, even if the filler content they use is different.
3.5 Influencers, Authors, and Account Types
Author
Lucas Leiroz
Lucas Leiroz, a “Brazilian journalist and geopolitical analyst” was originally identified in regard to the Storm-1516 network based on his contribution of 474 posts to VT Uncensored Foreign Policy since September 2023. In his bio on VT Foreign Policy, Leiroz boasts of his presentation of a “report on the use of chemical weapons by the Ukrainian Armed Forces at the 52nd Session of the UN Human Rights Council and at the OSCE’s ‘Supplementary Discussions’ at the request of the Russian Delegation in Geneva.
Leiroz consistently cites the Foundation to Battle Injustice (FBI) at the base of these articles as “slide-an” with a link. In addition to his contributions to VT Uncensored Foreign Policy, Leiroz was confirmed to contribute to InfoBrics and Sputnik Radio in Spanish. On LinkedIn Leiroz claims to contribute to Global Research, Blitz and China Global Television Network (CGTN), although his contributions to CGTN could not be verified and will require further research. Leiroz amplifies his own articles and those of others through his personal X account and Telegram channel.
Screenshot of the bio page of Lucas Leiroz on VT Foreign Policy.
Leiroz is significant through his use of R-FBI articles as sources for his contributions to VT Foreign Policy (e.g. 1, 2, 3, 4); however, even more pressing and indicative of his relationship with Russian influence operations is his contributions to InfoBrics, a subsidiary of the sanctioned Russian influence operation actor INFOROS. INFOROS is a Moscow-based “media” organisation incorporated in 2003 and 2004 and first sanctioned in May 2022 by the United Kingdom Foreign, Commonwealth & Development Office under the Sanctions and Anti-Money Laundering Act 2018. In November 2024, the Belgian Ministry of Finance identified INFOROS as a front organisation for Unit 54777 of the Russian Military Intelligence Service (GRU), the unit widely believed to be responsible for psychological operations, as reported in their sanctioning of the organisation. As of September 24 2025, INFOROS has 18 sanctions against it from 10 countries for violations in relation to the full-scale invasion of Ukraine and money laundering. Sputnik Radio, a subsidiary of Sputnik, one of Russia’s primary state media agencies to which Leiroz regularly contributes in Spanish, is also the subject of significant sanctions by Australia, Canada, Switzerland and the European Union.
While Lucas Leiroz has contributed significantly to INFOROS and Sputnik Radio Spanish, he is himself currently not sanctioned by the EU.
Influencers
Gasparyan
Armen Gasparyan is an RT journalist and the first deputy chairman of the committee for enlightenment of the Civic Chamber of the Russian Federation. He is one of the Kremlin’s key propagandists and is under sanctions of the European Union, Canada, Ukraine, the United Kingdom, and Switzerland. He was also banned from Moldova in 2015 until 2020.
Sania in Florida
Alexander (Sania) is a popular Russian video blogger who has been living in Florida, USA since 2002 and in 2018 started a YouTube channel to share his life experience as a Russian in the US. In 2023 YouTube blocked this channel for spreading Russian propaganda about the war in Ukraine; however, Alexander continues his blogging on Rutube[.]ru, Telegram, TikTok, Facebook, Vkontakte.
Golos Mordora
Mikhail Mikhailov, a popular Russian-language blogger, first started writing on Twitter (133,100 subscribers), and then switched to Telegram (160,427 subscribers). According to interviews, he grew up in one of the former Soviet Republics and after the dissolution of the Soviet Union moved to the Netherlands.
Chay Bowes
Chay Bowes is an Irish journalist and host of RT show Moscow Mules tackling “this week’s hot topics and events from an angle you might not expect” according to RT Balkan. According to The Irish Times, Bowes is the founder of the Irish website The Ditch, a news and comment platform. Coverage of The Ditch is unclear what type of news the site covers but reports indicate it is known for coverage of politicians and scandals. Bowes has since parted ways with The Ditch and works full-time for Russia Today.
Figure X: RT Balkan, Moscow Mules home page
Bowes has been very active on behalf of Russia, primarily focusing his work on blaming the full scale invasion of Ukraine on NATO. In June 2023 Bowes represented Russia at the United Nations where he blamed NATO politics for the war in Ukraine. According to Disinfowatch, Bowes’ work focuses on pro-Russian narratives targeting NATO in his reporting, challenging NATO’s legitimacy and portraying the alliance as destructive.
Earlier this year, Bowes attempted to travel to Romania in May 2025 to cover the Romanian Presidential election. According to the Irish Times, Bowes “was detained and then deported from Romania.” The article describes Bowes’ denial of entry to Romania as follows:
|
“Romanian Border Police confirmed that Bowes was prohibited from entering the country when he arrived at Bucharest International Airport on a flight from Dublin. In a statement the police said Bowes was not allowed to stay in Romania under an emergency ordinance law which prevents “aliens” from entering the country and interfering in its politics.Bowes was given a form with the charges attached and the legal way to challenge it if he wished to proceed that way. Instead, Bowes booked a flight to Turkey taking off a few hours later.”
|
Daniel Gaugger
Daniel Gaugger is a conspiracy theorist with a wide variety of interests. He is a prolific user of the number 888, a number which, according to certain numerological belief systems, represents abundance, financial prosperity and that the user is on the right path. Gaugger has published several books in German in both 2006 and 2017. In 2006, Gaugger published Agriculture and transport on equal pair: the municipality of Kirchberg BE as a scene of agricultural modernisation, consolidation of goods, railway and motorway construction. His interests seem to have changed drastically by 2017 when he published two books, 888 Jesus Lives and The Ski Lift to Knowledge: My Awakening on the mount of Olives and the cure with the King and Pope, also in German. According to the bio on his X page, Gaugger is a subscriber to climate hoax, chemtrail and 5G injection conspiracies. He is very active in spreading and promoting Storm-1516 content on X and runs his own Telegram channel as well.
He was among the influencers engaged in spreading Storm-1516 content during the German Elections.
Account Types
Social Media Accounts
| Platform | Account | Number of cases mentioned in |
Account Type |
Language |
| x | shadowed_news | 19 | “news” | ENG |
| x | wolsned | 13 | anonymous | ENG |
| x | stairwayto3dom | 12 | “news” | ENG |
| x | maimunkanews | 14 | “news” | ENG |
| x | leandroonx | 14 | anonymous | ENG |
| x | fopminui | 11 | “news” | ENG |
| x | bertalanzoli | 11 | influencer | ENG |
| x | s2funcensored | 10 | “news” | ENG |
| x | darinkheder | 8 | anonymous | ENG/ARA |
| x | ivankanews_ | 10 | fan account | ENG |
| x | dangerousthinkg | 10 | “news” | ENG |
| x | boweschay | 5 | influencer | ENG |
| x | leiroz_lucas | 6 | “news” | POR |
| x | truthtellerftm | 8 | “news”“news” | ENG |
| x | sprinterexpres0 | 5 | “news” | ENG |
| x | edgarmendeze | 5 | Influencer | ESP |
| x | futballunpacked | 4 | fan account | ENG |
| x | mai_asur | 6 | influencer | ENG |
| x | lilyjoelily | 3 | anonymous | ENG |
| x | nuradeeeen | 7 | influencer | ENG |
| x | reechutd | 6 | influencer | ENG |
| x | ottoman_agent | 3 | “news” | TUR |
| x | alternatnews | 7 | “news” | ENG |
| Telegram | shkvarka2 | 3 | influencer | RUS |
| x | dailyirannews | 3 | “news” | ENG |
| x | hatefmokhtar | 4 | influencer | ENG |
| x | magatimes24 | 5 | commentary | ENG |
| Telegram | mash | 2 | “news” | RUS |
| Telegram | russiancanadiannews | 2 | “news” | RUS |
| Telegram | sergeykolyasnikov | 2 | influencer | RUS |
| x | libtearcreator1 | 3 | “news” | ENG |
| x | preciouschinny0 | 2 | influencer | ENG |
| x | smo_vz | 3 | influencer | ENG |
| x | trump_fact_news | 6 | “news” | FRA |
| x | zlatti_71 | 2 | anonymous | ENG |
| x | daniel_gugger | 3 | influencer | DEU |
| x | geogeolite | 3 | “news” | ENG |
| x | peacemaket71 | 2 | “news” | ENG |
| Telegram | Голос Мордора | 4 | influencer | RUS |
| X | JeffreyxEpstein | 2 | Parody | ENG |
The wide range of recurring X-accounts spreading the same content indicates that they are part of the same network
Of the social media accounts determined to be taking part in the Storm 1516 operation, these accounts can be divided into three categories: fan accounts, anonymous accounts and “news” accounts.
Fan accounts are designed around an admired figure who is referenced in the name and bio of the account. Posts on this account are often politically in line with those the account shares from Storm 1516 but the narratives are not always present on the account prior to posts shared from Storm. Three accounts were identified as fan accounts of Donald Trump or Ivanka Trump, while two are Football fan accounts and one is a fan account of Jeffry Epstein. Each account clearly states it is a fan account in an official categorisation under the account name. These accounts are rarely connected to a Telegram account and often do not extend past X.
Screenshot of a fan account participating in the Storm-1516 operation. (Source: @IvankaNews_/archive via X)
Anonymous accounts are the cornerstone of an operation such as Storm-1516 as they are difficult to track and identify who is behind them. These accounts are described as anonymous as the information on the account does not provide any indication about who is behind the account which could be determined through photos or bio information. Additionally, no posts indicate anything specific about the account’s owner, making them anonymous to the researcher.
Screenshot of an anonymous account participating in the Storm-1516 operation. (Source: @wolsned/archive via X)
Finally, “news” accounts are those accounts that claim to be independent media organisations, often employing terms such as “real” news, implying that mainstream media does not share the pressing information people are seeking. These accounts are often also politically affiliated and demonstrate support for specific politicians such as Donald Trump, Make America Great Again or Vladimir Putin. Posts made on these accounts are consistently outrageous and emotionally triggering, targeting a majority conservative audience.
Screenshot of a “news” account participating in the Storm-1516 operation. (Source:@stairwayto3dom/archive via X)
4. Operation Objectives and Manipulative Techniques
DISARM is a taxonomy that allows researchers to codify the objectives and manipulative techniques used by influence operators. The objectives and techniques that are used in this particular disinformation campaign are capitalised, italicised, and are followed by parentheses “()” with the objective’s or technique’s number and a link to its description. E.g. Create Localised Content (T0101).
This case illustrates how a Russian influence operation is creating fabricated websites, populating them with AI-rewritten articles from legitimate sources, publishing the operation’s payload (an article) that commonly contains a fabricated video. These payloads are then spread across social media platforms through a series of social media accounts, including known Russian-aligned influencers.
4.1 Objectives
The operation seems to primarily have three objectives.
The first objective is likely to Smear (T0135.001) Sandu and Pas’ reputation, discrediting them towards Moldovan and international far-right audiences.
Furthermore, the operation is working to Subvert (T0135.003) Moldova’s international relations and foreign support by targeting far-right audiences, especially the Make America Great Again (MAGA) movement.
Lastly, the operation is likely working to Distract (T0077) Moldovans and international audiences from Russia’s actions in the region, trying to preemptively attempt to blame Moldovan authorities for the active measures that Russia itself is likely planning to conduct, as also concluded by the Institute for the Study of War.
4.2 Techniques
The influence operation used a wide variety of techniques previously identified in relation to Storm-1516 and R-FBI.
The operation created a series of websites, including R-FBI’s own website, which is a Fabricated (T0143.002) entity with a human rights NGO Personna (T0097.207).
The articles were Appropriated (T0084.004) and spread by Existing Inauthentic News Sites (T0098.002).
The operation also Created Inauthentic News Sites (T0098.001), which had Fabricated (T0143.002) News Outlet Persona (T0097.202). They also created websites that Impersonated (T0143.003🙂 PAS, to discredit them.
The fabricated news websites were all Generate Content Unrelated to Narrative (T0129.002), Plagiarise Content (T0084.002) from authentic media and rewriting them using AI (T0085.001) to make them look more authentic.
Thereafter, the operation Developed Inauthentic News Articles (T0085.003), which contained videos with Deceptively Edit Audio (Cheap Fakes) (T0088.002) using text-to-speech.
The operation seemingly Co-Opted Influencers (T0100.003), Recruit pro-Russian Partisans (T0091.002), and Contractors (T0091.001).
The content was Posted across Platforms (T0119.002), primarily X, Using Copypasta (T0084.001), tapping into Existing Echo Chambers/Filter Bubbles (T0102.001), mostly belonging to the far-right. Among the accounts, there were inauthentic Parody Accounts (T0143.004).
5. Content Analysis
5.1 Narratives
This chapter catalogues the main narratives pushed by Storm-1516 and its affiliates, mapping when each narrative first appeared within this operation and which campaign carried it. The table below provides a structured overview of recurring themes – from fabricated corruption scandals and electoral fraud to gendered attacks and anti-Western tropes – while the subsequent sections trace how these narratives were operationalized in practice.
| Number | Narrative | Campaign | Start of distribution |
| 1 | Sandu is making billions on illegal drugs, weapons and human trafficking | R-FBI | 19 June 2025 |
| 2 | Sandu legalises the killing of civilians by officials | R-FBI | 2 July 2025 |
| 3 | Sandu and PAS are preparing election fraud | R-FBI | 15 July 2025 |
| 4 | PAS is systematically exploiting minors via its youth structures | R-FBI | 15 July 2025 |
| 5 | The Soros Foundation gave president Sandu €10 million to promote LGBT propaganda in Moldova | Storm-1516 | 21 July 2025 |
| 6 | Sandu bought illegally obtained sperm samples from Hollywood actors | Storm-1516 | 30 July 2025 |
| 7 | PAS has sold Moldova’s energy to Romania as part of a corruption scheme | Storm-1516 | 4 August 2025 |
| 8 | PAS manipulates elections by checking ballots in their favour prior to election day | Storm-1516 | 18 August 2025 |
| 9 | Parliamentary Speaker Igor Grosu calls Moldovans “a flock of sheep” and is willing to send them to war | Storm-1516 | 25 August 2025 |
| 10 | Sandu sent Moldovan criminals to Ukraine to act as executioners for Zelenskyy | R-FBI | 29 August 2025 |
| 11 | PAS intensifies the crackdown on the opposition with searches at the “Heart of Moldova” party. | Storm-1516 | 2 September 2025 |
| 12 | Sandu has declared a military emergency and issued a decree banning men aged 25 to 50 from leaving the country | Storm-1516 | 4 September 2025 |
| 13 | The UK wants to increase its military presence in Moldova and is planning a military operation against Transnistria, which will be carried out by Ukrainian troops | Storm-1516 | 10 September 2025 |
| 14 | Moldova is mobilizing the police to suppress anticipated mass protests after the election | Storm-1516 | 19 September 2025 |
| 15 | PAS stated in its election manifesto that it would raise the retirement age and income tax, introduce conscription for women, and extend the length of military service | Storm-1516 | 19 September 2025 |
| 16 | Moldovans voting by mail from the U.S. received ballots excluding two opposition parties | Storm-1516 | 22 September 2025 |
| 17 | Sandu accepts France’s chemical waste and makes Moldova Europe’s dumping ground | Storm-1516 | 23 September 2025 |
5.2 Narrative Case Studies
The operation focuses on delegitimising the ruling PAS party and, in particular, President Maia Sandu, while also strengthening anti-Western and anti-Ukrainian sentiment. Fabricated stories play on polarising topics such as EU accession, corruption, fear of war or LGBT rights, for which generally the ruling government is portrayed as a non-sovereign actor, simply following dictations by Western elites. Sandu is depicted as both incompetent and evil, often playing on gendered stereotypes. Additionally, the campaign aims directly at the election and trust in democratic processes, using fake stories and AI-manipulated videos to warn of apparent election rigging orchestrated by PAS or the suppression of the opposition.
Case Study – Election Integrity
On August 18, a video started circulating on X that allegedly exposes voter fraud by PAS. In this likely manipulated or staged video, an electoral worker in Chisinau shows ballots that are already pre-marked for PAS, claiming that she is acting on direct order by the government and Maia Sandu. The person in the video speaks Romanian, subtitles and posting text were in English, emphasising the assumption that the target audience is English speakers. The video was distributed by at least 19 accounts between August 18 and 20, amassing several million views, yet only a few hundred retweets and around 10,000 likes. The biggest account involved was @IvankaNews_, where the video generated 2.4 million views alone.
Case Study – Corruption
Several fake stories focus on the alleged corruption of Sandu personally, PAS party officials or the whole government. A notable example includes a fabricated story published on the website eufiles[.]com, which describes a leaked dossier uncovering a high-level corruption scheme involving PAS and a (non-existent) Romanian mining company. The leak apparently exposes how political elites sold off Moldovan electricity in exchange for a €15 million donation. This personal enrichment of leading PAS figures is contrasted with the alleged frequent blackouts that regular Moldovan citizens are suffering from. The story was first published on August 4 and subsequently amplified by at least 30 accounts on X in the span of a few hours. All posts followed the same pattern of posting a likely AI-generated, English-language video covering the story and citing an apparent expert before linking to the EU Files website in a second post (example). In the typical manner, views of the posts were disproportionately high compared to actual engagement numbers.
Case Study – Support for Ukraine
One major goal of the operation is to undermine support for Ukraine by portraying the Zelenskyy government as an illegitimate dictatorship while also stirring up fear of Moldova being dragged into the war with Russia. On August 29, R-FBI started disseminating a fake story on its website in both English and Russian, which was also shared identically on vtforeignpolicy[.]com, a website which claims to be an uncensored alternative foreign policy media. The story points to an alleged alliance between Sandu and Ukrainian president Zelenskyy, with Sandu having signed a decree in 2024 sending Moldovan criminals to Ukraine for carrying out punitive operations and capital punishments against civilians and dissidents. It emphasises the narrative of a brutal and relentless “regime” in Kiev and a president in Moldova who is willing to aid this endeavour. Linking mostly to the VT version of the story, it was spread on both Telegram and X by at least 30 English-language channels. Content was also amplified via influencers such as pro-Russian Z-blogger @Zlatti71 or the journalist Lucas Leiroz who was also listed as the author of the VT piece. The posts generated more than 4 million views in total. While engagement was also not significant, the number of reposts was continuously higher than in content distributed by Storm-1516.
Case Study – PAS tax and retirement age increase
On September 18 website PAS2025.eu published news about the Party of Action and Solidarity (PAS) stated in its election manifesto that it would raise the retirement age and income tax, introduce conscription for women, and extend the length of military service. The incident involves outright disinformation: a fake website and fabricated video imitating official PAS campaign materials, falsely attributing controversial policy pledges to the party. The narrative was then amplified across social media through misleading posts and videos by a network of at least 14 X accounts between September 18 and 20, reaching several hundred thousand views, a few hundred retweets and likes. The largest account involved was @Truthtellerftm, @wolsned and @DangerousThinkg.
5.3 People Portrayed in Content
To project the image of credibility, R-FBI articles on Moldova typically feature several interviews with purported “subject-matter experts” to validate and legitimise the narrative pushed by the author. Research on these individuals reveals that most are employed by Kremlin-linked organisations and lack verifiable expertise on Moldova.
Dmitry Sorokin appears in the highest number of different articles. He is presented as the “chairman of the Russian-Moldovan Centre for Friendship and Cooperation,” a Russian non-profit organisation used by the Kremlin to promote rapprochement with Russia. His interview topics include the exploitation of minors in Moldova, corruption within the PAS party and the transit of drugs and weapons in Moldova. The wide range of topics covered by Sorokin suggests his talking points stem from different scripts provided to him rather than genuine expertise. In addition to his role as chairman, Sorokin is also the founder of an intelligence firm operating in Russia called “NORTHERN INTELLECT”.
Rafael Machado is credited as a Brazilian geopolitician who was interviewed to comment on “the participation of Moldovan nationalists in the military structures of Ukraine”. Machado’s activities have no apparent connection to Moldova. He is, however, the president of “New Resistance”, described by the U.S. Department of State as a “quasi-paramilitary neo-fascist organisation operating in South America, Europe, and North America with deep connections to entities and individuals within Russia’s disinformation and propaganda ecosystem.”
The other personalities interviewed are John Varoli, a journalist turned PR expert known for his pro-Russia views, who was asked to comment on Moldova’s supposed violations of international law. Ilya Kiselyov, a Russian commentator, talked about the state of Moldova’s judicial system. And finally, Chay Bowes, an Irish blogger and journalist working for Russian state media RT.
6. Reach and Impact
Storm-1516 is corrosive to the information space in Moldova by methodically weakening trust in democratic institutions and the ruling Party of Action and Solidarity (PAS). The narratives it built are around invented corruption scandals, false promises of policy, and faked evidence of election fraud, and all are aimed at rendering President Maia Sandu illegitimate. The reach and impact extends internationally, seeking to undermine solidarity and diminish Western support for the Moldovan government’s reform agenda, while branding the government as corrupt and beholden to foreign interests.
The campaign focuses on two overlapping audiences. The primarily targeted audience of Moldovan citizens are exposed to disinformation adjusted to take advantage of local perceptions of corruption, poverty, and war. Internationally, the operation adjusted its messaging targeting far-right and conservative audiences in the West, especially in the US and Europe, where it enhanced gendered attacks, anti-LGBT narratives, and allegations of election illegitimacy. This dual focus demonstrates how the operation saw opportunities to polarize both their internal constituencies and Moldova’s external partners.
X posts from two influential accounts amassed nearly 2 million views, amplifying anti-LGBTQ narratives aimed at discrediting Maia Sandu. (Source: @SprinterExpres0/archive (left); @AfricanHub_/archive (right) via X)
The Storm-1516 content experienced considerable distribution across a variety of platforms including X, Telegram, and websites. Individual posts received hundreds of thousands or several million views but engagement – likes, shares, or comments, relative to views are low. Amplification from infamous influencer accounts with tens and hundreds of thousands of followers as well as from anonymous and semi-anonymous “news” accounts made to look credible, was visible and contributed to the campaign’s visibility. Just to put this in numbers: the X posts examined above, which pushed these narratives, accumulated roughly 45 million views. And that figure only covers the content we collected – the true viewership could extend well beyond. AI-generated articles and cloned websites created additional scale and credibility, which further amplified the campaign’s overall visibility.
Storm-1516 relies on synthetic scaffolding. AI-generated filler articles provide camouflage, impersonated journalists inject credibility, and burner accounts create the illusion of consensus. This layered scaffolding is not aimed only at people but also at machines: synchronised posts and repeated content pushes manipulate recommendation engines, ensuring disinformation receives algorithmic amplification far beyond its organic traction.
There are clear signs that the operation is also inauthentically amplifying the posts through spam accounts. While this could not be analysed systematically, at least two of the accounts observed were using inauthentic sharing to boost their content. These two posts were quote-tweeted 266 and 90 times respectively (e.g. 1, 2, 3, 4).
The low to sometimes nonexistent amount of comments, compared to the number of reposts and likes, indicates inauthentic behaviour by said recurring accounts, further proving the point that the accounts are part of a network using bots and inauthentic accounts, boosting the spread of false information aimed at undermining the integrity of the Moldovan presidential Elections
It is challenging to quantify in precise terms exactly how the campaign changed the electoral dynamics, but it is evident that it succeeded in creating persistent distrust and confusion in the information environment. Two outcomes stand out: The first is strategic corrosion. By embedding manipulated information as a consistent part of the Moldovan electoral cycle, Storm-1516 has lowered the threshold for interference in subsequent campaigns, normalising polluted campaigns to disenchanted voters. The second is institutional fatigue: constant debunking uses limited resources from civil society actors, the media, and representatives of the state, which yields little time or energy for real political debate. This slow, creeping decay may have more of a long-term impact than any immediate shifting of voter behaviour.
7. Recommendations and Actions Taken
- As we have not been able to mitigate the operation in time due to the sheer technical complexity and lack of resources, we recommend that media and public figures inform the public about the characteristics of the operation.
- The European Commission should look to expand its list of sanctioned individuals and entities to cover currently unsanctioned actors who contribute content to sanctioned EU channels. Actors who are consistent key amplifiers and possible authors of the Storm-1516 payload articles should be reviewed for sanctioning.
- The social media accounts used in the operation should be investigated further to determine their origins and affiliations. Many of the accounts show a clear sign of inauthenticity and should be addressed by the respective social media platforms.
- Considering the sanction status of R-FBI, social media platforms should track the content connected to Storm-1516 and block its spread, enforce EU sanctions, and ensure that said content does not reach the Moldovan diaspora in Europe, a group that makes up around 21% of Moldova’s citizens.
- Moldovan authorities should look to block access to websites affiliated with Storm-1516 during the election period, in order to stop a clear avenue for manipulation.
- The EU and Moldova should continue to work closely together on enacting sanctions, including developing mechanisms for joint sanction enforcement.
Hostinger, one of the key domain and hosting providers of the operation, was contacted to request their assistance in mitigating the operation. While confirming reception of the email, they did not further engage.
8. Disclaimer
The participation of DFRLab, DEN, ASD GMF and Debunk.org in writing this report was part of the FIMI-ISAC project ‘FIMI Defenders for Election Integrity’.
Alliance4Europe’s participation was made possible through funding from the Ministry of Foreign Affairs of the Republic of Poland.
Acknowledgement of Funding:
The opinions expressed in this publication are those of the authors and do not reflect the views of the official positions of the Ministry of Foreign Affairs of the Republic of Poland.