Storm-1516: creation and impersonation of websites to pass them off as media outlets
Operation Storm-1516, discovered in August 2023 and named by Microsoft, is a campaign that involves creating websites that impersonate media outlets, copying their style, and also impersonating journalists who work in those outlets to spread misinformation.
In March 2025, a German journalist living in France named Robert Schmidt received an email from “the editor-in-chief of a website in an Eastern European country” asking for more information about the investigation “he had just published about Olena Zelenska,” the wife of Ukrainian President Volodymyr Zelensky. Schmidt had investigated extremism and multinational corporations, but never the alleged trafficking of minors at the foundation headed by the Ukrainian first lady. It was then that he learned he, too, had been the victim of a Russian disinformation campaign that had begun a few months earlier.
It was through an article on Maldita.es that the German journalist discovered he had been impersonated: they used his name as if he were a journalist who had uncovered that the Olena Zelenska Foundation “supplyed Ukrainian children to pedophiles in Western Europe.” A theory similar to Pizzagate . They also put his name on a YouTube channel , which no longer exists, where there was only one video: the supposed exclusive interview with someone they claimed was a former employee of the foundation and who confessed the secret to Schmidt. However, neither of the two people who appear in the video are shown.
The person who contacted the real Smichdt in March 2025 wanted to collaborate on the supposed revelation that would implicate the First Lady of Ukraine in child trafficking. “Actually, I was a little surprised because, at that time, there were already many articles proving that it was made up, and I was surprised that I couldn't find it,” Smichdt told Maldita.es .
The choice of journalists whose identities are stolen is, apparently, random. “I think they look for independent European journalists with some credibility. There could also be a link to investigations I participated in regarding Russian and Belarusian interference with Interpol , so they may have used that to create some negative reputation with that story, but I think the main, most likely explanation is simply that they found me on the internet,” Robert Schmidt told Maldita.es .
However, that credibility can be damaged. Appearing in one of these campaigns can lead to a loss of trust for the victims and have repercussions for their careers. Some time after being impersonated, Robert Schmidt, a freelance reporter and member of the WeReport collective, was working on a story about Belarus when a source he contacted said they weren't sure about collaborating with him because of the story published in Operation Storm-1516. “Actually, I don't know if there were other people who wanted to talk to me but didn't because they weren't sure if they could trust me or not ,” he told Maldita.es .
Recently, after the publication of the Epstein files by the United States State Department, journalist Victor Cousin, who writes for the French newspaper Le Parisien, reported that he had been impersonated on a website that in turn posed as France-Soir, to spread disinformation linking the President of France, Emmanuel Macron, to parties and young boys.
A few months earlier, Helen Brown, a journalist for the British newspaper The Telegraph, where she writes about culture, was also surprised when someone alerted her that her photo was appearing alongside an article claiming that Zelensky had been caught in a multi-million-pound corruption scheme—a topic far removed from the music and theater articles Brown usually writes about. Her photo appeared next to the signature, specifically the one she uses for her Twitter profile (now X). Unlike Victor Cousin, whose photo and name were impersonated, only Brown's photo appeared, but the name was "Charlotte Davies."
In Brown's case, they only used her photo and a very different kind of topic than what she usually writes about. However, in the case of journalist Jorge Liboreiro, as he himself recounts, not only was the topic similar to those he covers, such as "Orbán's vetoes in the EU," but he also says they used a writing style very similar to his own.
We found other variations in the modus operandi used. For example, Schmidt was impersonated by creating a YouTube channel in his name and subsequently disseminating the supposed revelation of the alleged witness on a website called DC Weekly , which posed as a historic Washington newspaper but was nothing more than a site created for the purpose of spreading this type of campaign, as the New York Times explained in an article . They also used this tactic on another website called NetAfrica.net. In the case of Helen Brown, the website impersonating The Telegraph was called The London Telegraph and used the same typography as the original.
In addition to impersonating journalists, these campaigns “frequently use West African or Russian actors posing as people from other parts of the world,” explains Darren Linvill, a professor at Clemson University and co-author of several publications analyzing these campaigns. He mentions that “the first story in Operation Storm-1516 that they published was about Zelensky buying a villa in Egypt—a story in which they created a journalist, gave him a name and a face, used an actor to portray him, and gave him a YouTube channel. And then, more than a year later, they staged the murder of that supposed journalist in another story .”
According to VIGINUM , the French state agency that studies disinformation and foreign interference, “Storm-1516’s activities meet the criteria for foreign digital interference and represent a significant threat to digital public debate.”
Another operation that impersonates media outlets is Matrioska. The strategy is always the same: create videos containing disinformation and place the logo of a media outlet or institution on them so that users believe they are being disseminated by those outlets or institutions, thus amplifying their disinformation campaigns.
They are not just journalists: the case of the writer Judy Batalion
DC Weekly, the website that pretended to be a newspaper in the U.S. capital, was the first of many sites created to spread disinformation while masquerading as a news outlet. “It existed for a long time, in fact, before it became part of the Storm-1516 campaign,” Linvill explains.
Just in DC Weekly, Canadian writer Judy Batalion , whose books have been translated into multiple languages, was impersonated. Not by name (they used Jessica Devlin), but with her photo. There was even a biography: “Jessica Devlin is a distinguished and acclaimed journalist whose career has taken her to some of the most critical and challenging regions in the world. Born and raised in the vibrant metropolis of New York, Jessica’s passion for storytelling and commitment to the pursuit of truth have propelled her remarkable career in journalism”.
“Technically, she wasn’t even a journalist; she was just a writer whose image was stolen. But other times they choose journalists who are on the front lines, so to speak. Journalists who are doing the day-to-day work,” Linvill explains. “I would say they don’t usually choose extremely well-known journalists” she adds.
Another person featured in DC Weekly is Sonja Van Den Ende, though in this case, she is indeed linked to the Kremlin. As the Clemson University report explains, “after attending a conference organised by Russian propagandist Aleksandr Dugin, Van Den Ende traveled as an 'independent observer' and journalist to eastern Ukraine, providing pro-Russian information.” The report also indicates that she has frequently shared Storm-1516 narratives on her X profile and blog. She is also part of the GFCN, the Kremlin -linked fact-checking network .
John Mark Dougan and the Foundation to Fight Injustice
Behind disinformation websites is Operation Storm-1516. One of its visible figures, according to the European Commission , is John Mark Dougan, a former sheriff from a Florida county (United States) who moved to Russia and has been sanctioned by the EU since December 2025 for “participating in pro-Kremlin digital information operations from Moscow by operating the CopyCop network of fake news websites and supporting the activities of Storm-1516.”
As the New York Times explained in an article in May 2024 : “Working from an apartment filled with servers and other computer equipment, Mr. Dougan has built an ever-growing network of more than 160 fake websites that mimic media outlets in the United States, Great Britain, and France.”
Thus, they add that “with the help of commercially available artificial intelligence tools, he has filled websites with tens of thousands of articles, many based on real news .”
“There are many people sharing content with the Storm-1516 narratives that we have linked to the Foundation to Battle Injustice ( sanctioned by the EU, whose website defines it as 'a fake human rights NGO created in March 2021 by Yevgeny Prigozhin , founder of the Wagner group'),” Linvill explains, adding that this organisation recruited people from all over the world who claim to be journalists, but in reality, they are not. Several of these people, he asserts, “worked at DC Weekly.”
Clemson University published the report "Writers of the Storm”, which analyzed the profiles that have contributed to amplifying this operation and their connection to the alleged foundation. "Many of the main disseminators of the Storm-1516 narratives are significant contributors to the alleged foundation and/or its sister organisation, the BRICS Journalists Association (BJA)," the report states. It adds that these profiles "come from all over the world and are often the first social media accounts we identify sharing specific narratives about Storm-1516." They also "frequently share" these narratives on their own blogs or news sites, the report adds. In addition to Dougan, the report highlights eight other individuals who are allegedly linked to the supposed foundation and who have disseminated Storm-1516 narratives. One of them is the aforementioned Sonja Van Den Ende.
Journalists in the crosshairs: beyond Russia
The Reporters Without Borders report '100 Deepfakes ', published in February 2026 , highlights how "these digital fabrications that usurp the identities of real people are becoming increasingly prevalent in the global news landscape". In two years, the organisation detected one hundred deepfakes impersonating journalists from 27 countries. The consequences can be numerous: defamation, fraud, and threats to physical safety. 74% of the victims were women.
Vincent Berthier, head of the organisation's Technology Department, highlighted three different categories of journalist impersonation in a conversation with Maldita.es : "The first is the impersonation of a journalist's voice or identity in an image, for example." This could be the case of journalist Jorge Liboreiro or Helen Brown.
The second is “impersonating the media outlet's brand. For example, creating fake content and adding a fake logo.” Like any of Matrioska 's videos .
And the third, and “most subtle,” is a fake video using a journalist’s voice and appearance. These, he says, “are the most sophisticated and can be very damaging to both the journalist’s credibility and, of course, the integrity of the information.” The Reporters Without Borders report highlights the case of Cristina Caicedo Smit, who works for Voice of America and discovered in February 2025 that her voice and image had been misused in a deepfake.
Another case involved Slovak journalist Monika Todova, whose voice was used in a fake audio recording where she supposedly spoke with Michal Šimečka, leader of the liberal Progressive Slovakia party, about how to manipulate the elections, in part by buying votes from the country's marginalized Roma minority. Besides the impersonation, this case was concerning because of how disinformation created with deepfakes could interfere with an election. The audio began circulating just hours before the vote.