Russian disinformation network with ties to notorious ‘troll factory’ is taking aim at the US election, analysis finds

The analysis found that a network dubbed “Storm-1516” — which has a history of producing staged videos and deepfakes that parrot the Kremlin’s propaganda – has close connections with a group created by the late Russian oligarch Yevgeny Prigozhin.

The Russian Foundation to Battle Injustice (R-FBI), founded by the former Wagner mercenary boss in 2021, is part of a multi-pronged disinformation effort that has increasingly pivoted from false claims about the Ukraine war to focus on the 2024 US presidential election. The group, which casts itself as a “human rights” organization, is led by Mira Terada, a Russian woman who served more than two years in a US prison on money laundering charges.

The R-FBI organization and the Storm-1516 campaign are among a multitude of active Russian disinformation efforts, many of them overlapping, according to US and European intelligence sources. They use American and foreign social media influencers to promote propaganda and disinformation in the West.

In recent weeks, the network has invented stories out of whole cloth targeting Vice President and Democratic presidential nominee Kamala Harris and her running mate, Minnesota Gov. Tim Walz. They range from fabricated claims that Harris was responsible for a hit-and-run in San Francisco and shot an endangered rhino while on safari in Zambia, to a baseless allegation that Walz sexually assaulted a student.

The Harris campaign has previously expressed concern that media coverage could amplify false Russian claims. Responding to a request for comment on the Russian disinformation narratives attacking Harris and Walz, Morgan Finkelstein, national security spokesperson for the campaign, said: “Vladimir Putin wants Donald Trump to win because he knows Trump will roll over and give him anything he wants. We condemn in the strongest terms any effort by foreign actors to interfere in U.S. elections.”

NBC and Wired have also covered the narratives, attributing them to Storm-1516.

Clemson said it was able to connect Storm-1516 to R-FBI by using scraped data and social listening software to analyze their historical, technical and organizational ties.

“We have found Storm-1516 to be tightly connected to the Russian Foundation to Battle Injustice (R-FBI). Their behavior is much too closely linked than would reasonably occur by accident or simple correlation in aims,” Darren Linvill and Patrick Warren, co-directors of Clemson University’s Media Forensics Hub, wrote in their report published Wednesday. “R-FBI affiliated individuals also frequently share Storm-1516 narratives on their own blogs or news pages. All of this is done at strategic times and routine rates not possible by chance.”

The disinformation campaign has ramped up ahead of the November 5 election, and as US intelligence agencies warn of a major Russian government-backed effort to influence the vote in favor of former US president Donald Trump, who they assess is the Kremlin’s preferred choice. The Biden administration in September announced a sweeping set of actions to tackle the Russian campaign, including unveiling criminal charges against two Russian nationals, sanctions on 10 individuals and entities, and the seizure of 32 internet domains.

Warren and Linvill note that the themes and methods used by Storm-1516 and R-FBI are consistent with those deployed by Prigozhin’s now defunct Internet Research Agency (IRA), widely known as Russia’s troll factory.

One of the recent fake Storm-1516 videos, which was shared by R-FBI network members, showed a man alleging an endangered black rhino was killed during a “diplomatic visit” to Zambia. “It was a female American politician. Her name was Kamala,” the ranger said, claiming that she shot a young rhino while on safari at North Luangwa National Park, and the incident was “swept under the rug.”

Another staged video attributed to the network featured a young woman claiming that Harris paralyzed her in a hit-and-run in San Francisco in 2011. US intelligence agencies assessed that a Russian operation produced the video. Like other disinformation that has gained traction, the video appeared to be staged with an actor rather than manipulated using AI. It was shared by a fake news outlet, “KBSF-TV.”

Many of the websites associated with the Russian disinformation network sound like American media outlets, with names such as The Miami Chronicle, The Boston Times and DC Weekly – a technique that was also used by the IRA.

But they are just fronts for narratives invented in St. Petersburg, where Wagner has its headquarters – an office also used by R-FBI, according to Russian media reports.

Influencers linked to R-FBI come from around the world and, according to Clemson, are often the first social media accounts identified “sharing specific Storm-1516 narratives.”

One American has been actively involved in spreading the fake stories: John Mark Dougan, a former Florida sheriff’s deputy who fled to Moscow in 2016 after facing felony charges of wiretapping and extortion in the US. Granted asylum in Russia, Dougan has become a vocal player in the Kremlin’s disinformation ecosystem, but a senior European intelligence official says he is a small cog in a much larger wheel.

Dougan is part of a constellation of characters promoting pro-Russia talking points through fake videos and websites. A Clemson report last year connected Dougan to the fake news website DC Weekly through a domain and internet protocol address shared by his personal website and two sites marketing his books. The use of real people is a departure from tactics used by Prigozhin’s IRA, which often distributed disinformation through bot networks, but much of the messaging is the same.

An official from the Office of the Director of National Intelligence (ODNI) told reporters last week that the content contained “several indicators of manipulation that are consistent with the influence efforts and tactics with Russian actors.” The US State Department said there was no record of a Kazakh exchange student at the Minnesota school at that time.

On October 24, the same X account carried fake video purporting to show an individual ripping up mail-in ballots for Trump in Bucks County, Pennsylvania. Within three hours it was reposted tens of thousands of times.

Yes, this video showing mail-in ballots being destroyed in Bucks County, PA is fake. And yes, its the Russians.

This Storm-1516 narrative appeared less than three hours ago and it’s already been shared on X tens of thousands of times.

It’s gonna be a rough couple of weeks. pic.twitter.com/IMbaMm8YVF

— Darren Linvill (@DarrenLinvill) October 24, 2024

Local election officials swiftly debunked the video. A day later, the ODNI, FBI and Cybersecurity and Infrastructure Security Agency said the video had been manufactured and amplified by Russian actors. Linvill said Clemson identified the video as a Storm-1516 narrative based on the way it was produced and distributed, adding: “It’s gonna be a rough couple of weeks.”

In an analysis of 25,000 fake stories posted by Storm-1516 and websites affiliated with Dougan between July 2023 and February 2024, Clemson researchers found just 49 included three or more images or video. Of those 57% were identified as Storm-1516 narratives, and 27% were stories from the R-FBI, showing a shared ecosystem.

“While there is no evidence Dougan is responsible for the creation of the narratives themselves, he claims responsibility for a series of AI-generated, fake news websites that have been used to covertly disseminate Storm-1516 messages,” Clemson said in their report.

‘Centralized and orchestrated from above’

In May 2021, Mira Terada arrived at Moscow’s Sheremetyevo International Airport, after serving jail time in the US. She was greeted by one of Prigozhin’s closest aides, Maxim Shugaley, who presented her with flowers, according to a video posted on his Telegram account.

Shortly after, Terada announced she would head up Prigozhin’s R-FBI (its name a nod to the Federal Bureau of Investigation adding him to its most-wanted list). The organization describes itself as a “independent non-profit organization supported by private donations from Russian citizens” and publishes content in Russian, English, German, and French.

Once known as Russian President Vladimir Putin’s “chef,” Prigozhin ran the Wagner paramilitary force before falling foul of the Kremlin and leading a short-lived mutiny in June 2023. He died in a mysterious plane crash two months later, but his influence still looms large.

Terada attended the headquarters’ opening in November 2022 along with other key figures in Russia’s information landscape: Konstantin Pridybaylo, a prominent journalist with state media outlet RT, and Ruslan Ostashko, a Russian TV presenter whose Telegram channel has nearly half a million subscribers.

The Biden administration has sought to blunt RT’s influence ahead of the elections and expose what it says is the Russian state media network’s key role in the Kremlin’s global intelligence and influence operations. In September, the US Justice Department charged two RT employees for covertly funneling nearly $10 million into a US company to create and amplify content that aligned with Russian interests.

Still, Gerard says that R-FBI and other Russian operations are unlikely to influence the outcome of the US election. “Their goal is less ambitious. They simply want the international community to believe that they have the power to influence, to destabilize. They want to be spoken about,” he said.

To that end, Terada has gathered a network of would-be influencers to propagate a range of false stories. She also chairs the BRICS Journalists Association (BJA), which includes foreign reporters in Russian allied states.

Terada has appeared with those reporters, and John Mark Dougan, at media events and conferences. In March – in one of several public appearances together – she stood with Dougan at the launch of his book “Betrayal of the Truth,” and quoted the Russian ultra-nationalist Alexander Dugin as saying the book was a “way to convey the truth about the incredible crimes of American globalist minorities against humanity.”

Last week, The Washington Post reported that Dougan had connections with Dugin’s Moscow institute, the Center for Geopolitical Expertise, and cited documents obtained by a European intelligence service that it said showed Dougan was provided funding by an officer from the GRU, Russia’s military intelligence service.

Another prominent figure in propagating Russian disinformation is American Tara Reade, a former Senate staffer who in 2020 accused then-presidential candidate Joe Biden of sexual harassment.

Reade defected to Russia in 2023 and became a contributor to RT. She has shared Storm-1516 narratives on her X profile 32 times over the last year, and has appeared on the R-FBI website six times, according to Clemson.

The links between Terada’s group and other Russian disinformation efforts are at best opaque, which is likely no accident. The Kremlin has opted for nodes of activity, some closely related to the state’s intelligence services, others less so.

“It’s very centralized and orchestrated from above, but it can sometimes be chaotic and less coherent. There are actors that take their own initiative… and it’s hard to tell sometimes if individuals are acting alone or as a part of a group.”

The Clemson researchers also acknowledge the challenges in establishing the exact organizational relationship between Storm-1516 and R-FBI, but said they were part of a “common structure.”

“The Storm-1516 narratives have had the biggest impact of any Russian disinformation operation the last four years… It means that whoever’s behind Storm-1516 is the most impactful actor. And the strongest evidence that I have is that an entity, either in or behind the R-FBI, is behind Storm-1516,” Warren said.

Sean Lyngaas contributed reporting.

Clemson researchers gathered the full set of R-FBI reports by scraping their website and used qualitative hand coding of individual R-FBI reports to organize them into categories and then counted those over time. To document the connections between the R-FBI influencers and the R-FBI and Storm-1516, researchers used the scraped data from the R-FBI website to find all mentions of those personalities and their full account histories on X (from Sprinklr) to measure how often and early they shared Storm-1516 and R-FBI content.