Russian disinformation network with ties to notorious ‘troll factory’ is taking aim at the US election, analysis finds

A spinoff of the Russian “troll factory” that targeted the 2016 US presidential election now appears to be at the heart of a disinformation campaign trying to sway Western and especially US audiences, according to an investigation by researchers at Clemson University’s Media Forensics Hub with CNN.

The analysis found that a network dubbed “Storm-1516” — which has a history of producing staged videos and deepfakes that parrot the Kremlin’s propaganda – has close connections with a group created by the late Russian oligarch Yevgeny Prigozhin.

The Russian Foundation to Battle Injustice (R-FBI), founded by the former Wagner mercenary boss in 2021, is part of a multi-pronged disinformation effort that has increasingly pivoted from false claims about the Ukraine war to focus on the 2024 US presidential election. The group, which casts itself as a “human rights” organization, is led by Mira Terada, a Russian woman who served more than two years in a US prison on money laundering charges.

CNN has reached out to Terada for comment on the R-FBI’s role in Russian disinformation efforts, and ties to the state.

The R-FBI organization and the Storm-1516 campaign are among a multitude of active Russian disinformation efforts, many of them overlapping, according to US and European intelligence sources. They use American and foreign social media influencers to promote propaganda and disinformation in the West.

In recent weeks, the network has invented stories out of whole cloth targeting Vice President and Democratic presidential nominee Kamala Harris and her running mate, Minnesota Gov. Tim Walz. They range from fabricated claims that Harris was responsible for a hit-and-run in San Francisco and shot an endangered rhino while on safari in Zambia, to a baseless allegation that Walz sexually assaulted a student.

The Harris campaign has previously expressed concern that media coverage could amplify false Russian claims. Responding to a request for comment on the Russian disinformation narratives attacking Harris and Walz, Morgan Finkelstein, national security spokesperson for the campaign, said: “Vladimir Putin wants Donald Trump to win because he knows Trump will roll over and give him anything he wants. We condemn in the strongest terms any effort by foreign actors to interfere in U.S. elections.”

Russia’s foreign ministry did not immediately respond to CNN’s request for comment.

Storm-1516 and R-FBI network members have spread at least 54 different disinformation narratives online since August 2023, according to Clemson and CNN’s analysis. Of the 10 most recent narratives, seven focus on US politics – none are supported by any evidence.

NBC and Wired have also covered the narratives, attributing them to Storm-1516.

US intelligence agencies have assessed that Russian operatives are behind some of the narratives but have not pointed to a specific group. A senior European intelligence official told CNN that they were difficult to trace but confirmed that they had been linked to Storm-1516, which was first uncovered by Clemson last fall.

Clemson said it was able to connect Storm-1516 to R-FBI by using scraped data and social listening software to analyze their historical, technical and organizational ties.

“We have found Storm-1516 to be tightly connected to the Russian Foundation to Battle Injustice (R-FBI). Their behavior is much too closely linked than would reasonably occur by accident or simple correlation in aims,” Darren Linvill and Patrick Warren, co-directors of Clemson University’s Media Forensics Hub, wrote in their report published Wednesday. “R-FBI affiliated individuals also frequently share Storm-1516 narratives on their own blogs or news pages. All of this is done at strategic times and routine rates not possible by chance.”

The disinformation campaign has ramped up ahead of the November 5 election, and as US intelligence agencies warn of a major Russian government-backed effort to influence the vote in favor of former US president Donald Trump, who they assess is the Kremlin’s preferred choice. The Biden administration in September announced a sweeping set of actions to tackle the Russian campaign, including unveiling criminal charges against two Russian nationals, sanctions on 10 individuals and entities, and the seizure of 32 internet domains.

Warren and Linvill note that the themes and methods used by Storm-1516 and R-FBI are consistent with those deployed by Prigozhin’s now defunct Internet Research Agency (IRA), widely known as Russia’s troll factory.

One of the recent fake Storm-1516 videos, which was shared by R-FBI network members, showed a man alleging an endangered black rhino was killed during a “diplomatic visit” to Zambia. “It was a female American politician. Her name was Kamala,” the ranger said, claiming that she shot a young rhino while on safari at North Luangwa National Park, and the incident was “swept under the rug.”

The national park told CNN that Harris had never been there, and the man was not an employee. Automated analysis techniques found evidence of facial manipulation in the video, suggesting that the man’s face had been digitally altered.

Another staged video attributed to the network featured a young woman claiming that Harris paralyzed her in a hit-and-run in San Francisco in 2011. US intelligence agencies assessed that a Russian operation produced the video. Like other disinformation that has gained traction, the video appeared to be staged with an actor rather than manipulated using AI. It was shared by a fake news outlet, “KBSF-TV.”

Many of the websites associated with the Russian disinformation network sound like American media outlets, with names such as The Miami Chronicle, The Boston Times and DC Weekly – a technique that was also used by the IRA.

But they are just fronts for narratives invented in St. Petersburg, where Wagner has its headquarters – an office also used by R-FBI, according to Russian media reports.

Influencers linked to R-FBI come from around the world and, according to Clemson, are often the first social media accounts identified “sharing specific Storm-1516 narratives.”

One American has been actively involved in spreading the fake stories: John Mark Dougan, a former Florida sheriff’s deputy who fled to Moscow in 2016 after facing felony charges of wiretapping and extortion in the US. Granted asylum in Russia, Dougan has become a vocal player in the Kremlin’s disinformation ecosystem, but a senior European intelligence official says he is a small cog in a much larger wheel.

“When it comes to Storm-1516 activities he’s being paid,” the official told CNN, adding “he’s a useful idiot. Not the mastermind, but a pawn.”

In messages to CNN, Dougan denied that he was acting on behalf of, or being paid by, the Russian state. He has also denied being behind any Russian disinformation campaign. “Does anyone believe that an American would be the spearhead of what some call the biggest Russian Disinformation operation since the cold war? It strains credulity to think this would be possible,” he said.

Dougan is part of a constellation of characters promoting pro-Russia talking points through fake videos and websites. A Clemson report last year connected Dougan to the fake news website DC Weekly through a domain and internet protocol address shared by his personal website and two sites marketing his books. The use of real people is a departure from tactics used by Prigozhin’s IRA, which often distributed disinformation through bot networks, but much of the messaging is the same.

Dougan and the Russian-backed network of fake news websites have been linked to all 54 narratives analyzed by Clemson and CNN. One of the most recent, a story that circulated earlier this month, attempted to smear Walz. The baseless claim that Walz sexually assaulted a foreign exchange student from Kazakhstan while he was a teacher in Minnesota was identified by US intelligence agencies as having been created by Russian operatives.

An official from the Office of the Director of National Intelligence (ODNI) told reporters last week that the content contained “several indicators of manipulation that are consistent with the influence efforts and tactics with Russian actors.” The US State Department said there was no record of a Kazakh exchange student at the Minnesota school at that time.

Dougan appeared along with the alleged victim, whose voice was altered and identity hidden, on the podcast RedPill78, which describes itself as a “citizen journalist” outlet and frequently shares conspiracy theories. The fake interview was carried on Rumble, Apple Podcasts and other platforms. It was also repeated on websites and social media accounts known to be operated by Dougan and shared by right-wing personalities, garnering nearly a million views on X. CNN reached out to Apple for comment.

About a week later, a manufactured video promoting a similar claim was shared by X account @TheWakeninq. It went viral with some 4.5 million views and was picked up by dozens of accounts associated with Storm-1516, as well as a pro-MAGA website. The video appeared to have been substantially manipulated, with unnatural facial expressions and a robotic voice, according to a CNN analysis using deepfake detector tools.

On October 24, the same X account carried fake video purporting to show an individual ripping up mail-in ballots for Trump in Bucks County, Pennsylvania. Within three hours it was reposted tens of thousands of times.

Local election officials swiftly debunked the video. A day later, the ODNI, FBI and Cybersecurity and Infrastructure Security Agency said the video had been manufactured and amplified by Russian actors. Linvill said Clemson identified the video as a Storm-1516 narrative based on the way it was produced and distributed, adding: “It’s gonna be a rough couple of weeks.”

In an analysis of 25,000 fake stories posted by Storm-1516 and websites affiliated with Dougan between July 2023 and February 2024, Clemson researchers found just 49 included three or more images or video. Of those 57% were identified as Storm-1516 narratives, and 27% were stories from the R-FBI, showing a shared ecosystem.

“While there is no evidence Dougan is responsible for the creation of the narratives themselves, he claims responsibility for a series of AI-generated, fake news websites that have been used to covertly disseminate Storm-1516 messages,” Clemson said in their report.

In May 2021, Mira Terada arrived at Moscow’s Sheremetyevo International Airport, after serving jail time in the US. She was greeted by one of Prigozhin’s closest aides, Maxim Shugaley, who presented her with flowers, according to a video posted on his Telegram account.

Shortly after, Terada announced she would head up Prigozhin’s R-FBI (its name a nod to the Federal Bureau of Investigation adding him to its most-wanted list). The organization describes itself as a “independent non-profit organization supported by private donations from Russian citizens” and publishes content in Russian, English, German, and French.

Once known as Russian President Vladimir Putin’s “chef,” Prigozhin ran the Wagner paramilitary force before falling foul of the Kremlin and leading a short-lived mutiny in June 2023. He died in a mysterious plane crash two months later, but his influence still looms large.

Wagner’s headquarters, a modern high-rise building in St. Petersburg, now appears to be a hub for fresh disinformation efforts. Besides the R-FBI, representatives of a voluntary association called “Cyberfront Z” – linked to Russian disinformation efforts in the Ukraine war – and other groups have used the building on Zolnaya Street for their activities, according to photos from events there shared by pro-Russian media and geolocated by CNN.

Terada attended the headquarters’ opening in November 2022 along with other key figures in Russia’s information landscape: Konstantin Pridybaylo, a prominent journalist with state media outlet RT, and Ruslan Ostashko, a Russian TV presenter whose Telegram channel has nearly half a million subscribers.

The Biden administration has sought to blunt RT’s influence ahead of the elections and expose what it says is the Russian state media network’s key role in the Kremlin’s global intelligence and influence operations. In September, the US Justice Department charged two RT employees for covertly funneling nearly $10 million into a US company to create and amplify content that aligned with Russian interests.

Colin Gerard, a French researcher who has followed R-FBI closely, told CNN that the organization is far from independent. After Prigozhin’s death, it was “reintegrated into the Russian state influence system,” he said, adding that Terada has taken part in training courses offered by ANO Dialog, a disinformation operation that was sanctioned by the US in September for operating at the direction of the Russian government.

Still, Gerard says that R-FBI and other Russian operations are unlikely to influence the outcome of the US election. “Their goal is less ambitious. They simply want the international community to believe that they have the power to influence, to destabilize. They want to be spoken about,” he said.

To that end, Terada has gathered a network of would-be influencers to propagate a range of false stories. She also chairs the BRICS Journalists Association (BJA), which includes foreign reporters in Russian allied states.

Terada has appeared with those reporters, and John Mark Dougan, at media events and conferences. In March – in one of several public appearances together – she stood with Dougan at the launch of his book “Betrayal of the Truth,” and quoted the Russian ultra-nationalist Alexander Dugin as saying the book was a “way to convey the truth about the incredible crimes of American globalist minorities against humanity.”

Last week, The Washington Post reported that Dougan had connections with Dugin’s Moscow institute, the Center for Geopolitical Expertise, and cited documents obtained by a European intelligence service that it said showed Dougan was provided funding by an officer from the GRU, Russia’s military intelligence service.

Dougan told CNN he did not receive funding from the GRU, and said he did not work with the R-FBI or its head, Mira Terada.

Another prominent figure in propagating Russian disinformation is American Tara Reade, a former Senate staffer who in 2020 accused then-presidential candidate Joe Biden of sexual harassment.

Reade defected to Russia in 2023 and became a contributor to RT. She has shared Storm-1516 narratives on her X profile 32 times over the last year, and has appeared on the R-FBI website six times, according to Clemson.

Shortly after CNN requested comment from Reade through her lawyer, she appeared on RT to say that the network had asked her to comment on reports that she amplified Russian disinformation, and dismissed the request as “silly.”

Chay Bowes, an Irish journalist and commentator for RT, and Australian Simeon Boikov, a propagandist podcaster who sought asylum in the Russian consulate in Sydney, have also shared fake stories and videos from Storm-1516 and R-FBI, Clemson and CNN’s analysis showed. Boikov’s X account, “Aussie Cossack,” was recently suspended.

Bowes told CNN that he had not originated the posts but merely commented on them. CNN also has reached out to Boikov for comment.

The links between Terada’s group and other Russian disinformation efforts are at best opaque, which is likely no accident. The Kremlin has opted for nodes of activity, some closely related to the state’s intelligence services, others less so.

A senior European intelligence source who has studied the web of Russian disinformation efforts told CNN: “The people involved in these ecosystems are doing it for different reasons. Some are motivated by money; others are doing it based on their convictions.”

“It’s very centralized and orchestrated from above, but it can sometimes be chaotic and less coherent. There are actors that take their own initiative… and it’s hard to tell sometimes if individuals are acting alone or as a part of a group.”

The Clemson researchers also acknowledge the challenges in establishing the exact organizational relationship between Storm-1516 and R-FBI, but said they were part of a “common structure.”

“The Storm-1516 narratives have had the biggest impact of any Russian disinformation operation the last four years… It means that whoever’s behind Storm-1516 is the most impactful actor. And the strongest evidence that I have is that an entity, either in or behind the R-FBI, is behind Storm-1516,” Warren said.

Sean Lyngaas contributed reporting.

How CNN reported this storyClemson University’s Media Forensics Hub researchers and CNN journalists analyzed links between the Russian disinformation campaign Storm-1516 and the Russian Foundation to Battle Injustice (R-FBI) using several techniques.

Clemson researchers gathered the full set of R-FBI reports by scraping their website and used qualitative hand coding of individual R-FBI reports to organize them into categories and then counted those over time. To document the connections between the R-FBI influencers and the R-FBI and Storm-1516, researchers used the scraped data from the R-FBI website to find all mentions of those personalities and their full account histories on X (from Sprinklr) to measure how often and early they shared Storm-1516 and R-FBI content.

Clemson and CNN assessed 54 Storm-1516 narratives associated with John Mark Dougan websites and R-FBI network members. To measure the story types and origins of websites associated with Dougan, Clemson scraped their data. They then extracted media and post length information and noted a small set of outliers in that distribution.