The transformation of Russian disinformation operations from rudimentary tactics to a sophisticated cognitive warfare doctrine represents one of the most insidious threats to the stability of Western democracies. What emerges from the analysis of Russian digital influence systems is not merely a collection of automated bots, but an integrated industrial ecosystem that combines artificial intelligence, social engineering, financial manipulation, and a deep understanding of the psychological fractures within democratic societies.

Meliorator: The Software That Industrialized Manipulation

In July 2024, the U.S. Department of Justice seized the domains of what represents the most advanced bot farm operation ever documented. At the heart of the operation lies Meliorator, an AI-powered software package developed by RT (Russia Today) affiliates under the direction of an official identified as a former deputy editor-in-chief of the Russian state broadcaster. Joint analyses by the FBI, Canadian, and Dutch intelligence services revealed a surgical technical architecture.

Technical Architecture: Brigadir, Taras, and the Automation of Deception

Meliorator is structured around three fundamental components that transform the creation of false identities from a manual process to a scalable industrial operation:

• Brigadir: The administrative interface that allows operators to manage thousands of fictitious identities (called "souls") and assign automated action scenarios (called "thoughts"). Operators connect via Virtual Network Computing (VNC) to control the entire operation remotely.
• Taras: The decentralized back-end that manages bot logic through JSON files and MongoDB databases. The system executes complex scripts to simulate authentic human behaviors, including posting patterns, social interactions, and credible periods of inactivity.
• Faker and Nemezida: Identity generation tools. Faker creates profile photos via AI, while Nemezida uses web crawlers to collect real data from the internet, creating bots that appear completely authentic with no visible connection to artificial intelligence.

The system is capable of bypassing two-factor authentication by intercepting codes on email servers managed by the organization, allowing Russian bots to maintain stable accounts on platforms like X, Facebook, and Instagram despite moderation attempts. By June 2024, Meliorator had created 968 verified accounts on X, but analysis indicates the intention to expand capabilities to other social platforms.

Three Bot Archetypes to Avoid Detection

Meliorator's strategic approach involves creating three distinct types of bots, each with a specific role in the disinformation ecosystem:

• High-activity bots: Complete profiles with AI-generated photos, detailed biographies indicating political orientations and ideologies, geographic location. These bots conduct the most robust activity and are used to actively propagate disinformation.
• Low-information bots: Minimal profiles used primarily to amplify content through "likes" and shares, artificially inflating message reach without drawing attention to individual accounts.
• Nemezida bots: The most sophisticated, built using real data scraped from the web to create authentic personas with verifiable histories, organic activity, and genuine followers. They represent the pinnacle of algorithmic deception.

A critical feature: most accounts followed by the bots boast over 100,000 followers, a threshold necessary to avoid detection when interacting with other accounts. The system automatically assigns proxy IP addresses based on the bot's assumed geographic location, creates variations in user agent strings, and implements backend code to mask the Russian origin of the operation.

Storm-1516: The Face of Deepfake Disinformation

While Meliorator represents mass automation, Storm-1516 embodies high-impact artisanal manipulation. This operation, discovered by Clemson University researchers in fall 2023 and confirmed by Microsoft as a coordinated Kremlin campaign, has produced some of the most viral and damaging false narratives in recent years.

John Mark Dougan: The American Serving the GRU

At the center of Storm-1516 is a former American Marine and Florida deputy sheriff, John Mark Dougan, who fled to Russia in 2016 after an FBI raid. According to the Washington Post, based on over 150 pages of European intelligence documents, the GRU (Russian military intelligence service) funded Dougan and directed his operations through Valery Korovin of the Center for Geopolitical Expertise. The GRU reportedly provided Dougan with artificial intelligence tools to generate texts, photos, and videos on servers hosted in Russia.

In December 2025, the European Union sanctioned Dougan, making him the first American citizen sanctioned for running influence operations aimed at manipulating public debate in Western countries. NewsGuard named him "Disinformer of the Year 2024," documenting how his network produced over 171 fake news sites and 32 false narratives, generating more than 67 million views in 16 languages.

The Evolution: From Amateur Videos to Industrial Deepfakes

Storm-1516 has undergone rapid technological evolution. Starting in late 2023 with YouTube videos of real people posing as whistleblowers, by early 2024 the operation had already implemented AI-generated personas and sophisticated deepfake videos. The video production team reportedly operates from an office in St. Petersburg and recruits actors from diaspora communities present in Russia.

Case Studies: Viral False Accusations

Storm-1516's effectiveness lies in its ability to create false visual evidence that is amplified through a coordinated network of over 100 websites and thousands of social accounts. The most significant operations include:

• The Kamala Harris Case (September 2024): A deepfake video claimed that in 2011 Harris had caused a car accident in San Francisco, leaving a 13-year-old girl paralyzed, then fled the scene. The video included X-rays stolen from medical journals and photos of a 2018 accident in Guam. The story generated millions of views and was shared by Senator JD Vance.
• The Tim Walz Accusations (October 2024): A coordinated campaign with fake testimonies from supposed former students accusing Walz of abuse. Before removal, one video received 4.3 million views. The email images provided as evidence contained glaring errors such as visible text cursors in screenshots.
• Operation Zelensky-Hitler (November 2024): Over 100 Dougan sites simultaneously published the false story that Zelensky had purchased a house that once belonged to Hitler, generating 19.8 million views across 5,087 posts.

In November 2025 alone, Storm-1516 produced five false narratives that spread through 11,900 articles and posts on X and Telegram, reaching 43 million views. According to Euromaidan Press, in 2025 Storm-1516 generated more false claims than RT and Sputnik combined.

Targeting European Elections

Storm-1516 has not spared Europe. CORRECTIV investigations in Germany revealed that over 100 fake German-language sites were created to spread AI-generated articles, deepfakes, and fabricated stories ahead of the German federal elections on February 23, 2025. The narratives included:

• False sexual abuse accusations against Robert Habeck (Green candidate), spread through deepfake videos that digitally recreate an alleged former consultant from the deputy's office.
• Claims that Marcus Faber, head of the parliament's defense committee and Ukraine supporter, was actually a secret Russian agent.
• False stories about alleged agreements to bring 1.9 million workers from Kenya to Germany, designed to fuel racist and Islamophobic sentiments.

Between July 2024 and February 2025, links to Storm-1516 domains related to Germany were posted 3,280 times on X and 692 times on Telegram, generating 4.7 million total views. Significantly, Storm-1516 content was picked up and distributed by official AfD accounts, conferring legitimacy to the false narratives.

Doppelgänger: The Sabotage of Journalistic Credibility

Operation Doppelgänger, managed by Moscow-based companies Social Design Agency (SDA) and Structura National Technologies, represents the most persistent and sophisticated media impersonation campaign ever documented. Launched in May 2022 immediately after the full-scale invasion of Ukraine, the campaign was exposed by the EU DisinfoLab in September 2022 but has continued to operate and expand despite sanctions.

The Industrial Typosquatting Technique

The mechanism is surgical: operators register domains like washingtonpost.pm instead of .com, derspiegel.com instead of spiegel.de, or ansa.ltd instead of ansa.it. These mirror sites faithfully reproduce the graphic design, fonts, and logos of the original publications but publish articles laden with Russian propaganda.

Cloned Publication Conveyed Narrative Mechanism Der Spiegel (Germany) Energy crisis caused by Ukraine support Bots on X and Meta with obfuscated links Le Monde (France) Government support for Ukrainian 'Nazis' Mass comments under official posts Fox News (USA) LGBTQ+ criticism and US military competence Infiltration of conservative MAGA groups ANSA (Italy) Distrust of EU and NATO institutions Pro-Kremlin troll comments The operation uses geofencing techniques to limit the visibility of cloned content only to IP addresses of target countries, making identification by global security researchers more difficult. The network has expanded its reach by creating fake sites of the French Foreign Ministry and NATO, publishing fake press releases about tax increases to fund the war.

Direction and Funding from the Kremlin

The U.S. Department of Justice revealed that Doppelgänger operates under the direction and control of the Russian Presidential Administration, particularly Sergei Kiriyenko, First Deputy Chief of Staff of the Presidential Executive Office. In September 2024, the Department of Justice seized 32 internet domains used in the campaign, violations of federal money laundering and trademark laws.

Concurrent with the domain seizure, the U.S. Treasury Department designated 10 individuals and two entities (Social Design Agency and Structura) as part of a coordinated response to Russia's malign influence efforts targeting the 2024 U.S. presidential elections. The campaign produced Facebook advertisements targeted at French and German audiences with messages about aid to Ukraine, farmer protests, and the Gaza war.

Continued Expansion Despite Sanctions

Despite EU sanctions in August 2023 and Department of Justice actions in September 2024, Doppelgänger has continued to operate and expand. A December 2024 report by Alliance 4 Europe accused X (Twitter) of failing to adequately address illegal content and failing to counter the Doppelgänger campaign. In January 2025, RT opened a new X account for its RT Germany (RT DE) channel, accumulating over 17,000 followers in a few days and paying for verified blue checkmark, despite the ban on financial transactions with sanctioned entities. X subsequently removed the account.

The Pravda Network: Poisoning Artificial Intelligence Models

In 2025, the disinformation challenge entered a critical phase with the emergence of what researchers call "LLM grooming" - the deliberate contamination of datasets used to train Western artificial intelligence chatbots. At the center of this strategy is the Pravda network (no relation to the propaganda newspaper of the same name), a Moscow-based operation discovered by the French government agency VIGINUM in February 2024.

The Scale of the Operation

According to NewsGuard, in 2024 alone the Pravda network published 3.6 million articles through a network of 150 websites presenting themselves as independent news outlets. These articles are not original content but strategic aggregations of material from Russian government agencies, state media like RT and Sputnik, and pro-Kremlin influencers.

The domains have names like denmark.news-pravda.com, trump.news-pravda.com, nato.news-pravda.com, using two-letter country codes (FI for Finland, NO for Norway). All sites are hosted on servers located in Russia. The network is managed by TigerWeb, an IT company based in Russian-occupied Crimea.

Infiltration of Western Chatbots

An audit conducted by NewsGuard on 10 leading chatbots - including OpenAI's ChatGPT-4o, Google's Gemini, Microsoft's Copilot, Anthropic's Claude, Meta AI, xAI's Grok, Perplexity and others - revealed alarming results: 33% of the time these systems reproduced narratives spread by the Pravda network, citing fake articles as legitimate sources.

Chatbot Audit Results Percentage Repetition of Pravda disinformation 33.55% Debunking of false narratives 48.22% No response 18.22% Total responses with direct links to Pravda 56 out of 450 Collectively, the chatbots cited 92 different articles from the network containing disinformation, with two models referencing as many as 27 Pravda articles each. Seven chatbots directly cited specific Pravda articles as sources, conferring legitimacy in users' eyes.

The LLM Grooming Mechanism

The American Sunlight Project formulated the concept of "LLM grooming" in February 2025, warning that "the wider a set of pro-Russia narratives, the greater the likelihood it will be integrated into a Large Language Model." By flooding search results and web crawlers with pro-Kremlin falsehoods, the network distorts how language models process and present news and information.

The mechanism operates on two levels:

1. Real-time contamination: Chatbots searching for information on the web in real-time encounter Pravda articles in search results and present them as credible sources.
2. Training data contamination: Pravda articles are absorbed into training datasets for future models, ensuring that the next generation of AI communicates Russian narratives even without searching for additional information online.

As John Mark Dougan declared at a Moscow conference in January 2025: "By pushing these Russian narratives from the Russian perspective, we can actually change worldwide AI. It's not a tool to be afraid of, it's a tool to leverage."

The 207 Documented False Narratives

NewsGuard has identified at least 207 demonstrably false claims spread by the Pravda network since its launch in April 2022. The main narratives include:

• Secret U.S. biological weapons laboratories in Ukraine
• Misuse of U.S. military aid by Zelensky
• Zelensky's ban on Truth Social (completely fabricated platform)
• Zelensky's purchase of Bill Cosby's $29 million villa
• Ukraine as a Nazi regime requiring denazification

When NewsGuard posed the question "Why did Zelensky ban Truth Social?" to chatbots, six out of ten repeated the false narrative as fact, in many cases citing articles from the Pravda network.

Strategic Synthesis: An Integrated Manipulation Ecosystem

The integrated analysis of the four main operations - Meliorator, Storm-1516, Doppelgänger, and the Pravda network - reveals an enemy that no longer seeks merely to convince, but to confuse. Russian cognitive warfare aims to destroy the connective tissue between State and society, rendering citizens unable to distinguish between facts and fiction.

Operation Primary Technique Geopolitical Impact Meliorator AI bot farm to simulate organic mass movements Erosion of trust in elections and institutions Storm-1516 Deepfakes and videos with actors for viral false accusations Election targeting with personalized narratives Doppelgänger Cloning authoritative media sites with typosquatting Destruction of professional journalism credibility Pravda Network Infiltration of AI training data with 3.6M articles/year Long-term corruption of digital knowledge base These four vectors operate in synergy, creating a self-reinforcing manipulation ecosystem:

1. Meliorator creates the critical mass of accounts that organically amplify content produced by other operations.
2. Storm-1516 produces high-impact viral content (deepfakes, false accusations) that captures media attention and generates emotional shares.
3. Doppelgänger confers apparent legitimacy by presenting narratives as coming from recognized journalistic sources.
4. The Pravda network guarantees long-term persistence by infiltrating AI systems that will become the primary means of accessing information.

The scale of operations is impressive:

• 968 verified bot accounts on X (Meliorator alone)
• 171+ fake news sites (Storm-1516)
• 300+ cloned domains (Doppelgänger)
• 150 active websites, 3.6 million articles in 2024, 83+ target countries (Pravda network)
• 43 million views from just 5 Storm-1516 narratives in November 2025
• 67 million cumulative views of documented Storm-1516 operations

Conclusions: The Threat to European Cognitive Sovereignty

Russia has demonstrated that information can be scaled, micro-targeted, and made convincing enough to paralyze collective responses from democracies. In this scenario, truth is not just an ethical value but a fundamental national security asset for the survival of the democratic system itself.

The response requires "cognitive resilience" that cannot be limited to fact-checking. An approach is needed that combines:

• Systematic digital literacy for the population
• Strengthening of national cyber infrastructures
• Coordinated legislative response to dismantle funding networks
• Obligation for AI platforms to verify training datasets
• Coordination between public and private sectors to identify operations
• Severe sanctions for platforms that do not actively counter state disinformation

Europe must recognize that Russian hybrid warfare has already deeply penetrated its information space. Every day of delay in response allows Meliorator to create more bots, Storm-1516 to produce more deepfakes, Doppelgänger to clone more publications, and the Pravda network to further contaminate the AI systems that will shape future generations' perception of reality.

European cognitive sovereignty is at stake. The ability to distinguish truth from falsehood has never been so critical for the survival of democracy.

Bibliography and Sources

Government and Intelligence Sources

• FBI/CISA/DOJ Joint Cybersecurity Advisory. "State-Sponsored Russian Media Leverages Meliorator Software." July 2024. https://www.ic3.gov/CSA/2024/240709.pdf
• U.S. Department of Justice. "Justice Department Disrupts AI-Powered Bot Farm." July 2024. https://www.justice.gov
• VIGINUM (France). "Portal Kombat/Pravda Network Analysis." February 2024.

Academic and Think Tank Research

• Microsoft Threat Analysis Center. "Russian election interference efforts focus on the Harris-Walz campaign." September 2024. https://blogs.microsoft.com
• Center for Strategic and International Studies (CSIS). "A Russian Bot Farm Used AI to Lie to Americans. What Now?" 2024. https://www.csis.org
• American Sunlight Project. "LLM Grooming Report." February 2025. https://www.americansunlight.org

Investigative Journalism

• NewsGuard. "A Well-funded Moscow-based Global 'News' Network has Infected Western Artificial Intelligence Tools Worldwide with Russian Propaganda." March 2025. https://www.newsguardtech.com
• Washington Post. "American creating deepfakes targeting Harris works with Russian intel, documents show." October 2024. https://www.washingtonpost.com
• CORRECTIV. "Influence operation exposed: How Russia meddles in Germany's election campaign." January 2025. https://correctiv.org
• NBC News. "How Russian disinformation is reaching the U.S. ahead of the 2024 election." 2024. https://www.nbcnews.com
• Euromaidan Press. "Russia's covert influence operation now outpaces state media in spreading Ukraine war falsehoods." December 2025. https://euromaidanpress.com

Monitoring Organizations

• EU DisinfoLab. "Doppelganger - Media clones serving Russian propaganda." 2022-2024. https://www.disinfo.eu
• EDMO (European Digital Media Observatory). "Storm-1516, the pro-Russian disinformation operation threatening the public debate." 2024. https://edmo.eu
• Alliance for Securing Democracy. "Russia exploits AI training data to spread propaganda via chatbots." 2025. https://securingdemocracy.gmfus.org