Archived link
Russia’s disinformation machine didn’t just meddle in Germany’s 2025 elections — it built an entire fake media ecosystem to do it. Through a network of over 100 bogus news sites and psychological operations like Storm-1516, the Kremlin sowed chaos, amplified far-right narratives, and targeted key political figures with fabricated scandals.
[...]
Just a few days before the extraordinary German elections in February of this year, a two-minute video appeared on social network X showing the destruction of ballots cast for the far-right Alternative for Germany (AfD) party. The video claimed to expose electoral fraud designed to suppress Germany’s far-right. But the video itself was a fake. According to German security services, it was part of a Russian disinformation campaign orchestrated by the group Storm-1516.
[...]
For example, you could learn that Green Party candidate Robert Habeck was accused of abusing a young woman years ago. Other unsubstantiated claims included an article about how Foreign Minister Annalena Baerbock met with a male escort during her trips to Africa, and one that alleged that Marcus Faber, the head of the German parliament’s defense committee, is a Russian agent. Other fake news articles claimed that the German army was planning to mobilize 500,000 men for a military operation in Eastern Europe, and that there was a migration agreement signed by Germany that would allow 1.9 million Kenyans to come to the country.
[...]
[Germany] is yet another target of an extensive cyber offensive that Russia has waged for many years, one that also concerns other European states. This offensive consists of a series of often independent but interconnected operations known mostly by code designations such as Storm-1516 (and another one using the same modus operandi, named Operation CopyCop), Doppelgänger (and its variants such as Operation Overload), UnderCut, and Matryoshka.
[...]
Storm-1516 and its CopyCop and other operations
The group known as Storm-1516 is responsible for a network of various actors connected to Russian state bodies, proxy organizations, and accounts distributing the content of various influencers. The group first attracted attention in 2023 while trying to influence American primary campaigns. Since then, it has been mentioned in connection with other influence operations, including activities in Germany. Its actions are often referred to by the media as CopyCop or other names.
At the core of the Storm-1516’s operation in Germany was content production backed by John Mark Dougan, a former Florida police officer who fled to Russia in 2016 to avoid criminal prosecution. [...] he is behind a network of 102 web pages with professional layouts and names like “Berliner Wochenzeitung,” “Hamburger Post,” “Echo der Zeit,” or “Widerhall,” which appear to be classic news websites. However, according to analysis by Newsguard, they primarily published artificial intelligence (AI) content inspired by or paraphrasing from right-wing media such as Compact or the pro-Russian blog Nachdenkseiten.
[...]
Storm-1099 and Doppelgänger
Storm-1516 was not the only Russian group that directed its operations against Germany and used websites with disinformation to do so. Germany also became the target of other campaigns. Among them was the so-called Doppelgänger operation, which was behind the group designated by Microsoft researchers as Storm-1099. The Doppelgänger operation has been ongoing across Europe since at least May 2022. Its name means “double” and captures the essence of its activity: As part of this operation, attackers create numerous fake pages that seem like regular mainstream websites, with URLs that resemble these websites, too. In Germany, doubles appeared of Der Spiegel, Bild, and T-Mobile.
These lookalikes of legitimate websites then share disinformation. Networks of equally fake accounts on X or Facebook are then used to spread content from these fake websites, which, again, looks like it’s coming from the real thing. According to a report by the German Foreign Ministry from January 2024, 50,000 accounts on the social network X participated in one part of the operation.
[...]
Matryoshka
The third operation that we observed during the past year in Germany and throughout Europe was the so-called Matryoshka operation, which was first documented by the group bot blocker (operating on the X network under the account @Antibot4Navalny) in September 2023. The principles of Matryoshka were then detailed by the French agency VIGINUM in its detailed report.
Unlike Storm-1516 and Doppelgänger, the Matryoshka operation does not focus only on the actual spread and creation of disinformation but also on overwhelming the victims of disinformation campaigns, such as politicians or journalists or fact-checking organizations. The aim is to limit their ability to respond. The campaign itself takes place in two phases. “The first group of accounts, known as ‘seeders,’ publishes false content on the platform. The second group of accounts, called ‘quoters,’ then shares the seeder’s post and a reaction to it. Quoters contact target individuals or organizations and ask them to verify the authenticity or truthfulness of the content published by seeders,” states the Viginum agency report.
According to a June report by the Finnish company Check First, Operation Overload, using Matryoshka tactics, was able to affect 800 organizations from more than 75 countries, among which France and Germany played a key role. Check First cites an example of a video that was made to look as if it had come from the German media BR24. The fictional news clip ridicules a Ukrainian refugee who allegedly worked in a Berlin aquarium and claims that he stole tropical fish there, cooked and ate them, and subsequently suffered poisoning, leading to his hospitalization. The footage includes a photograph of a Ukrainian man identified as Oleg Panasjuk. A reverse image search revealed that this photograph was lifted from a Russian dating site and involves the profile of a person residing in Russia.
The video was then spread on Twitter until an account belonging to the Matryoshka network asked a BBC fact-checker to check it. BR24 responded to the entire campaign with a long explanatory text. However, as Janina Lückoff, an editor and head of the fact-checking team at BR24, told The New Arab, “dealing with fake media content, of course, limits our capacities.”
[...]
Attacks on cyber infrastructure
While Storm-1516, Doppelgänger, and Matryoshka focused primarily on spreading disinformation in Germany, other attacks were oriented toward its cyber infrastructure.
In 2023, the Social Democratic Party of Germany (SPD) became the victim of a cyber attack. Email accounts of the party headquarters were hacked. The German government then accused a GRU unit, specifically the APT28 group (also known as Fancy Bear), of the attack.
[...]
At the end of February 2024, researchers from the security company Mandiant identified a new wave of attacks, this time targeting the German Christian Democratic Union (CDU) and potentially other German political parties. The attack was carried out by the APT29 group (also known as Cozy Bear), associated with the Russian Foreign Intelligence Service (SVR).
[...]
From noise to signal
According to James Pamment from the Psychological Defence Research Institute at Lund University, the groups and agencies involved in disinformation campaigns and cyber attacks aim to penetrate the national security environment. “At the first level, it looks like spamming. They use paid advertising, automatic comments, and other low-quality methods of spamming digital media with links. It’s like advertising, and they expect 95% of it to be ignored, so it turns into something like background noise. Constant drumming that’s always here,” he said of the psychology of extensive operations.
[...]
But according to the expert, this part is followed by two more steps: “They assume that at some point, the user will be provoked to click on one of these links to learn more. The network of web platforms offers something for every target group – if you need to hear their narratives from the Guardian, they have double websites available. If you need to hear them from unconventional media, they have created these brands. They have created reliable intermediaries for almost any target audience,” said Pamment, adding that the real goal is to get the disinformation repeated by politicians, celebrities, influencers, and even voters’ neighbors. If successful, the disinformation becomes a part of the normal discourse. Then those responsible can say they successfully penetrated the information environment.