By Natalie Huet, Mascha Wolf, and Eva Maitland | Published on Feb. 27, 2026

A Russian influence operation has shifted its strategy over the past year not only to spread false claims about Ukraine, but increasingly to aim disparaging narratives at French President Emmanuel Macron and German Chancellor Friedrich Merz. It’s an apparent effort to discredit two of Ukraine’s staunchest allies as they move in to fill the near-total reduction in U.S. financial support for Ukraine.  

At the fourth anniversary of Russia’s Feb. 24, 2022, full-scale invasion of Ukraine, a NewsGuard review found that Storm-1516 — the Russian influence operation reported to be an offshoot of Russia’s Internet Research Agency troll farm — published 34 false claims targeting the two European countries since January 2025, advanced in 175,000 posts and articles, and drew 274 million views on X alone. This tally includes four claims advanced so far in 2026 that generated 29 million views, indicating that the effort shows no sign of slowing down. In 2024, just 12 claims targeted France and Germany. 

This makes Storm-1516 an even more prolific spreader of false claims about the Ukraine war than Moscow’s state media outlets RT or Sputnik News.

The influence operation appears to have evolved as Europe replaced the U.S. as Ukraine’s biggest benefactor after President Donald Trump assumed office in 2025. Total U.S. aid to Ukraine fell by 99 percent during the year, according to the Kiel Institute for the World Economy, a German think tank. During this same period, European military aid increased by 67 percent, compared to the 2022-2024 average, the Kiel Institute reported. 

Germany is now Ukraine’s biggest military aid donor — 9 billion euros in 2025 — and France’s Macron has emerged as a vocal champion of Ukrainian president Volodymyr Zelensky, advocating for sending European troops to Ukraine to support peacekeeping efforts.

In the first two months of 2026, the campaign already advanced three new claims targeting France and one targeting Germany. Among the 30 false claims identified by NewsGuard pushed by Storm-1516 in 2025, 17 targeted France, 12 targeted Germany, and one targeted both countries. Another 25 false claims directly targeted Ukraine. There was only one false claim in 2025 targeting the U.S. versus 11 in 2024 when it was the largest financial supporter of Ukraine.

Moreover, the campaign against France and Germany sharply ramped up in the second half of 2025, when the tally of false narratives and their viewcount rose by 50 percent compared to the first half of the year. Storm-1516 advanced 18 false claims targeting France and Germany in the second half of 2025, totaling 147 million views. This compared to 12 claims totaling 97 million views in the first half of the year.

(The numbers in the chart above differ from those described at the introduction to this report because they account only for 2025, and do not include false claims from the first two months of 2026.)

Storm-1516 includes the efforts of John Mark Dougan, a former Florida deputy sheriff and U.S. fugitive who fled to Russia in 2016 and became involved in the Kremlin’s propaganda machine. The European Union sanctioned Dougan in December 2025, accusing him of participating in pro-Kremlin influence operations with the goal of “influenc[ing] elections, discredit[ing] political figures and manipulat[ing] public discourse in Western countries.” Asked about Storm-1516’s campaign against France and Germany, Dougan told NewsGuard in a Feb. 26, 2026, message on Signal, “Storm? Never heard of it.” Dougan denies any links to the Russian government.

OLD PLAYBOOK, NEW TARGETS

Storm-1516 methods have been well documented by NewsGuard and other researchers. The network typically plants made-up claims on bogus websites masquerading as legitimate news outlets, then amplifies the false narrative via anonymous accounts on X. The operation’s playbook typically involves taking a controversial news topic, fabricating an elaborate false claim around it using AI personas, forged documents, and other means, and  then amplifying it through bot accounts, pro-Kremlin influencers, and fabricated websites. 

Indeed, NewsGuard reported in December 2025 that Storm-1516 is now one of the most prolific and rapidly expanding Russian influence operations, even overtaking RT and Sputnik, the Kremlin’s primary state-funded outlets, as major spreaders of false claims about the Russia-Ukraine war.

Storm-1516’s false claims targeting France closely followed expressions of French support for Ukraine, including diplomatic visits, statements from Macron backing Ukraine, and high-profile Macron meetings with Zelensky, NewsGuard previously reported. The tit-for-tat has continued, but in recent months, the operation appears to have refined its tactics to gain visibility. Until mid-2025, Storm-1516 published its false claims on a sprawling network of AI-powered websites designed to look like local news outlets, but which did not actually impersonate real media. However, since July 2025, the campaign has repeatedly used websites that masquerade as authentic news outlets by appropriating their brand and logo, using a domain name that is similar to the authentic one.

TARGET NUMBER ONE: MACRON 

The campaign has become increasingly personal against Macron, NewsGuard has found. Out of the 21 false narratives targeting France since January 2025, 10 have been direct attacks against Macron or his wife Brigitte. The false claims have included that Macron was compromised by the newly released Epstein files, that he lost a testicle in a jet-ski accident, and that leaked test results from his former employer showed he had an IQ of 89, below that of Koko the Talking Gorilla.

French officials have warned of Russian disinformation attacks ahead of French municipal elections scheduled in March 2026 and presidential elections due in 2027. Viginum, the French government agency tracking foreign online interference, went so far as to issue a guide for local politicians to help them spot and mitigate influence campaigns such as Storm-1516.

On Feb. 4, 2026, a bogus and now-defunct French website claimed that the U.S. Department of Justice (DOJ) had released May 2017 emails between convicted sex offender Jeffrey Epstein and a suspected accomplice, late French modeling agent Jean-Luc Brunel, saying that Macron liked young boys and was a frequent visitor at Epstein’s Paris residence. The claim spread in 38,000 X posts that collectively amassed 20.4 million views, prompting an official rebuttal from @FrenchResponse, an X account launched by the French foreign ministry to hit back at foreign disinformation campaigns.

The supposed emails were fabricated. NewsGuard found no mention of Macron in the  hundreds of emails between Brunel and Epstein released by the DOJ, and no credible media outlets have reported that Macron ever visited Epstein’s apartment in Paris. The fabricated narrative originated on a newly-registered domain, France-Soir[.]net, which impersonated FranceSoir.fr, an anti-establishment French website that NewsGuard has found to repeatedly publish false and egregiously misleading content. The hoax article was falsely attributed to Victor Cousin, a news reporter for French newspaper Le Parisien. Cousin told NewsGuard that he wrote no such article.

Cousin is not the first French journalist to find his name attached to a Storm-1516 campaign. Since June 2025, the operation has advanced false claims under the bylines of eight other journalists from as many reputable French outlets, including daily newspapers Le Monde and Le Figaro and public broadcasters France Télévisions, France 24, and France Info.

GERMANY IN THE CROSSHAIRS

Storm-1516 narratives have also impersonated reliable German media outlets, including Stern.de and the German fact-checking organization Correctiv, as well as the official website of the ruling center-right party, the Christian Democratic Union.

Like Macron in France, German Chancellor Merz is now a central target of the campaign. Since January 2025, Storm-1516 has advanced 13 false claims targeting Germany, compared to three in 2024. Eight targeted Merz personally, while others sought to undermine trust in German elections and democratic institutions with fabricated claims about ballot tampering and voting irregularities. (See NewsGuard’s 2025 election report here.) 

Throughout 2025 and early 2026, Storm-1516 narratives targeting Germany and Merz have focused on alleged crime and corruption. These include a claim that Merz assaulted a sex worker from Ghana, approved funding for a 1.4 billion euro stadium in Brazil as an apology for making disparaging comments about the country, and staged drone incidents at German and Danish airports to create political pressure for new defense spending.

One particularly viral claim placed Merz at the center of a supposed aviation accident in the United Kingdom. On Nov. 26, 2025, DailyExpress[.]news, a fake news website posing as the London-based Daily Express, published a fabricated article claiming that Merz had severely injured an airport worker while piloting his private plane at London Ashford “Lydd” Airport in July 2024. The article said that Merz promised compensation in order to keep the incident secret and included a video of a man identifying himself as “James Okafor,” who said he was the injured worker.

A manager at the Lydd airport told NewsGuard that no such incident occurred and that no employee named “James Okafor” ever worked there. In an email to NewsGuard, an unnamed spokesperson for Merz’s press office called the story “fictitious and completely unfounded.”

Again, the operation relied on impersonation. The domain created to push this claim was falsely attributed to a real journalist, Deirdre Durkan-Simonds, who actually writes for the British tabloid Daily Mail, not the Daily Express. DMG Media, which owns the Daily Mail said in a statement to NewsGuard: “Deirdre did not author or contribute to the article in question.” 

The claim about the purported airport incident spread widely on X and Telegram, generating 7.8 million views in 1,410 posts in its first four days of circulation. The timing was notable: The hoax article surfaced two days before the German parliament passed a new budget that includes an increase in assistance to Ukraine for 2026 of 3 billion euros, bringing the annual total support to 11.5 billion euros.

Storm-1516 is not the only Russian campaign that is doubling down in its attacks on Kyiv’s European allies. Matryoshka, a Russian influence operation that publishes pro-Kremlin disinformation videos mimicking credible Western media outlets including the BBC and CNN, has published 57 videos targeting France and Germany in 2026 so far, compared to 45 in 2025, NewsGuard found. However, the spread of these videos is typically far lower than those of Storm-1516.

Storm-1516 uses every available tactic to not only tarnish the image of Ukrainians and support Russian President Vladimir Putin, but to “give us a bad image of ourselves, to weaken our morale,” a French government official who tracks foreign influence operations and asked not to be named for security reasons told NewsGuard in a February 2026 phone interview. The official said the use of narratives linked to sex and crime is strategic because these typically draw more views, and that Storm-1516 also focuses on hot-button issues like French farmers’ protests.

“We are dealing with people who know us very well, who read our press, and who have a fairly nuanced understanding of our debates,” the official added. “They’re playing that game full on, and they’re having a field day.”

Edited by Dina Contini and Eric Effron.