How Russia Uses Bots and Troll Farms to Undermine the West.

​

Over the past decade, digital influence has become a central arm of Russia’s hybrid warfare against the West. Alongside traditional tools such as espionage, cyberwarfare, and propaganda in traditional media, the Kremlin has developed an entire industry of manipulation on social media — based on a combination of automated bot accounts, paid human personas, fake news websites, and covert influencer networks. The goal: to destabilize Western societies from within, deepen existing social divisions, and promote political forces that are friendly toward Moscow.
 

How It Works Technically:

​

The common perception that “bots” are simply automated programs that post content is inaccurate. It is also important to clarify from the outset: this is not a single centralized machine, but a decentralized ecosystem of multiple networks, organizations, and different periods. IRA, Doppelgänger, Storm-1516/CopyCop, and election-specific operations such as those in Romania are separate entities, sometimes with different operators and funding chains, even when they share similar techniques and strategic objectives. Nevertheless, several recurring technical layers can be identified, although not all of them are used by every network:
 

1. Coordinated Accounts and Fake Personas

​

At the core of the system are human operators — not just scripts — managing thousands of fake accounts. Each account has its own biography, profile picture, “posting history,” and distinctive “voice,” all designed to make it appear like a genuine citizen of the target country. Former IRA employees described an office environment with strict daily quotas for posts and comments. Academic researchers who specifically examined IRA accounts, including a team at Clemson University that has tracked them for years, identified telltale patterns: activity systematically stopping during Russian holidays and weekends, and consistent timing corresponding to a normal working day — suggesting employees working in shifts. It is important to emphasize that this finding was documented in the specific context of the historical IRA and there is no evidence that it characterizes all networks currently operating to the same extent.
 

Operations such as Storm-1516 — in some sources also linked to John Mark Dougan, a former American sheriff’s deputy who has lived in Russia since 2016 — have moved from publishing staged “eyewitness” videos featuring real actors to entirely artificial personas: “experts” and “journalists” who do not actually exist, sometimes using a consistent synthetic voice (for example, a character named “Olesya” used to make false allegations against Ukraine). According to Bloomberg, between July 2024 and July 2025, the German Foreign Ministry documented ten well-substantiated Storm-1516 cases involving financial and media tracking, and in some cases links or indications of links to Russian military intelligence (GRU) were identified — not necessarily as a blanket conclusion that the network as a whole is an official arm of the agency.
 

2. Fake Websites Impersonating Real News Organizations
 

The two major networks, Doppelgänger and Storm-1516, employ similar but not identical techniques. The signature technique of Doppelgänger is classic “typosquatting”: purchasing web addresses that closely resemble those of established news organizations — often using a different domain extension, such as .ltd instead of .de — and building pages that look virtually identical to the original. Such copies have been documented for Der Spiegel, Le Parisien, Fox News, and The Washington Post.
 

CopyCop — a network closely linked to Storm-1516 operationally and infrastructurally, although not necessarily identical to it — relies primarily on building a network of more than 300 entirely fictitious “news” websites. According to a September 2025 report by research firm Recorded Future, this included approximately 94 sites targeting German audiences alone. Rather than copying existing addresses, these sites use names that sound plausibly American or European — such as BostonTimes.org, SanFranChron.com, and LondonCrier.com — along with AI-generated logos and systems that automatically publish content. At the same time, over the past year Storm-1516 has also adopted outright brand theft: NewsGuard identified nine media organizations, including The Sun, Kyiv Independent, and Bellingcat, whose branding was directly stolen.

In August 2026, the stolen branding of the German public broadcaster Deutsche Welle was also documented. In other words, the two networks are increasingly converging toward the same toolbox, even though they began with somewhat different approaches.

“Cloaking” services — such as the tool known as Kehr, documented by researchers at Qurium and Correctiv — can present social-media platform crawlers and researchers with an innocuous, non-offensive version of a website, while real human users arriving through targeted links are automatically redirected to the propaganda content itself. This makes detection and enforcement significantly more difficult.
 

3. Coordinated Algorithmic Amplification
 

Groups of accounts work together to “flood” specific hashtags, plant nearly identical comments beneath posts by public figures and politicians, and exploit the recommendation mechanisms of platforms — particularly X, Facebook, Instagram, and TikTok — to push content into the “trending” sphere.
 

In the 2024 Romanian case, Romanian intelligence reported that the accounts were assigned unique IP addresses, with no shared IP addresses, in a manner designed to make it more difficult to identify the shared infrastructure characteristic of bot networks. The authorities also documented the staggered activation of approximately 797 established TikTok accounts created as early as 2016 that had remained dormant until November 11, 2024, just days before the election — a technique intended to make it harder for the platform to identify the accounts as a coordinated network of newly created accounts.

In Germany, ahead of the federal parliamentary elections in February 2025, attempts at coordinated amplification were documented on a significant scale.
 

4. Generative AI
 

This is the component that has changed most dramatically over the past two years. In recent years, networks such as Storm-1516 have added mass production of synthetic content to their capabilities, alongside earlier methods — real actors and staged “eyewitnesses” — which continue to be used in parallel: fake videos (deepfakes) of leaders and public figures, synthetic voices, and even a fake propaganda film in the style of a high-end streaming production called Olympics Has Fallen (described in some reports as a “fake documentary”), which mimicked a Netflix production, included an AI imitation of Tom Cruise’s voice, and featured fabricated reviews attributed to The New York Times and the BBC.

According to Microsoft data (MTAC) reported during 2026, more than 1,000 AI-generated videos attributed to this network were documented during the first quarter of that year — an average rate of more than ten new videos per day.

Examples of the content produced include a fake video accusing French President Emmanuel Macron of spending €148 million on a luxury bunker, false allegations against Volodymyr Zelenskyy, false claims that Brigitte Macron, the French president’s wife, was born a man, and, most recently, in August 2026, a fake video circulated in Germany claiming that German Chancellor Friedrich Merz was about to resign. The video used the stolen branding of the German public broadcaster Deutsche Welle and the newspaper Handelsblatt; German security officials attributed the video to the Storm-1516 network.

The technical “advantage” of AI is not only its speed and low cost, but also a dangerous secondary effect that researchers call the “liar’s dividend”: when the public sphere is flooded with artificial content, genuine evidence also loses credibility, and politicians can deny authentic recordings by claiming that they are deepfakes.

Note on Dougan and Storm-1516

It is important to clarify that the relationship between John Mark Dougan and the network known as “Storm-1516” — a designation coined by Microsoft — is more complicated than some reports suggest. Dougan is more directly associated with the fake-news website network CopyCop, which he operates, while sources differ over how central his role is within the broader Storm-1516 operation. While some reports describe him as having “designed” the network, Clemson University researcher Darren Linvill has characterized his role as “relatively small” within the broader picture.
 

5. Coordination Outside the Platforms
 

Operational instructions — which hashtags to use, which emojis to add, how to circumvent platform identity-verification mechanisms, and when to “activate” a wave of accounts — are often transmitted through closed Telegram channels rather than through the targeted platform itself, making early detection more difficult.

In Romania in 2024, a specific Telegram channel was documented as being used to coordinate operational instructions. At the same time, and independently of that channel, TikTok itself confirmed to Romanian authorities that a user identified as Bogdan Peșchir, a cryptocurrency trader by profession, paid approximately $381,000 through the platform’s “TikTok Gifts” mechanism — in-app virtual gifts that can be redeemed for cash — to other users who promoted Georgescu between October 24 and November 24, 2024.
 

The organizational history also shows that when a particular entity is exposed and subjected to sanctions — for example, the arrest of the CEO of the Russian hosting company AEZA in April 2025, on unrelated criminal charges involving drug trafficking on the darknet, while Correctiv and Qurium separately linked the company’s infrastructure to the Doppelgänger network — the broader apparatus does not necessarily disappear, but can continue operating under new branding, companies, and technical identities.
 

Scale and Channels
 

This is an industry in its own right, not a marginal activity:
 

• Academic researchers studying Russian troll operations have described organizations employing hundreds to more than a thousand workers in shifts, with monthly budgets reaching hundreds of thousands of dollars.
   

• In the 2024 Romanian influence campaign (discussed below), approximately 25,000 TikTok accounts were identified as having been activated within a short period, including around 797 “dormant” accounts created as early as 2016 and reactivated only shortly before the election.
   

• The main channels are the major social networks — X, Facebook, Instagram, and TikTok — Telegram for operational coordination, and fake “news” websites distributed through those same networks.
   

• Alongside bots, these organizations recruit and pay real influencers — micro-influencers and, in some cases, well-known public figures — to give propaganda an appearance of authenticity.
   

The St. Petersburg Troll Farm — Internet Research Agency
 

The best-known and most extensively documented example is the Internet Research Agency (IRA), established in St. Petersburg around 2013 and initially financed through the “Concord” catering company of Yevgeny Prigozhin, who later also established the private military organization Wagner. The organization operated from offices on Savushkina Street in St. Petersburg and, according to various reports, employed several hundred to more than a thousand people at its peak, who were required to meet daily quotas for political posts and comments. Former employees who went public, such as Lyudmila Savchuk, described a conventional office environment with strict productivity targets.
 

The IRA was involved, according to U.S. intelligence community findings, in a systematic influence operation targeting the 2016 U.S. elections, including the creation of thousands of English-language accounts posing as American citizens — for example, a Twitter account posing as a Tennessee branch of the Republican Party that amassed more than 100,000 followers.

An important clarification: Prigozhin was killed in a plane crash in August 2023, approximately two months after Wagner’s brief mutiny against the Kremlin. Since then, the IRA as it was originally known has declined. Following the decline of the IRA in its original form, new and separate Russian influence operations emerged, including Social Design Agency (SDA) and Structura National Technologies, which were linked to the influence campaign known as Doppelgänger, first exposed as early as 2022. It is important not to present this as a direct transfer of the organization or chain of command from the IRA, but rather as a parallel development within a broader ecosystem.
 

Doppelgänger and Other Influence Operations
 

Doppelgänger is currently one of the most active and extensively documented Russian influence operations. It primarily seeks to undermine Western support for Ukraine, using four recurring narratives: sanctions against Russia are ineffective, the West is “Russophobic,” Ukraine is failing, and Western support for Ukraine harms Western citizens themselves. The campaign has targeted Germany, France, the United States, and other countries, using fake websites that imitate established media outlets. In the United States, the Department of Justice sanctioned SDA, Structura, and their managers in 2024; the United Kingdom imposed similar sanctions.
 

A prominent additional example, and one from the very recent past, is the influence operation surrounding Romania’s November 2024 presidential election. Romanian intelligence uncovered unusual digital activity surrounding the pro-Russian right-wing candidate Călin Georgescu, who had been a relatively marginal candidate in the polls, at around 1%, but unexpectedly surged to approximately 23% of the vote in the first round.

It is impossible to establish scientifically and unequivocally that the entire surge was caused by the Russian operation. However, Romanian authorities linked the timing and scale of the unusual digital activity — a coordinated TikTok campaign involving approximately 25,000 accounts, uniform hashtags and emojis intended to manipulate the algorithm, and the activation of dormant accounts dating back to 2016 — to coordinated foreign/Russian activity. Links to payments to local influencers and coordination through Telegram channels were also identified.
 

Following the revelations, Romania’s Constitutional Court annulled the results of the first round and ordered the process to be restarted — a decision that took place on December 6, 2024, following suspicions of foreign interference.

The Objectives: Destabilization and the Promotion of Pro-Russian Forces

According to analyses by Western intelligence and research organizations, the two objectives identified above are indeed central to these operations:

​

• Creating social instability — injecting content that amplifies existing divisions, such as immigration, race, culture wars, attitudes toward COVID-19, and attitudes toward the war in Ukraine, rather than creating an entirely new narrative from scratch. The logic is not necessarily to persuade audiences of a particular position, but to erode general trust in democratic institutions, the media, and the electoral process itself.
   

• Promoting pro-Russian politicians and forces — both through overt support for candidates identified as pro-Russian, such as Georgescu in Romania, and by weakening their opponents. Similar patterns of activity have been documented in recent years around elections in Ukraine, Moldova, Georgia, the United States, and other European countries.
   

Accuracy note: It is important to clarify that not every individual Russian operation is intended to bring a specific pro-Russian candidate to power. In practice, the objectives are broader, with the two above representing only part of the picture: weakening support for Ukraine, undermining trust in the media itself, undermining confidence in elections as a mechanism, and fostering a general sense that “nobody really knows what is true” — an effect directly connected to the “liar’s dividend” mentioned earlier.

In other words, the objective is sometimes not to persuade people of a particular narrative, but to paralyze society’s collective ability to agree on basic facts.