Global Security Feature: Information Operations, 2026-W42

Bottom line #

The one operation documented this week to the full four-criteria bar is NewsGuard's account of the Russian campaign Storm-1516. By NewsGuard's count, the campaign aimed 21 false claims at France and Germany in six months, then turned to the U.K. in August 2026, where a fake site impersonating the Daily Express reached a former British politician's audience. The week's other notable items are fact-checked claims: recycled or AI-generated imagery and distorted quotes circulating in Russian-language channels, an Ethiopian recycled-video claim, and two U.S. election claims with no state link.

This week's documentation covers Russia only. No operation run by the U.S., Canada, an EU member, Ukraine or Israel was documented in the week. The attributors are Western commercial and Ukrainian fact-checking bodies, so the imbalance likely reflects who documents as well as who operates (moderate confidence: the pattern has held for three weeks, but no source measures it).

Cases #

Storm-1516 fabrications aimed at France, Germany and the U.K. (IO-2026-W42-01) #

• Actor: NewsGuard describes Storm-1516 as a "prolific Russian influence campaign". Channel class: state-aligned (the source names no Russian state body).
• Behaviour: Falsified news reports and videos bearing real outlets' logos (Reporterre, BFMTV), apparently staged videos, and a fake news site impersonating the U.K. tabloid Daily Express. The fakes were shared on X.
• Content: Videos purporting to show ballot fraud in German elections in September 2026. Fake articles about French presidential candidates: one said Raphaël Glucksmann spent 2 million euros on private jet flights, another said Édouard Philippe had dementia. In the U.K., a fake article said Prime Minister Burnham had proposed bringing up to 4,000 migrants stranded in the Spanish enclave of Ceuta to the U.K.
• Degree: One X post sharing the fake Philippe article drew 4.9 million views in 16 days. A former British politician shared the fake Daily Express article in a post that drew 470,000 views in a day. Breakout 5 (amplified by a high-profile person), on the U.K. strand.
• Effect: None observed beyond views.
• Four-criteria test: met (false content; deliberate spread through impersonated outlets; targeting of elections and national leaders; a foreign actor, per NewsGuard). This is an operation.
• Kill-chain phases described: disguising assets (outlet impersonation, a fake site); indiscriminate engagement (sharing of the fakes on X).
• Status of the core claims: false, established by NewsGuard ("The Daily Express published no such report").
• Sources: NewsGuard Reality Check, 2026-10-14.
• Attribution: NewsGuard, 2026-10-14; grade C:p O:p E:p T:p; not corroborated. NewsGuard is a commercial ratings firm; the piece mixes findings with endorsement of the U.K. government's response ("Burnham is right to be worried").

Noise floor #

What is known: Le Figaro publishes polling, including on the French high-school protests, and released no such video. The video claims Putin would handle the protests better than any candidate. StopFake found no such clip or poll. The Abiy clips date from 2019 and 2021, per AFP. The Merz quote is genuine; StopFake says the interpretation attached to it was invented. The candidate's mental-health claim rests on a phone call edited to remove the facility employee's repeated denials, and the facility said he was never treated there.

Observed pattern, not attribution: the Le Figaro video uses a real outlet's logo for a fake item about the French protests, the same technique and subject as the fake news-brand reports NewsGuard tied to the Matryoshka campaign on 2026-10-07. StopFake does not link it to any named operation. Confidence: low.

Attributions this week #

The record #

This week: 3 case(s) and 9 unverified claim(s) logged, 6 of them described in the Noise floor. Since the record began: 3 cases and 9 claims.

Cases this week by actor state

Everything logged this week by channel class

Status of the core claim

Breakout category (observed reach, 1 to 6)

By week

Counts include every item assessed this week; minor claims are counted but not described.

Context and baseline #

• New against the baseline: NewsGuard's Storm-1516 account adds the U.K. to a target set it ranks as Ukraine, Armenia, France and Germany. Armenia was also the target of the fabricated "Politico" tomato story that DFRLab documented on 2026-09-29, which drew on accounts with a Storm-1516 history (IO-2026-W41-03).
• Recurring: StopFake republished EUvsDisinfo's analysis "How to Justify Crimes Against Humanity: the Kremlin Method" on 2026-10-13, first published by EUvsDisinfo on 2026-10-09 ("Pro-Kremlin commentators deny proven war crimes against civilians"; StopFake, EUvsDisinfo). It is the same narrative push on Bucha and "Nazi Ukraine" (IO-2026-W41-05), not a new finding. Recycled Abiy Ahmed footage around the Tigray fighting recurs too: AFP debunked a doctored 2020 Abiy clip presented as current in late September.
• U.K. government position: In a statement to the UN First Committee on 2026-10-14, delivered by Ambassador David Riley, the U.K. said: "We are witnessing an industrial-scale assault by hostile actors like Russia on the information environment in the UK" (GOV.UK). This is open government messaging, not a documented operation. NewsGuard reports that Prime Minister Burnham announced a National Centre for Information Defence in a 2026-09-22 speech to the UN, and that he has warned that the U.K. has "tiptoed around" the threat of disinformation.
• Non-Russian documentation, for comparison: VIGINUM, the French agency for foreign digital interference, published a technical report on "Rokh Solis" on 2026-06-11. It found that operations aimed at French municipal elections met its criteria for foreign digital interference, with technical markers pointing to the involvement of Israeli actors, including an Israeli influence company. It did not attribute the activity to a state, said it would keep investigating who the operators are, and described the assets' online visibility as very low (VIGINUM). The report dates from June, so it is baseline rather than this week's documentation.
• Skew: The week's only documented operation comes from a commercial U.S. ratings firm, and the Russia-linked claims were checked by StopFake, a Ukrainian fact-checker focused on Russian disinformation. Both are credible on method, but neither is neutral on the conflict.

Indicators to watch #

• New Storm-1516 fabrications aimed at the U.K. or at French presidential candidates, and whether any reach mainstream media (Breakout 4) or draw an official response (Breakout 6).
• The U.K.'s National Centre for Information Defence: its mandate, and whether its first public attribution comes with published evidence.
• More fake news-brand videos around the French protests and German elections, and whether a named investigator ties them to Storm-1516 or Matryoshka.
• VIGINUM or another government naming the operators behind Rokh Solis, or any state tie.
• AI-generated or composite strike imagery in Russian-language channels, and how quickly checkers catch it.
• Recycled footage around the Ethiopia, Tigray and Eritrea tensions.

How this was made #

This week's material was about 80 items from investigators, fact-checkers, platforms and government bodies, plus searches of the week's wire, regional and social coverage for influence-operation and disinformation terms. The investigator's report and each fact-check were read in full. The body of the U.K. statement to the UN First Committee could not be retrieved beyond its title and speaker. NewsGuard's Storm-1516 findings were read on its own site, not in an underlying dataset. The method, including the four-criteria test, the Breakout scale and the attribution grades, is described on the methodology page.

How this was made: methodology and limits.