GRU-linked Storm-1516 network shifts its false claims to the Baltic states

TLDR

• In August 2026, X accounts tied to Russian propaganda operation Storm-1516 began pushing four false claims about the Baltic states.
• Researchers say the campaign cloned the websites and logos of reputable media outlets to make the fabrications look like real reporting.
• Clemson University's Media Forensics Hub, which first spotted the activity, links Storm-1516's technical infrastructure back to Yevgeny Prigozhin's Lakhta disinformation operation.
• The timing lines up with rising NATO concern over possible Russian hybrid-warfare moves against member states.

DFRLab researcher Nika Aleksejeva, writing for StopFake, traced the earliest posts introducing the false claims to X accounts previously linked to Storm-1516's information manipulation set.¹ The accounts showed signature patterns researchers attribute to Russia's military intelligence agency, the GRU, including cloning the websites and logos of legitimate media outlets to lend the fabricated claims a veneer of real reporting.¹ Clemson University's Media Forensics Hub, the US-based research center that first identified the operation, says Storm-1516 has been active since August 2024 and under observation since late 2023, with technical links, such as shared web infrastructure, tracing back to the Lakhta project, the Prigozhin-run disinformation and cyber-warfare operation also behind the Internet Research Agency troll farm.¹ Storm-1516 has previously targeted Western support for Ukraine and elections in the United States, Moldova, Armenia, France, and Germany.¹

The shift to the Baltic states lands amid heightened NATO anxiety about Russian preparations for hybrid warfare against member states.¹ CIA Director John Ratcliffe reportedly visited Moscow on August 25 to warn Russian officials against attacking NATO countries, the same day new decrees from Russian President Vladimir Putin appeared on Russia's official legal portal with gaps in the numbering suggesting unpublished classified decrees.¹ Two days later, Belarusian President Aleksander Lukashenka met Putin in Moscow to discuss what was described as security matters, a meeting Polish Prime Minister Donald Tusk said reflected Russia preparing "very seriously" to escalate tensions.¹

Why it matters: cloning a real outlet's branding is a specific tell that separates an attributed influence operation from ordinary trolling, since it is built to make a fabricated claim survive a reader's first instinct to check the source.¹