In 2016 the Kremlin allocated $1.25 million a month to the Internet Research Agency’s English-language operations aimed at American voters. That budget funded 2,700 fake accounts spread across Facebook, Twitter, Instagram, and YouTube. The St. Petersburg troll farm, housed at 55 Savushkina Street, paid its operators roughly 40,000 rubles per month plus performance bonuses for driving engagement.
The Internet Research Agency's 2016 American Operation
A single IRA-controlled Facebook page, "Blacktivists," reached more than 11 million people in the run-up to the election. The unit also bought at least 3,500 political ads. Many were priced between $25 and $1,000, and they targeted swing states like Michigan, Wisconsin, and Pennsylvania.
Federal prosecutors later traced $73,000 in IRA ad spending to Wisconsin alone. The scale of the operation demonstrated a systematic attempt to exploit American social platforms for political influence.
The EU Ban on RT and Sputnik
On 2 March 2022, the Council of the European Union suspended the broadcasting activities of RT and Sputnik across all member states. The decision followed Russia’s full-scale invasion of Ukraine. It cited both outlets’ role in systematic disinformation, including false claims about Ukrainian forces shelling civilians in Donbas.
The ban applied to television, online distribution, apps, and social media accounts operated by RT English, RT UK, RT Germany, RT France, RT Spanish, and Sputnik. National regulators in France, Germany, Poland, and the Baltic states began enforcement within days. French media authority Arcom ordered Eutelsat and other satellite operators to drop RT France from their lineups on 3 March. Social platforms including Meta, YouTube, and TikTok blocked the outlets across EU jurisdictions shortly afterward.
In July 2022, the EU General Court dismissed RT France’s legal challenge to the ban, finding that the restrictions were proportionate to the risk of electoral and security interference.
The Doppelganger Network
In September 2022, EU DisinfoLab identified the Doppelganger network. A coordinated system of cloned Western news domains laundered Kremlin narratives. Researchers mapped 300 counterfeit outlets impersonating real brands. Among them: a fake version of Britain’s The Guardian hosted at theguardian.pw, and a spoofed Bild at bild.de-live.com.
These sites lifted authentic layouts, fonts, and bylines. Then they swapped one or two articles for fabricated stories about Ukrainian biolabs or Polish plans to annex western Ukraine. Distribution ran through Facebook ads and Telegram channels. Domains were registered through Russian bulletproof hosting and paid in cryptocurrency. By December 2023, the campaign had expanded to 17 languages and targeted elections in Germany, France, and Italy.
It often posted the same mistranslated paragraphs across dozens of mirrors within minutes. The goal was not persuasion but sheer volume: flooding search results and social feeds so that any reader encountering a debunked claim would find it repeated everywhere.
The Ghostwriter Campaign and GRU Unit 26165
Mandiant traced the Ghostwriter campaign to Unit 26165 of Russia’s GRU. This came after intrusions against Polish and Lithuanian government networks. The unit targeted NATO member states with phishing emails carrying malicious RTF attachments.
In 2021, Ghostwriter operators hijacked the Facebook account of a Polish official. They used it to post false claims about refugee resettlement. That same year, they defaced a Lithuanian news site. They planted fabricated content alleging corruption in the Lithuanian armed forces.
The GRU aimed to erode trust in NATO troop rotations through the Suwalki Gap. The border strip between Poland and Lithuania stretches 100 kilometres. Unit 26165 had previously been linked to the 2016 DNC breach. It reused infrastructure from those operations, including domains registered under the names of real Polish journalists.
The Vulkan Files and Automated Amplification
Leaked Vulkan files tied 27 Russian military contracts to Airobot, Avito, and other IT firms. These firms ran bot farms from rented offices in St. Petersburg and Rostov-on-Don. The documents list 14,000 fake social media accounts activated per operation. Each one posted up to 40 times daily across VK, Telegram, and X.
One contract, dated March 2023, allocated 41 million rubles for “narrative amplification” targeting Baltic and German audiences ahead of the NATO summit in Vilnius. Operators used GPT-based text generators to rewrite the same disinformation kernels into hundreds of local-language variants. Then they measured reach through dashboards tracking shares, quote tweets, and comment sentiment.
Procurement records show quarterly bonuses paid to teams that pushed prepackaged claims about:
- Ukrainian biolabs
- Polish border attacks
- Western election fraud
These claims were pushed into trending feeds across multiple platforms simultaneously.