Storm 1516: anatomy of Russia’s AI disinformation machine in 2026

Newsrooms and OSINT teams live a daily paradox: a video goes viral within minutes, and within those same minutes someone has to decide whether to publish it, debunk it, or ignore it. AI-driven war disinformation has turned that decision into a minefield. In the first quarter of 2026 the Microsoft Threat Analysis Center mapped more than 1,000 synthetic videos produced by a single coordinated operation: Storm-1516. The narrative count keeps climbing, output reaches nearly one video per day, and the target is no longer just the Ukrainian audience. Editors, fact-checkers and corporate security leads now share one question: what makes a digital asset trustworthy when every clip can be fabricated and every authentic clip can be dismissed as fake? The answer does not live in post-hoc detection. It lives in source-level certification.

This insight is part of our guide: AI war disinformation: why certified evidence beats detection

Storm 1516: what it is and why it differs

Storm-1516 is a Russian influence operation that has been active since at least 2023 and has scaled sharply in 2026. Microsoft TAC and RUSI describe it as a modular machine: every synthetic video, every fabricated witness, every text disguised as locally produced follows a planned sequence that researchers call a narrative kill chain. What sets it apart from traditional propaganda is the industrial scale and the delegation to generative models: content production is no longer the bottleneck.

Q1 2026 in numbers

Data gathered by Microsoft TAC during the first quarter of 2026 paints a clear trajectory:

• Over 1,000 synthetic videos attributed to Storm-1516 across three months.
• The number of identified narratives doubled compared to Q1 2025.
• Nearly one output per day between late March and early April, with peaks tied to Western political events.
• Diversified targeting: Ukrainian soldiers, civilians, European and North American audiences.

The modular narrative kill chain

The pattern documented by NewsGuard unfolds across four phases that can run in parallel:

1. Seeding: a fake witness (often an AI video) tells a plausible but unverifiable story.
2. Recycling: low-tier blogs and Telegram channels amplify the story with multilingual variants.
3. Laundering: less rigorous Western outlets pick up the secondary source, severing its link to the original Russian operator.
4. Pre-emptive denial: when authentic evidence of real crimes surfaces, the information noise makes it indistinguishable from the flood of fakes.

Liar's dividend: the real strategic objective

Storm-1516 output is not built to convince every single viewer. It is built to saturate the information space until any video, real or fake, can be dismissed as a deepfake. This effect, known in academic literature as the liar's dividend, was theorised by professors Robert Chesney and Danielle Citron and lets aggressors evade accountability for documented crimes.

Who is exposed when they produce digital evidence

The problem stretches far beyond war journalism. A newsroom publishing a video investigation can be accused of AI manipulation by the very subject of the report. A company that produces visual documentation (a site survey, a technical inspection, a claim file) is exposed to the same reputational attacks. The most vulnerable categories are:

• Newsrooms publishing OSINT war reporting or court journalism.
• Insurance, energy and infrastructure firms documenting sensitive sites.
• Law firms presenting video or photo evidence in court.
• Internal investigation and integrity teams operating in politically exposed markets.

The AI Act alone is not enough

Article 50 of the EU AI Act sets transparency requirements for AI-generated and AI-manipulated content, including readable labelling. It is a meaningful step, but it operates on the synthetic-content side. It does not answer the mirror question: how do you prove that an authentic asset is in fact authentic, in a way that holds up against third-party challenges and stands as evidence in court? Without an answer to that second question, the liar's dividend remains available to anyone who wants to exploit it.

How TrueScreen breaks the narrative kill chain

TrueScreen is the Data Authenticity Platform that certifies photos, videos and screenshots with legal value at the moment of capture. Instead of trying to detect the fake after the fact, it shifts the problem: it ensures that the authentic asset is born with an evidentiary lock that cannot be reproduced. The operating principle is simple: the asset is captured, integrity is fixed via hash, a qualified timestamp issued by an integrated QTSP is applied, and an eIDAS-compliant electronic seal is added. From that moment, any alteration is detectable and any liar's dividend challenge meets a structured evidentiary block to answer.

The operational flow for newsrooms and security teams

Source-level certification follows four traceable actions:

1. Controlled capture: through the mobile app, Web Portal, Forensic Browser or API, content is captured along with environmental metadata (geolocation, device, time) the moment the shot is taken.
2. Qualified seal: the asset receives a qualified timestamp and an electronic seal via integrated QTSP.
3. Audit trail: every access, export and share stays logged and verifiable.
4. Public verification: anyone, with or without an account, can verify the integrity of the asset through a unique identifier.

Three direct benefits for teams operating in exposed markets

The point is not to compete with detection systems, which remain useful. The point is to build an evidentiary layer that does not depend on an algorithm's ability to recognise a fake, but on a system's ability to certify a truth at the right moment. For anyone producing evidence in markets exposed to propaganda, that difference is the difference between being believed and being swept into the noise.