Russian state-sponsored Storm-1516 conducts coordinated disinformation campaigns targeting Hungary and other countries using fake websites, stolen journalist identities, and false narratives to influence political processes.

Cyber & Information WarfareInformation OperationsPropaganda & disinformation campaigns

Aggressor

Summary

The Storm-1516 disinformation campaign is targeting Hungary and its primary opposition candidate, Peter Magyar, falsely claiming that Magyar promised to reinstate military conscription if elected. The campaign uses a recently created fake copycat website magyartisza2026.com which mimics the official Tisza campaign site. The linked 'Johnny Midnight' X account, recently suspended and then reinstated, propagated a Russian state-sponsored influence operation. The broader activity of Storm-1516 involves multiple disinformation campaigns targeting countries such as Moldova (with fake videos showing votes marked for the ruling party PAS), Armenia (alleging corruption involving prime minister's spouse and fake identities of journalists), and Ukraine (false claims about ownership of French utility EDF). These campaigns use fake websites stealing branding from legitimate media outlets and employ stolen journalist identities to increase credibility, representing a coordinated Russian state-sponsored influence effort.

Classification

Confidence: High

The campaign involves orchestrated disinformation efforts by a known Russian state-sponsored actor utilizing fake websites, stolen identities, and fabricated narratives to influence political outcomes and destabilize target countries, fulfilling criteria for hostile hybrid warfare signals.

Source URL

https://x.com/gnidaproject/status/2040393706507792641

Open source

Provenance

Publisher: extension
Submitted: Apr 4, 2026, 15:27 UTC
Last updated: Nov 7, 2026, 11:46 UTC
Event time: Apr 4, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "00dec5f1-1a6c-409a-b25b-d3d5221065dd",
  "url": "https://x.com/gnidaproject/status/2040393706507792641",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Information Operations",
  "incident_type": "Propaganda & disinformation campaigns",
  "country": "Unknown",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Storm-1516",
    "disinformation",
    "Russian influence operation",
    "fake websites",
    "stolen journalist identities",
    "political manipulation",
    "Hungary",
    "Moldova",
    "Armenia",
    "Ukraine"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "The Storm-1516 disinformation campaign is targeting Hungary and its primary opposition candidate, Peter Magyar, falsely claiming that Magyar promised to reinstate military conscription if elected. The campaign uses a recently created fake copycat website magyartisza2026.com which mimics the official Tisza campaign site. The linked 'Johnny Midnight' X account, recently suspended and then reinstated, propagated a Russian state-sponsored influence operation. The broader activity of Storm-1516 involves multiple disinformation campaigns targeting countries such as Moldova (with fake videos showing votes marked for the ruling party PAS), Armenia (alleging corruption involving prime minister's spouse and fake identities of journalists), and Ukraine (false claims about ownership of French utility EDF). These campaigns use fake websites stealing branding from legitimate media outlets and employ stolen journalist identities to increase credibility, representing a coordinated Russian state-sponsored influence effort.",
  "summary_short": "Russian state-sponsored Storm-1516 conducts coordinated disinformation campaigns targeting Hungary and other countries using fake websites, stolen journalist identities, and false narratives to influence political processes.",
  "summary_extended": null,
  "actor_primary": "Storm-1516",
  "target_primary": null,
  "location_text": "Cyberspace",
  "location_region": "Cyberspace",
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The campaign involves orchestrated disinformation efforts by a known Russian state-sponsored actor utilizing fake websites, stolen identities, and fabricated narratives to influence political outcomes and destabilize target countries, fulfilling criteria for hostile hybrid warfare signals.",
  "event_time_utc": "2025-04-04T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-04-04T15:27:00.037Z",
  "updated_at": "2026-11-07T11:46:56.261Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighIndependence confirmedTime: UnknownLocation: Unknown

Source reliability

Info credibility

Event time

Apr 4, 2025, 00:00 UTC

Event time confidence

unknown

Location

Cyberspace

Region

Cyberspace

Primary actor

Storm-1516

Country

Unknown

Tags

Storm-1516, disinformation, Russian influence operation, fake websites, stolen journalist identities, political manipulation, Hungary, Moldova, Armenia, Ukraine

Loading signal...

{ "id": "00dec5f1-1a6c-409a-b25b-d3d5221065dd", "url": "https://x.com/gnidaproject/status/2040393706507792641", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Information Operations", "incident_type": "Propaganda & disinformation campaigns", "country": "Unknown", "source_reliability": "C", "info_credibility": "3", "tags": [ "Storm-1516", "disinformation", "Russian influence operation", "fake websites", "stolen journalist identities", "political manipulation", "Hungary", "Moldova", "Armenia", "Ukraine" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "The Storm-1516 disinformation campaign is targeting Hungary and its primary opposition candidate, Peter Magyar, falsely claiming that Magyar promised to reinstate military conscription if elected. The campaign uses a recently created fake copycat website magyartisza2026.com which mimics the official Tisza campaign site. The linked 'Johnny Midnight' X account, recently suspended and then reinstated, propagated a Russian state-sponsored influence operation. The broader activity of Storm-1516 involves multiple disinformation campaigns targeting countries such as Moldova (with fake videos showing votes marked for the ruling party PAS), Armenia (alleging corruption involving prime minister's spouse and fake identities of journalists), and Ukraine (false claims about ownership of French utility EDF). These campaigns use fake websites stealing branding from legitimate media outlets and employ stolen journalist identities to increase credibility, representing a coordinated Russian state-sponsored influence effort.", "summary_short": "Russian state-sponsored Storm-1516 conducts coordinated disinformation campaigns targeting Hungary and other countries using fake websites, stolen journalist identities, and false narratives to influence political processes.", "summary_extended": null, "actor_primary": "Storm-1516", "target_primary": null, "location_text": "Cyberspace", "location_region": "Cyberspace", "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The campaign involves orchestrated disinformation efforts by a known Russian state-sponsored actor utilizing fake websites, stolen identities, and fabricated narratives to influence political outcomes and destabilize target countries, fulfilling criteria for hostile hybrid warfare signals.", "event_time_utc": "2025-04-04T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-04-04T15:27:00.037Z", "updated_at": "2026-11-07T11:46:56.261Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }