Russian malign influence operations have changed their tactics in recent years. But their message has stayed the same: Abandon Ukraine.
On the morning of Nov. 7, 2024, the pro-Russian X account @OCanonist posted a video of men in Ukrainian military uniforms shooting and setting ablaze a mannequin wearing a Trump 2024 T-shirt and red hat. With it, @OCanonist shared the message, “It’s time to defund this degenerate country.”
Over the course of the following day, the post was shared more than 26,000 times and viewed by 12.4 million users. From X, the video exploded across social media, was shared by other high-profile, right-wing influencers such as Gunther Eagleman, and was viewed millions more times in various online communities.
In nearly every post, the message was the same: Stop supporting Ukraine.
The video, however, was not what it seemed. It was not created by Trump-hating Ukrainian soldiers, and it did not spread across the internet by chance. It was, in fact, a well-orchestrated deception, a carefully crafted and artfully packaged piece of Russian disinformation.
Outwardly, the MAGA mannequin video seems sophomoric, a bit like something that bored middle school boys might make in their backyard. This simplicity masks the work of a careful hand. The mannequin video is, in fact, a perfect demonstration of the ways in which Russian influence operations have evolved, but it also highlights how these tactics have stayed the same. The new generation of Russian influence operations is less reliant on fake social media personae. Russia—like many companies—has evolved its use of social media marketing to employ the influencer economy. But unlike corporate sales, Russia has peddled the same product for years: distrust of Ukraine.
The story of the MAGA mannequin video, both its construction and its dissemination, is highly instructive in how today’s Russian operations try to manipulate a narrative. The video speaks to a specific community (in this case MAGA America), baiting those anxious to believe it. The message is short, simple, and unambiguous—all elements essential for social media virality. And the video lacks any extraneous elements that may offer information about where it was made or who created it. The men are masked, and their uniforms lack unit designation. Further, no landmarks are shown in the background that might allow for geolocation. This careful anonymity is key to not giving away the fraud.
The MAGA mannequin video went through a dissemination process that is very familiar to us in its construction but nonetheless unique in its particulars. We believe the video was created by Storm-1516, a Russian narrative-laundering campaign our team identified in late 2023 and named subsequently by Microsoft’s Threat Intelligence Center. Narrative laundering is a process by which a false story is placed and then methodically layered into the media ecosystem in a way that distances the story from its actual source and integrates it into genuine, organic conversation.
The video first appeared in late October, nearly two weeks before the presidential election, posted on a Russian-language Discord channel by a newly created account. From there, it took a purposefully circuitous path posted next by a fake, pro-Russian Telegram channel, then to a Ukrainian separatist politician’s account, and finally ending up on a Russian state media page, Pravda En. Each of these four, layered steps in the Russian laundering process was systematic. Each gave the video incrementally more credibility and a more believable provenance. This is old tradecraft; Russia has been engaging in these kinds of information shell games since the Soviet era. In 2016, Russian digital disinformation became infamous for its use of fake social media accounts spreading division and dissent among real users. But that tactic has now shifted, along with the rest of the internet economy, to a more successful one relying on a distribution network grounded in the influencer economy. These days, employing real people—not bots—to spread disinformation is cheaper and, it turns out, possibly more effective.
Our research suggests that elements of the late Wagner Group leader Yevgeny Prigozhin’s former network—specifically an organization calling itself the Foundation for Battling Injustice—have worked to recruit foreign influencers willing to spread Russian lies. It was this network that took the now thoroughly laundered MAGA mannequin video to viral success. Two social media accounts run by individuals whom we believe to be part of the Foundation’s network shared the video: a right-wing, pro-Russian X account called @MyLordBebo and a Telegram channel connected to the Irish journalist and Russian state media employee Chay Bowes.
Both of these individuals have shared Storm-1516 narratives routinely over the past year. For this video, MyLordBebo had more than 800 reposts and nearly 100,000 views. With this kind of introduction to X, it was only a matter of time until other influential accounts shared the video as well. Twenty-six minutes after MyLordBebo’s post @OCanonist made his, and Russia had a hit.
Russia uses influencers for the same reasons marketing professionals and political campaigns do: because they are trusted. Users tend to follow influencers they feel some connection to. They are thought leaders among online communities, serving to shape shared realities and beliefs. Influencers can be ideal peddlers of lies because we want to believe what they have to say.
Russian disinformation became infamous for its attempts to influence Western politics, and it is true that in the 2024 election Storm-1516 had some well-documented success in working to undermine election integrity. The MAGA mannequin video, appearing widely on mainstream social media the day after the election, suggests what is most important to Russia, and that is the war in Ukraine. Russia’s attempts to shape discourse online through digital manipulation have been ongoing since at least 2014, and the MAGA mannequin video was the start of what will surely be an ongoing grassroots lobbying campaign targeting the new Trump administration. The message of this campaign is clear: Stop supporting Ukraine.
While the Internet Research Agency (IRA)—a Russian company created to spread propaganda and disinformation—became infamous for its efforts to influence the 2016 U.S. presidential election and destabilize Western democracy, it’s important to remember that Prigozhin founded the organization in 2014, just after Russian incursions in Crimea and Donbas. Its original purpose was to spread disinformation about the newly started conflict in Ukraine. Russian digital disinformation, in other words, has always targeted Ukraine. Of all the social media posts the platforms have publicly attributed to Prigozhin’s IRA, by far the most common target has been Ukraine. In the past two years, as the war has become an existential threat for President Vladimir Putin, Russian efforts to influence Western support for Ukraine have been constant. One important instrument has been the distribution of Storm-1516 narratives through the Foundation network.
Another example of this anti-Ukraine campaign is Storm-1516’s success spreading false stories about Ukrainian President Volodymyr Zelenskyy and his wife Olena, perpetuating perceptions of wasteful corruption. Different narratives had the couple purchasing extravagant homes in England, Germany, Egypt, and Vero Beach, Florida. According to Russia, Olena went on spending sprees at New York’s Cartier jewelers and Volodymyr hid the purchase of two yachts worth tens of millions of dollars. Other false stories claim the couple has purchased extravagant cars, as well as a casino on Cyprus and a vineyard previously owned by Sting. On particularly successful days, as much as one third of the total conversation on X about the Zelenskyys included mentions of Storm-1516 lies. And to illustrate success in their real purpose, at least one narrative was publicly repeated by Vice President Vance. Since Trump’s victory and the appearance of the MAGA mannequin video, the campaign has continued. Recent narratives reporting Zelenskyy’s purchase of a ski resort in France and yet another villa, this time in the Caribbean, have been viewed millions of times online.
While we can’t know for sure the real impact of Russia’s Storm-1516, there is no question that support for Ukraine’s war effort has slowly eroded, especially among conservative Americans. The reasons offered often mirror those given by Russian narratives (for instance, concern about the Zelenskyys’ integrity or about Ukraine’s worthiness). Storm-1516’s manipulation of the influencer economy has become one of Putin’s most reliable ways to lobby Washington. The more anger they can generate in the MAGA base, the more likely their campaign is to be successful. The more Russia can turn MAGA followers against Ukraine, the more likely Trump will be to support Putin’s goal: Abandon Ukraine.
– Darren Linvill, Patrick Warren, Published courtesy of Lawfare.
