Russia's fake-newsroom machine is aimed at the midterms and the Baltics

Russian disinformation operations have published 906 fake news reports passed off as the work of 163 real outlets since March 2023, NewsGuard reported on 28 September. Per Mother Jones, the Russian operation Matryoshka made fake Mother Jones videos falsely accusing Democratic midterm candidates of crimes. In the Baltics, DFRLab traced four fabricated narratives to Storm-1516 and says the campaign showed patterns characteristic of operations attributed to the GRU, Russia's Main Intelligence Directorate. The adversary no longer needs to invent a source. It can borrow one.

Euronews is the most impersonated outlet, with 82 fake stories, NewsGuard found, and the Pravda network's 280 websites published approximately 6.3 million articles advancing 115 false claims in 2025. Fabricated outlets are also a commercial service. Citizen Lab documented a program of more than 14 weeks that BlackCore, an Israeli influence-for-hire company, ran for Angolan government communications staff, centered on a made-up news outlet and artificial personas. Anthropic's September threat report describes LKM Company, a France-based advertising agency, running approximately 70 fabricated news websites.

For an OSINT desk, the failure point is a time-pressure shortcut: a recognized logo stands in for verification. Per DFRLab, one account posting a Storm-1516 claim linked to a clone of The Defense Post on a .eu domain, not the real .com. DFRLab also documented a Euronews-logo video claiming a Ukrainian soldier killed three NATO troops during an exercise in Latvia. Reach is no signal: Mother Jones' David Corn says bots inflated view counts on the fake Mother Jones videos. As of 2 September, only two of the four Baltic falsehoods had been publicly refuted, per DFRLab.

• Verify provenance before ingestion: domain, hosting, archive history, the outlet's own site.
• Discount reach. Bot-inflated view counts say nothing about credibility.
• Expect fabricated criminal allegations against named leaders, delivered as deepfakes styled like trusted outlets.
• Name owners for debunking and escalation before elections and high-salience events.

LUCID — OSINT Awareness supports continuous monitoring across 50+ languages, with campaign and influence-operation detection designed to help analysts see coordinated amplification of a story early, while there is still time to check where it came from. Detection is designed to surface the pattern; analysts verify the source and decide what is real, what to escalate and who needs to know.

Russia's operators build their own networks; they also borrow audiences that already trust the outlet. The doctrine echoes the gray-zone operations disrupted in August: deniable means run through civilian channels. With the US midterms on 3 November, source provenance belongs in daily workflow, not post-incident review.