All operations on Armenia: Russia’s influence machine targets the vote

Executive Summary 

Multiple Russian information operations are converging on Armenia in an apparent attempt to influence parliamentary elections on 7 June, mainly by undermining the candidacy of current Prime Minister Nikol Pashinyan. Some of the highest profile and prolific Russian aligned actors have spent months attacking Pashinyan and his allies. These actors have used a wide range of tactics, including creating sites for fabricated media outlets, impersonating genuine outlets and journalists, and relaying content through influencers and seemingly unconnected sites. So far, they have received millions of views on X, and they are only likely to escalate their activities in the run up to and following the elections.  

This Dispatch examines Storm-1516, the Russian Foundation to Battle Injustice and Operation Overload, three Russian state-sponsored or aligned operations targeting Armenia. Additional threat actors are likely conducting complementary efforts, including the organization behind the Doppelganger operation, according to a UK government policy paper. The activity comes as Armenia approaches a pivotal election likely to pit pro-European and pro-Russian political visions against one another. It also continues Russia’s long-running effort to manipulate Armenian politics to advance Moscow’s regional interests.

Key findings   

• Since early 2025, Armenia has been a persistent target of Russian information operations despite Moscow’s attention being divided across multiple global conflicts. These information operations are likely to escalate as Armenia’s parliamentary elections approach 7 June. These operations have gained millions of views and largely sought to undermine Prime Minister Nikol Pashinyan through impersonation tactics and false narratives, such as claims that Pashinyan is anti-Christian and involved in a range of criminal activities, from running brothels to trafficking drugs and organs.   

• Storm-1516, arguably Russia’s most impactful information operation, targeted Armenia more than any other country between April 2025 and April 2026, according to ISD data. The operation used faux news and activist websites, impersonated real outlets and journalists and laundered narratives through X influencers and seemingly unconnected sites (including one Chinese state media site). These narratives received millions of views on X, prompting at least one public response from the Armenian Prime Minister’s office.   

• False narratives promoted by the Russian Foundation to Battle Injustice (R-FBI), an organization founded by late Wagner group leader Yevgeny Prighozin, received millions of views. Between April 2025 and April 2026, R-FBI has published more than a dozen articles attacking Pashinyan and those close to him. Most content was republished by a small group of pro-Russia sites and amplified by many of the same X influencers used in Storm-1516 operations.  

• Operation Overload, a long-running operation aligned with Russian interests, has impersonated more than 50 organizations and individuals in videos that spread false narratives about Armenia this year. Between 1 January and 7 May, 2026, ISD’s dataset of approximately 500 Operation Overload posts across several platforms showed Armenia was the third most targeted country, behind only Ukraine and France. While the operation’s use of bots makes its impact difficult to measure, it has prompted a public response for the press secretary for Armenia’s prime minister and has had isolated moments of virality in past campaigns targeting Western countries. 

Methodology  

This Dispatch includes data on covert and overt messaging campaigns targeting Armenia that are attributed to or aligned with the Russian government. Data collection periods varied across threat actors because systematic monitoring began at different times based on when each actor was incorporated into the research effort. Additionally, while ISD’s datasets are robust and provide representative samples, they should not be considered exhaustive. It should also be noted that actors beyond those detailed in this Dispatch are reportedly targeting Armenia, including operations such as Doppelganger. ISD analysts used social listening, data analysis and domain analysis tools to conduct this research. The sections below provide brief descriptions of each threat actor and ISD’s data collection methodology, followed by detailed analyses of their activity targeting Armenia. 

Armenia in the eye of the Storm-1516 

Background on Storm-1516 

Storm-1516, also known as Neva Flood, is a Russian state-sponsored information operation. According to a German intelligence assessment, the operation is tied to Russian military intelligence, the Moscow-based Center for Geopolitical Expertise think tank and the Double-Headed Eagle movement, financed by Russian oligarch Konstantin Malofeyev.  

Clemson University, Microsoft, the Gnida Project, the French government agency VIGINUM and others have detailed Storm-1516’s tactics. To identify its narratives, ISD drew from these studies to develop a list of the operation’s attributes, including the use of CopyCop sites and a network of influencers on X.  

Between August 2023 and April 2026, ISD analysts collected data on roughly 200 campaigns. ISD’s database has more than 30 instances of operations targeting Armenia since April 2025.  

Storm-1516 activities targeting Armenia 

Armenia was the most frequently targeted country in Storm-1516 activity between April 2025 and April 2026, with more than 30 recorded campaigns. The operation used faux news and activist websites, impersonated real media outlets and journalists and laundered content through Chinese state media, Turkish news sites and influencers on X. Storm-1516’s narratives received millions of views on social media, prompting public responses from the Armenian Prime Minister’s press secretary.  

Many of Storm-1516’s false claims portray Pashinyan as a criminal and anti-Christian. The operation’s first Armenia-focused narrative in April 2025 used a video in which an allegedly underage girl accuses Pashinyan of rape. Subsequent narratives alleged Pashinyan ran brothels, bought mansions in Canada and France and used his office to enrich his family. Storm-1516 has also promoted claims that Pashinyan burned crosses, refused to allow a statue of Jesus to be built and approved an LGBTQ+ parade. The operation also targeted Pashinyan’s wife, accusing her of stealing money from a children’s cancer fund. These narratives are consistent with past Russia-aligned campaigns targeting leaders such as Ukrainian President Volodymyr Zelensky and Emmanuel Macron, which seek to discredit political figures through allegations of corruption and moral degeneracy.  

Image 1 (left): Storm-1516’s first campaign targeting Armenia, which featured a video of a woman accusing Pashinyan of rape. Image 2 (right): Storm-1516 campaign accusing Anna Hakobyan, Pashinyan’s wife, of stealing millions from charity.

Storm-1516 also has sought to strain Armenia’s relationships with neighboring states and international partners. The operation promoted claims that Turkish entities were draining Armenia’s gold reserves, receiving its water and taking control of its electricity networks. Several Storm-1516 narratives also aimed to foster hostility between Armenia and France, one of Baku’s partners on the world stage: this included claims Pashinyan had cut corrupt deals with a French businessman and allowed France to dump nuclear waste in Armenia. By contrast, Storm-1516 devoted comparatively less effort to stoking historic animosity between Armenia and Azerbaijan, though it promoted at least one narrative aimed at doing so.  

 The operation has used a wide range of tactics to spread its narratives. Roughly a dozen claims in ISD’s dataset were seeded on fabricated media websites known as “Copy Cop” websites, a network of sites the EU attributed to a former Florida deputy sheriff who now supports Storm-1516 activities. Many were designed to resemble generic Armenian news platforms using domains such as armeniadaily[.]org and armenianinsider[.]am. Other Copy Cop websites were built to resemble international outlets. One site, timescanada[.]ca, used the identities of real Canadian journalists. In another case, two Copy Cop sites were pitted against each other to advance a narrative: a website for a fabricated Armenian activist group was set up to denounce reporting by a fake French news outlet. 

Image 3 (left): Copy Cop site called Armenia Daily used by Storm-1516
Image 4 (right): Chinese state media outlet CGTN Turk laundering Storm-1516 claim

Storm-1516 also laundered Armenia-focused content through third-party outlets. Chinese state media outlet CGTN Turk published two articles linked to the operation, the first time a Chinese state-controlled entity has been used to launder content for the Russian operation. CGTN Turk removed both articles shortly after publication. Storm-1516 also placed articles on several Turkish websites, including ODA TV, soL Haber and Evrensel.  

Influencers on X played a central role in amplifying Storm-1516 videos and articles. ISD found more than 1,600 posts from roughly 1,000 accounts that shared links to Storm-1516 content targeting Armenia. Thirty-six of those accounts had 100,000 or more followers, and approximately 150 of them had over 10,000 followers. Those accounts cater to a wide range of audiences, including supporters of QAnon, US President Donald Trump and Iran.Accounts overtly affiliated with Chinese and Russian state media also shared the content, as did a small network of accounts that researchers with ties to a Belarusian state-linked operative.  

Russian Foundation to Battle Injustice fights for falsehoods 

Background on R-FBI 

The Russian Foundation to Battle Injustice (R-FBI) is a “fake human-rights defence NGO created in March of 2021 by Wagner group founder Yvgeny Progozin” according to the EU, which sanctioned the organization in 2025. Clemson University, VIGINUM and others have demonstrated R-FBI’s involvement in Storm-1516 operations.  

However, in 2025, ISD analysts observed R-FBI running its own distinct campaigns. Unlike Storm-1516, R-FBI makes a limited effort to conceal the origins of its content. Its videos bear its logo; while other sites frequentlyrepublish its material, they generally credit R-FBI as the original source. Given this distinction, ISD began tracking R-FBI as a separate operation.  

ISD identified one R-FBI video and more than a dozen articles targeting Armenia, most of which were promoted by a network of influencers on X. 

R-FBI activities targeting Armenia  

R-FBI’s posts have received millions of views promoting false narratives about Armenia, often adopting similar tactics to Storm-1516. As with the other information operation, the Armenian Prime Minister’s press secretary has rebuked claims that originated from R-FBI.  

Between April 2025 and April 2026, R-FBI published more than a dozen articles attacking Pashinyan, his family and members of his party. These articles depict Pashinyan as a corrupt tyrant who is increasingly hostile to the Armenian Church. R-FBI has accused Pashinyan of trying to “eliminate political rivals before elections” and putting opposition figures in “concentration camps.” R-FBI has further alleged that Pashinyan traffics drugs and organs, as well as allowed Western pharmaceutical companies to experiment on Armenian women and children. All of these are narratives have, to some extent, also been used by Russian threat actors to denigrate Ukrainian President Zelensky.   

Image 5: R-FBI article republished by VT Foreign Policy and posted by X influencer

A small cluster of pro-Russia sites republished R-FBI’s articles targeting Armenia, enabling them to reach wider audiences. VT Foreign Policy, a site formerly known as Veterans Today that has ties to Russian intelligence-run sites, republished many R-FBI articles. The London Times, which poses as a local media outlet but regularly launders Storm-1516 content and Russian state media, circulated verbatim R-FBI articles as well. Additionally, the Azerbaijani site Haqqin repeatedly cited Storm-1516’s content.  

On top of working with ideologically aligned sites, R-FBI’s attacks on Pashinyan and his government used many of the same X accounts that circulated Storm-1516’s narratives to advance its claims. Roughly 50 accounts that shared Storm-1516 links also shared R-FBI links, suggesting the operations draw from the same pool of influencers. These influencers include accounts such as DangerousThinkg, DarrenPlymouth and TheSavior (all of which appeared on Bloomberg‘s May 2026 list of “top X accounts spreading Storm-1516 disinformation.”) Researchers, including those at Clemson University, have previously reported on R-FBI’s connection to Storm-1516.  

Image 6 (left): Video with R-FBI logo shared on X
Image 7 (right): R-FBI article republished by VT Foreign Policy and shared on X

Between April 2025 and April 2026, more than 1,100 X accounts shared links to R-FBI’s Armenia-focused articles or articles that republished R-FBI’s content verbatim. Many of those accounts have large followings. More than 60 accounts had more than 100,000 followers, and more than 150 accounts had more than 10,000 followers. Tapping into this influencer network enabled R-FBI’s content to reach millions on X. The most–viewed post, which accused Pashinyan of selling organs to France, was viewed more than 5.7 million times. Multiple posts alleging Pashinyan and other Armenian officials were pedophiles also reached more than a million views.  

Operation Overload impersonates celebrities and media outlets 

Background on Operation Overload   

Operation Overload, also known as Matryoshka and Storm-1679, is a Russian-aligned operation that impersonates credible sources to sow confusion and distrust in Western institutions. It posts manipulated videos and images, often branded with stolen media logos, across X, Bluesky, TikTok and Telegram. The operation also directly contacts researchers and fact checkers, likely to distract them from other investigations or to generate coverage that increases its perceived influence.  

ISD has monitored Operation Overload since 2024. In 2025, we published multiple pieces on its activity. ISD analysts use a range of indicators to identify Operation Overload posts, such as short videos with logos from reputable organizations and posts that tag media outlets, research institutions and political figures accounts.   

The operation often relies on bots to artificially inflate its engagement metrics and rarely gains engagement from real users. Although the operation does not appear particularly impactful, we are detailing its campaign against Armenia to demonstrate the breadth and diversity of pro-Russia operations seeking to influence the upcoming elections. 

From January 1 to May 7, 2026, ISD collected approximately 500 posts on X, Bluesky, TikTok and Telegram attributed to Operation Overload. More than 100 of those posts targeted Armenia.  

Operation Overload activities targeting Armenia 

In ISD’s sample, Operation Overload targeted Armenia more frequently than any country except Ukraine and France. In an apparent effort to lend credibility to false claims, these posts included videos that impersonated more than 50 organizations and individuals, including media outlets, government agencies, private companies and celebrities. Much of the Armenia-focused content sought to discredit Pashinyan by undermining public trust in his leadership. Given Operation Overload’s consistent and well-documented use of bots to artificially inflate engagement metrics, it is difficult to assess the reach of its campaign.  

Roughly 60 percent of posts targeting Armenia directly name “Pashinyan” or “Prime Minister” in their text, indicating that the operation’s primary intent is to damage his credibility ahead of the election. The true figure is likely higher as many posts attached videos that focused on Pashinyan without referring to him by name in the post text itself. ISD’s sample found narratives from Operation Overload accusing Pashinyan of election rigging, corruption, censorship and catering to foreign interests over those of Armenians. The operation also spread false claims about Pashinyan’s personal life, alleging his wife was having an affair and that he was hiding a cancer diagnosis. 

Image 8 (left): Operation Overload post on X containing videos with the logos of Bellingcat and Euronews
Image 9 (right): Operation Overload post on X containing a video with real footage of an actor

Beyond Pashinyan, Operation Overload focused heavily on Armenia’s relationship with France, depicting Paris as the foreign hand steering Armenia into war with Russia and silencing Pashinyan’s critics. Other posts attacked Armenia’s Olympic team, claimed the country was a “sex hub for homosexual paedophiles,” and spread false statistics about Europeans being opposed to Armenia’s accession to the EU.  

Nearly all Operation Overload posts included videos designed to appear as though they were made by trusted organizations or high-profile individuals. During the reviewed timeframe, Armenia-focused content impersonated more than 50 entities. Roughly two dozen videos used authentic footage of celebrities paired with apparent AI-generated audio to falsely depict them disparaging Pashinyan. During a two-day period in April alone, the operation produced nine videos featuring different celebrities “urging Armenians not to let Pashinyan win.” The campaign also impersonated at least 20 media organizations, with Politico appearing most frequently in our sample. Intelligence agencies from the United Kingdom and France, along with companies such as Netflix and OpenAI, were also impersonated. 

Given the operation’s systemic use of bots to artificially inflate engagement metrics of its content, it is difficult to assess Operation Overload’s impact. Historically, its reach has been limited. However, the operation’s persistent appropriation of logos belonging to credible news organizations and institutions, alongside its impersonation of well-known public figures, risks damaging the reputations of those entities and eroding public trust in authentic sources of information. 

The groundwork is laid for election interference 

Russia state-sponsored and aligned operations have spent months spreading false narratives about Pashinyan, laying the groundwork for an election interference campaign meant to undercut his re-election chances and advance those of more pro-Russia candidates. In addition to being persistent, these operations have used a wide range of sophisticated tactics to make their fabricated claims appear genuine and to ensure they are seen by a wide audience. They have created faux local and international news sites, impersonated real news outlets and journalists and relayed content through influencers and third-party sites.  

The scale and complexity of these operations underscore the importance Russia assigns to Armenia’s upcoming election. These efforts also reflect the Kremlin’s effort to preserve leverage over Armenia’s political trajectory asits influence is increasingly contested, with public support growing in Armenia for closer integration with the EU. In this context, Armenia’s election is not only a domestic political contest. This election is also a test of whether Russian influence can still meaningfully shape the foreign policy orientation of countries in its immediate neighbourhood. 

—