A hacked workstation exposes the prompts, payments and disputes inside Storm-1516

A reconstructed copy of systems belonging to former Florida police officer John Mark Dougan reveals the machinery behind part of Russia’s Storm-1516 influence operation, according to CORRECTIV and The Insider. CORRECTIV says it cross-checked samples of the chats, emails, files and browser data; one correspondent confirmed an email in the leak. The dataset is incomplete and came from an anonymous source.

The files include payment receipts sent to Dougan by Yuri Khoroshevsky, whom previous intelligence reporting associates with the GRU’s Unit 29155. One 2022 transfer covered equipment and a monthly payment. Dougan acknowledges consulting for the Moscow-based Center for Geopolitical Expertise but denies being paid to operate his DC Weekly site and denies involvement in election interference.

The more instructive evidence is operational. A program in the leak appears to have filled more than 40 pseudo-news sites with thousands of AI-rewritten articles. Its prompts instructed models to adopt pro-Russian frames; task messages show one request being converted into more than 100 published links. Such filler creates the appearance of ordinary outlets around a smaller number of fabricated claims.

The records also show internal conflict: Dougan complained that his code and fake-site method had been taken from him, while contacts encouraged expansion into European elections. The leak confirms a production system and financial relationships. It does not by itself prove Dougan’s role in every later Storm-1516 campaign, including the German operations that bear similar fingerprints. That boundary makes the evidence stronger, not weaker.