The Last Hop - Decipon Insights

The Hit-and-Run That Didn’t Happen

In August 2024, a video circulated on X showing a woman named Alicia Brown. She was in what appeared to be a medical setting. She described being struck by a car in San Francisco in 2011 — a hit-and-run that left her paralyzed. The driver, she said, was Kamala Harris.

The video garnered 2.7 million views. It was amplified by then-Republican vice presidential candidate JD Vance. The hashtag #HitAndRunKamala spread across X, TikTok, and Telegram.

San Francisco police confirmed: no such accident had ever occurred. The x-ray used in the video came from a medical journal. The crash photograph was taken in Guam in 2018. The television station cited — KBSF-TV — did not exist; its name was spelled inconsistently across the video. “Alicia Brown” was a paid actor.

The video was produced in Saint Petersburg.

The Factory

Storm-1516 is an influence operation discovered by Clemson University researchers in fall 2023. Current intelligence assessments link it to Russia’s Internet Research Agency — the organization behind 2016 U.S. election interference — and to the Center for Geopolitical Expertise, a Kremlin-adjacent think tank. Microsoft briefed the Senate Intelligence Committee on the network in September 2024.

Since January 2025 alone, the operation has published 34 documented false claims. Those claims generated 175,000 posts and articles and 274 million views on X alone. That number is not a side effect. It is the product of a specific design.

The design works like this: fabricate a story, seed it through anonymous accounts, route it toward high-credibility amplifiers, then step back and let the credibility transfer happen automatically.

The Routing

Every campaign has a designed propagation path. For the Harris hit-and-run, the path was: fabricated video → anonymous distribution networks → partisan amplifiers → mainstream figures → coverage of the “controversy.”

Storm-1516 doesn’t need every viewer to believe the content is real. It needs the content to reach one person with an existing credible platform — and then to let that person’s credibility do the work.

When JD Vance posts a claim, it stops being “a claim circulating online” and becomes “something Vance said.” His followers don’t trace the link back to an anonymous Saint Petersburg production team. They trace it to Vance. His credibility is borrowed. His audience is reached. The fabricators remain invisible.

This is the mechanic: the last hop washes the origin.

Other documented amplifiers of Storm-1516 content include Representative Marjorie Taylor Greene, who shared the Zelensky yacht narrative; Candace Owens and Jack Posobiec, who distributed content through their platforms; and Donald Trump Jr., who followed key distribution accounts. MSN republished content that originated in the network. In each case, the last hop came with its own audience already attached.

What the Claims Looked Like

The playbook recurs with minor variation across targets and election cycles.

Sexual or moral corruption. Fabricated claims that Macron “liked young boys” reached 20.4 million views across 38,000 X posts. German Chancellor Friedrich Merz was falsely accused of assaulting a sex worker. Tim Walz, then the Democratic vice presidential candidate, was accused of sexually abusing students at a Minnesota high school — the campaign included a deepfaked video of an alleged victim (4.3 million views before deletion), fake email screenshots with visible cursor artifacts, and a fabricated connection to Kazakh foreign exchange students. State Department records confirmed no such students attended the school during the relevant period.

Financial corruption. Zelensky’s associates allegedly purchased yachts worth $75 million using Western military aid. This story circulated through 2023 and 2024, was debunked by the actual yacht brokers involved in real sales, and was nevertheless cited by Vance in his public arguments against continued U.S. support for Ukraine.

Electoral manipulation. On October 24, 2024, a video appeared showing apparent destruction of Trump ballots in Bucks County, Pennsylvania. The County Board of Elections confirmed the materials were inauthentic. The video had spread through partisan networks for hours before debunking was available.

Strategic fear. In July 2024, a deepfaked video impersonating Hamas threatened the Paris Olympics, warning of “rivers of blood” in the streets over France’s support for Israel. Researchers traced it to the same operation. The fear it generated was real regardless of whether the video was. That is the point.

Each category targets a different emotional register: disgust, moral outrage, financial betrayal, physical fear. The specific allegation is secondary to the activation. The brain doesn’t need to fully believe; it needs to be primed to distrust.

The Shift to Europe

By 2025, with U.S. financial support for Ukraine reduced to near zero, Storm-1516 redirected its targeting. The operation shifted toward Europe’s remaining Ukraine backers — specifically the leaders keeping Western aid flowing.

Since January 2025, Storm-1516 has published 13 false claims targeting Germany (compared to three in all of 2024) and 17 targeting France. Eight targeted Merz personally. The tactics are identical to the 2024 U.S. campaign: fabricated allegations, impersonated news sites, falsely attributed journalism.

New domains mimicked Stern.de, Correctiv, the BBC, and CNN. Nine French journalists from Le Monde, Le Figaro, France Télévisions, France 24, and France Info had fabricated articles attributed to their bylines without their knowledge or consent. The publication design was real; the authors didn’t write it.

The goal, as with the American campaign, is not to convince every reader. It is to make the allegations impossible to ignore. If German media must cover “the claims being made about Merz” even to debunk them, the operation has succeeded. The debunking carries the allegation.

Why Fact-Checks Arrive Too Late

The Harris hit-and-run was fact-checked within 48 hours. The Walz video was deleted after 4.3 million views. The yacht story was contradicted almost immediately by the brokers involved in actual yacht transactions.

None of this stopped the amplification.

There are two timelines in a disinformation campaign. The first timeline is where fact-checkers operate: discover, verify, publish debunking, distribute. The second timeline is where the content operates: post, amplify, reach 2.7 million views, generate emotional response, get shared by a vice presidential candidate.

The second timeline runs faster. By the time the debunking arrives, the emotional work is done. The brain does not replace a felt conviction with a correct fact the way software overwrites a corrupted file. The debunking adds a second data point; it rarely nullifies the first.

This is why surface-level disclosure mechanisms fail against this mechanic. The “AI GENERATED” label, the platform fact-check tag, the correction tweet — all of these arrive after the hook has landed. The hook lands first. The label is for the lawyers.

The Design Principle

Storm-1516’s architecture contains a specific engineering insight: the most valuable node in a disinformation network is not the fabricator — it is the last human being with a real reputation who touches the content before it reaches the audience.

The operation does not need to be trusted. It needs to produce content that a trusted voice will relay. The trusted voice’s existing audience, existing reputation, and existing credibility are the actual delivery mechanism. The fabricators provide the raw material. The amplifiers provide the engine.

This inverts the standard model of disinformation defense. Defenders focus on the source: identify the troll farm, expose the fake account, attribute the fake domain. That work is necessary but insufficient. The last-hop amplifiers are, in most cases, not aware they’re relaying fabricated content. They believe what they’re sharing. They are not the adversary — they are the weapon, turned against their own credibility.

The defense has to operate at the pre-amplification stage — before a claim reaches someone with enough credibility to launder it. By the time a sitting senator cites a story in policy debate, the operation has already succeeded. The laundering is complete.

274 Million Views

The number is worth sitting with. 274 million views on X alone, for a single coordinated operation, since January 2025. That is roughly equivalent to the entire U.S. adult population being reached by content originating in a production studio with documented Kremlin connections.

Some fraction of those viewers absorbed claims about Macron, Merz, Zelensky, Harris, Walz. A smaller fraction shared them. A smaller number amplified them to audiences of hundreds of thousands. A very small number had names that appear in newspapers.

That final set — the credible mouths — is where the arithmetic collapses from millions of anonymous views into something durable: a political claim that a real person, with a real reputation, can be documented saying. The fabricators don’t need to win the argument. They just need to write the lines that someone else will deliver.

They keep finding people willing to deliver them.

This article is part of Decipon’s Manipulation Breakdowns series, examining specific influence operations through the Influence Tactics Protocol.

Sources: