Executive Summary 

EclecticIQ analysts assess with high confidence that on May 11, 2025, pro-Kremlin disinformation group Storm-1516 [1] amplified a fabricated story on X, falsely claiming European leaders used drugs while traveling by train to Kyiv for peace talks, aiming to undermine the European support for Ukraine [2]. Independent fact-checkers quickly debunked the false rumour, which was based on a photo of a paper napkin likely deliberately misidentified as a “bag of cocaine.”[3] 

The earliest viral post, published at 16:51 UTC on May 10 by the French-speaking X account @francoisros [4], featured a video clip with the caption “Il les remet dans sa poche à la fin” (“He puts them back in his pocket at the end”). The video briefly showed a Telegram group notification from the Russian Embassy in France, prompting questions about the account’s intent. However, no definitive evidence currently links that X account to the Russian government. 

Figure 1- X post from @francoisros deliberately misidentified a paper napkin as drugs in a video of European leaders' visit to Kyiv. 

Soon after, pro-Kremlin actors including Storm-1516, Russian state media, and Maria Zakharova, a senior official in Russia’s foreign ministry, amplified the story as part of a coordinated disinformation campaign [5]. EclecticIQ assesses with high confidence that this operation aimed to promote the narrative that Europe is run by "drug addicts" detached from ordinary citizens. 

EclecticIQ assesses this campaign as part of a Kremlin strategy to fracture European unity on Ukraine and divert attention from upcoming diplomatic efforts, particularly the Istanbul peace talks scheduled for May 15, 2025 [6].  

Storm-1516 Linked Social Media Accounts Spread Disinformation to Discredit Diplomatic Visits  

EclecticIQ analysts assesses with high confidence that Storm-1516 very likely orchestrated a coordinated disinformation campaign to discredit the May 10, 2025, visit of European leaders to Kyiv.  

The campaign falsely accused French President Emmanuel Macron, UK Labour leader Keir Starmer, and German chancellor Friedrich Merz of drug possession during their return from Ukraine.  

Figure 2 – Disinformation amplified by Storm-1516-linked X accounts. Both accounts used the same fake narrative, deliberately misidentifying the items on the table as a snuff spoon used for drug consumption.

On May 11, 2025, Storm-1516 linked X accounts @MyLordBebo [7] and @Zlatti_71 [8] amplified these false claims, cantering the narrative on a deliberately misrepresented image. The widely circulated image shows a simple tissue that was deliberately portrayed as a “bag of cocaine” and a metal stirrer was intentionally misidentified as a snuff spoon used for drug consumption [9].

Analysts assess with medium confidence that this disinformation campaign likely aims to discredit the European leaders' show of unity with Ukrainian President Zelensky, who hosted them in Kyiv ahead of the Istanbul peace talks. Their visit was intended to reinforce diplomatic pressure on Russia and signal strong European support for Ukraine's position.

By attacking the reputation of these leaders, the campaign likely aimed to turn their own voters against them, using influence operations (IO) to reduce public support for Ukraine by discrediting the politicians who back it.

Leveraging Generative Artificial Intelligence (AI) for Image Creation

EclecticIQ analysts identified a deliberate effort by pro-Kremlin disinformation actors particularly the Storm-1516 network, to use generative AI tools to fabricate images targeting European leaders following their high-profile diplomatic visit to Kyiv in May 2025. These images included depictions falsely linking leaders like Emmanuel Macron to cocaine use.

Figure 3 - AI generated image showing figure of Emmanuel Macron with bags of cocaine.

Starting late on May 11, 2025, accounts like @TheGriftReport [10] and @MyLordBebo [11] began spreading AI-generated, visually manipulated memes depicting the three leaders with drug-related themes. These images were rapidly produced using latest AI models and leveraged internet meme culture to distribute these fake allegations much faster. The memes served as a vector for virality and increasing shareability, a hallmark of hybrid information warfare tactics.

Figure 4 - Same disinformation theme was used to target Keir Starmer and other European leaders.

Historical Context and Attribution Confidence for  Storm-1516

EclecticIQ assesses with high confidence that @Zlatti_71 and @MyLordBebo are linked to the disinformation group Storm-1516. Following the initial publication of a fabricated drug-use allegation on May 10, 2025, both accounts—alongside Storm-1516-linked profiles and pro-Kremlin troll networks—amplified the false narrative across social media platforms.

This assessment is based on a convergence of technical indicators, including:

• Infrastructure overlaps with previously identified Storm-1516 social media accounts, as documented by VIGINUM (France's digital interference agency) in May 2025 [12],
• Synchronized amplification behaviour observed among known affiliated accounts, with same disinformation theme,
• Consistent linguistic, visual, and thematic patterns, particularly the repeated use of AI-generated content to construct and disseminate disinformation.

According to Microsoft Threat Researchers [13], Storm-1516 is a Russian state-linked disinformation group likely operated by the Foundation to Battle Injustice (R-FBI) [14], an entity associated with the late Yevgeny Prigozhin.

Emerging in late 2023 as a successor to the Internet Research Agency, Storm-1516 specializes in high-impact influence operations, focusing on Ukraine and Western democracies. Its operations are characterized by the strategic deployment of AI generated media, fake news outlets, and coordinated social media campaigns for spreading disinformation.

Storm-1516 has demonstrated a systematic reliance on AI-generated media as a core tactic, using fabricated images and deepfake-style videos to lend visual credibility to false narratives. This approach enables rapid narrative construction and facilitates cross-platform spread, often outpacing traditional fact-checking mechanisms.

Figure 5 - AI-generated disinformation video depicting Ukrainian President Volodymyr Zelensky in Istanbul, falsely presenting him with a “bag of cocaine.”

Figure 5 shows an AI-generated video posted on X by the pro-Kremlin troll account @runews [15], featuring a fabricated image of President Zelensky in Istanbul holding a bag of cocaine—an attempt to discredit Ukrainian leadership. The video aligns with disinformation tactics previously observed in Storm-1516-linked accounts targeting European leaders.

It was posted at 2:26 PM on May 13, 2025, just two days before the scheduled Istanbul Peace Talks. The timing and content indicate a calculated effort to undermine Zelensky’s credibility through synthetic media, likely intended to influence diplomatic negotiations aimed at ending the Russo-Ukrainian war.

Russia’s Ministry of Foreign Affairs Spook Person Publishing the Disinformation Narrative in Telegram Channels

On May 11, 2025, EclecticIQ analysts observed Maria Zakharova, director of the Russian foreign ministry’s information and press department, using her official Telegram channel [16] to falsely accuse European leaders with the same false narrative that was being amplified by Storm-1516 linked social media accounts.

Figure 6 - Telegram channel of Zakharova share the same drug-use disinformation campaign that was first published by Storm-1516 linked social media accounts.

She posted a video showing Emmanuel Macron, Keir Starmer, and Friedrich Merz near a paper napkin and spoon—objects she claimed were cocaine-related. Zakharova framed the summit as a drug-fuelled farce, referencing unverified claims about Volodymyr Zelensky’s alleged cocaine use.

This involvement by a senior Russian government official is shows how state actors are not only amplifying disinformation narratives but also legitimizing them through official channels. 

Strategic Outlook and Actions to Take for Policy Makers

Storm-1516’s latest disinformation campaign showcases the Kremlin’s hybrid warfare tactics, blending generative AI with legacy troll networks to target European unity at pivotal diplomatic junctures. As the Istanbul peace talks approach, the EU member countries and their leaders face a threat from Influence Operations.

EclecticIQ analysts recommend that European policy makers rapidly operationalize existing tools such as the Digital Services Act and the AI Act to disrupt malign narratives before they reach critical amplification.

Intelligence sharing and diplomatic efforts must be synchronized to deter further influence operations, mandating content provenance standards on social media platforms, and embedding rapid counter-disinformation mechanisms across member states.

To safeguard Europe’s strategic coherence and public trust, policymakers must treat the information environment as a frontline domain and act pre-emptively to future threats.

References

[1]          S. Nazari, “Storm-1516 and R-FBI: Russian Attempts to Interfere in the German Election,” Alliance4Europe. Accessed: May 12, 2025. [Online]. Available: https://alliance4europe.eu/storm-1516-german-elections

[2]          A. C. Walsh Nick Paton, “European leaders visit Kyiv, and tell Russia: 30-day ceasefire now or face massive sanctions,” CNN. Accessed: May 12, 2025. [Online]. Available: https://www.cnn.com/2025/05/10/europe/european-leaders-kyiv-ukraine-visit-intl

[3]          “Macron, Merz and Starmer targeted by Russian ‘cocaine’ claims,” euronews. Accessed: May 12, 2025. [Online]. Available: https://www.euronews.com/my-europe/2025/05/12/fact-check-macron-merz-and-starmer-targeted-by-russian-cocaine-claims

[4]          “François (75 / 20) on X: "@So44601640 @E2Villiers Il les remet dans s…,” archive.md. Accessed: May 12, 2025. [Online]. Available: https://archive.md/luUmT

[5]          “Telegram: View @MariaVladimirovnaZakharova.” Accessed: May 12, 2025. [Online]. Available: https://t.me/MariaVladimirovnaZakharova/10479

[6]          “Putin offers Ukraine to resume direct peace talks in Istanbul.” Accessed: May 12, 2025. [Online]. Available: https://www.aa.com.tr/en/russia-ukraine-war/putin-offers-ukraine-to-resume-direct-peace-talks-in-istanbul/3563499

[7]          “Lord Bebo on X: "🇫🇷🇬🇧🇩🇪 BUSTED: The coalition of the willing wa…,” archive.is. Accessed: May 12, 2025. [Online]. Available: https://archive.is/uipyb

[8]          “Zlatti71 on X: ‘New Episode Out Now: “Powder Behind Power – Elites, Cocaine, and Consequences” In this gripping new episode, we pull back the curtain on a recurring and controversial issue: the presence—and suspected use—of cocaine and other drugs within the ranks of political and economic https://t.co/k8AHYVD5CE’ / X,” X (formerly Twitter). Accessed: May 12, 2025. [Online]. Available: https://x.com/Zlatti_71/status/1921848021257457998

[9]          Zlatti71 [@Zlatti_71], “This item needs a new name! How about „Merzifix“? https://t.co/J1sXXz3Eno,” Twitter. Accessed: May 12, 2025. [Online]. Available: https://x.com/Zlatti_71/status/1921568994605093044

[10]       “Grifty on X: ‘The Cocaine Train 😆 https://t.co/cIb0pR248Z’ / X,” archive.is. Accessed: May 12, 2025. [Online]. Available: https://archive.is/zHHBE

[11]       Lord Bebo [@MyLordBebo], “Already selling off the shelves like hot cakes https://t.co/21WOMkqQML,” Twitter. Accessed: May 12, 2025. [Online]. Available: https://x.com/MyLordBebo/status/1921650867406561395

[12]       “20250507_TLP-CLEAR_NP_SGDSN_VIGINUM_Rapport technique_Storm-1516.pdf.” Accessed: May 12, 2025. [Online]. Available: https://www.sgdsn.gouv.fr/files/2025-05/20250507_TLP-CLEAR_NP_SGDSN_VIGINUM_Rapport%20technique_Storm-1516.pdf

[13]       “Russian US election interference targets support for Ukraine after slow start,” Microsoft On the Issues. Accessed: May 12, 2025. [Online]. Available: https://blogs.microsoft.com/on-the-issues/2024/04/17/russia-us-election-interference-deepfakes-ai/

[14]       S. V. Conte Gianluca Mezzofiore, Avery Schmitz, Alex Marquardt, Michael, “Russian disinformation network with ties to notorious ‘troll factory’ is taking aim at the US election, analysis finds,” CNN. Accessed: May 12, 2025. [Online]. Available: https://www.cnn.com/2024/10/30/europe/russian-disinformation-harris-walz-us-election-intl

[15]       Russian Market [@runews], “This week in Turkey https://t.co/umCDVDtLTB,” Twitter. Accessed: May 14, 2025. [Online]. Available: https://x.com/runews/status/1922251988684644789

[16]       “Telegram: View @MariaVladimirovnaZakharova.” Accessed: May 14, 2025. [Online]. Available: https://t.me/MariaVladimirovnaZakharova/10479