A Telegraph journalist reveals how her identity was stolen as part of a sinister fake news operation run by the Kremlin

Roland Oliphant Chief Foreign Analyst

14 September 2025

The Telegraph’s Helen Brown is an arts writer – music and film reviews, interviews with comedians, directors and ballet choreographers, write-ups of new documentaries. Geopolitics is not her bag.

So when she was asked if she had written a potentially libellous story about Volodymyr Zelensky, she was first bemused, then perturbed.

“I was a bit like, what? And I was in the middle of a field with the dog. The dog was still playing with some dogs she didn’t know. And I was like, ‘I’m a freelancer’, you know? I’m a self-employed arts journalist”, she said.

She squinted at the screen to see the “incriminating” story, dog lead in one hand, phone in the other. The text was too small to make out the author’s picture. “I got back and had a proper look and, oh my goodness, there I was – good grief – in some mashed-together London Evening Standard with the Daily Telegraph.”

Helen’s byline photo – an old one, lifted from her Twitter profile – sat under a headline claiming that Volodymyr Zelensky had been caught in a billion-dollar corruption scheme, a subject she had never written about. The byline was Charlotte Davies, a name she had never heard. And the host website was so shoddy “my kids could have done a better job.”

She did not know it at the time, but Helen was the latest victim of journalistic identity theft by a Russian propaganda campaign run by a fugitive American police officer based in Moscow.

It’s a bizarre, but potentially dangerously disruptive, part of the Kremlin’s propaganda war: a well-funded attempt to sway public opinion in the West by planting fabricated stories on clumsily cloned websites.

“Charlotte Davies” was born when the so-called “London Telegraph” website appeared out of nowhere in late August.

Beyond the name, it bears almost no resemblance to the real Telegraph. In Google search results it shows up with a thumbnail using the Gothic initials LT – but in a slightly off version of the font The Telegraph actually uses.

The site itself is set in uniform Arial, with erratic capitalisation that would give any real homepage editor a heart attack.

Its articles are clumsily written, and every one of them was uploaded in quick succession on August 25, 26 or 27.

Inside a disinformation network

All of these are hallmarks of Russia’s sprawling fake news ecosystem – a virtual world of fabricated websites, deepfake videos and brazen lies dressed up as journalism, all designed to sway Western opinion.

The Telegraph is hardly the only target. Over the past year, the propagandists have posed as the BBC, the Economist, Vogue, Fox News – even OK! magazine.

Several networks are known to operate. The most prominent, dubbed “Matryoshka” by Western researchers, has been linked to attempts to spread fake news during the 2024 US election and Germany’s parliamentary elections in February 2025.

Most recently, it was caught pushing fabricated stories claiming that Moldovan president Maia Sandu had embezzled $24m and was addicted to “psychotropic drugs.”

The EU’s disinformation centre classifies Matryoshka as only one strand of a broader Russian operation known as “Doppelganger”, designed to undermine support for Ukraine and sow division among its allies.

Doppelganger’s key characteristic is creating hoax “clones” of media and government websites. Le Monde, the Guardian, Der Spiegeland Fox News have all been spoofed in the past.

NewsGuard, a New York-based transparency group that monitors Russian misinformation, believes the “London Telegraph” is the work of a separate network known as Storm-1516.

“About a year ago, this Russian influence operation was primarily just inventing reporters from scratch, making up names for them, making up outlets completely from scratch that didn’t exist”, says McKenzie Sadeghi, a researcher at the company,

“But within the last few months or so, we’ve seen that they’ve shifted their tactics slightly to start impersonating actual journalists and making sites that mimic these actual outlets. In this case, it was mimicking The Telegraph and hijacking the identity of Helen Brown in an attempt to give the false claim credibility and make it appear more legitimate”, she says.

Like Matryoshka, Storm-1516 has been implicated in US, German and Moldovan election interference. While Matryoshka specialises in spamming videos, Storm-1516 uses an AI server to generate hoax websites.

The network was identified in the autumn of 2023 and given its name by researchers at Microsoft. It has been implicated in a series of disinformation efforts, including a deepfake video falsely accusing Tim Walz, Kamala Harris’s running mate in the 2025 election, of sexual assault.

The group appears to have begun as an offshoot of the Internet Research Agency, the St Petersburg troll farm founded by the late mercenary leader Yevgenny Prigozhin, and has been linked by Microsoft’s Threat Analysis Centre to Valery Korovin, a former Internet Research Agency employee who now heads a Moscow-based think tank called the Center for Geopolitical Expertise (CGE).

Korovin and the CGE were both sanctioned by the United States as affiliates of the GRU, Russian military intelligence, in December 2024.

Viginum, the French government’s anti-digital interference agency, has also linked the network to John Mark Dougan, a former deputy Palm Beach County sheriff who defected to Russia in 2017.

Dougan has in the past received money from a GRU officer involved in sabotage operations to set up an AI server to generate content, according to a 2024 Washington Post article citing Russian documents provided by a European intelligence service.

“They replicate the website and populate it with generic news content to give it the appearance of a real outlet… to make it seem more credible”, says Sadeghi of Dougan’s modus operandi. “It is all AI generated. Sometimes the articles even include the prompts [the instructions given to AI by a user].”

The fake news stories are then promoted by bot-run social media accounts in the hope of making them go viral.

The method behind the network’s move into journalistic identity theft remains something of a mystery.

Why, asks Brown, use an arts critic for a story about corruption? They might at least have used one of The Telegraph’s foreign correspondents, or the team who broke the story about Angela Rayner’s stamp duty scandal.

At the beginning of the war, Brown profiled Jo Cope, a single mother from Chelmsford who flew to Poland to rescue refugee Ukrainian children. Telegraph readers raised £50,000 for the rescue operation. And in July 2022, she interviewed the Ukrainian ballet choreographer Alexei Ratmansky. But she has no other history of covering Ukraine or Russia.

Reverse image searches showed the theft of at least two other reporters’ byline photographs on the London Telegraph.

“James Whitemore”, the paper’s purported Africa correspondent, has hijacked the byline photo of Kyle Mitchell, a reporter for the Michigan television station Wood TV.

“Sophie Marshall”, whose name appears on the London Telegraph’s culture stories, uses the Twitter profile picture of Britt Jones – a 29-year-old freelance news and entertainment writer and author from the West Midlands.

Like Brown, she appears to have no connection to Russia, Ukraine, or the content her picture has been used with.

“Um, it is quite confusing”, says Jones, whose photograph appears under headlines like “Bruce Willis’s communication abilities deteriorate amid dementia battle” and “Before Breathless: The untold story of Godard’s first film.”

“None of that’s my forte”, she says. “I do write about politics, but I’m more into trending news. Because I do a lot for LADBible, we’re quite careful about, you know, making sure we don’t get sued. So if it’s substantial and substantiated, then, yes, we’d write about something like that.”

Jones wonders aloud whether her profile was targeted because she is not very active on social media.

“There may be something to that”, says Sadeghi. “It’s unclear to me how they go about choosing which reporter to impersonate, but my suspicion is that, you know, if they choose a very prominent, well-known reporter, getting that content to surface high up in a search result or elsewhere isn’t going to be that effective because there’s already so much public information and news reports about that reporter.”

Using reporters with a lower online profile allows them to “hijack that data void and more effectively associate that person’s name with the false article”, she explains.

For Brown, it is just a bizarre experience.

“Like any journalist, our job is to try and tell the truth. I get upset if I make the tiniest error in an article. Obviously this isn’t my mistake, but it’s unsettling, isn’t it, to have your credibility hijacked to spread false information. I found it unsettling. Disturbing”, she says.

“As a journalist, you are used to s— online. I mean, I once gave a Lorde album three out of five stars, and those fans started sharing a story online that I killed a woman in San Diego.”

“But you have to put your identity out there as a means of verifying what you do. You can’t not have a byline photo. So our identities are more up for grabs.”

………………