# Pro-Kremlin network spreads fake Politico tomato hoax

Published: 2026-09-29 · Severity: routine · Sectors: media, government-national
Canonical: https://vorant.io/reports/d59f193c-00a6-56d5-9d9a-df8745445c3e/pro-kremlin-network-spreads-fake-politico-tomato-hoax

> DFRLab traced a coordinated pro-Kremlin disinformation campaign that fabricated a Politico story about EU rejecting Armenian tomatoes, spreading it in 18 languages within 29 hours.

DFRLab and CivilNet documented a coordinated influence operation that fabricated a Politico news story claiming the EU had rejected Armenian tomato imports, inverting the actual fact that Russia had embargoed Armenian agricultural goods ahead of Armenia's June 2026 parliamentary elections while the EU opened its market. The false claim was seeded on a Russian-language Telegram channel (@indeec_1937) on July 22, 2026, and within minutes appeared on a verified X account (@SprinterPress, part of the pro-Kremlin 'Sprinter' network) and spread to Space.ru mirrors, Facebook groups, and Belarusian state TV. The operation exploited genuine Armenian farmer protests to push narratives discrediting PM Pashinyan and the EU, timed to undermine Armenia's westward orientation.

Analysts used the Erebus Toolkit and byte-level image hashing to establish coordination across four platforms (Telegram, X, Facebook, VK), identifying automated translation pipelines, synchronized multilingual posting clusters (Russian-German-French within 30 seconds, 413 instances observed over two months), and fixed-sequence amplification chains involving Armenian outlet Past.am and four Telegram channels. Key amplifiers included pro-Kremlin military blogger Yury Podolyaka (73 posts across 64 channels), the ANNA NEWS Telegram channel, the Pravda Network mirror sites, and 74 X accounts with documented ties to the Storm-1516 influence operation targeting Armenia and the Baltic states. The false story reached eighteen languages, including Korean and Vietnamese, within 29 hours, with word-for-word identical text indicating centralized translation and distribution rather than organic spread.

For defenders and trust & safety teams, the report is valuable less for its specific claim than for the reusable disinformation infrastructure it exposes: persistent mirror sites, automated cross-posting bots with near-zero-second republication latency, page-like inauthentic Facebook accounts, and verified/high-follower X accounts pre-positioned to amplify Kremlin-aligned narratives on demand. This infrastructure predates the campaign and remains active, meaning similar fabricated-attribution hoaxes attacking other countries' EU/Western relations should be expected using the same channels and techniques.

## Mentioned in this report

- Threat actors: Storm-1516
- Campaigns: Armenian Tomato Hoax, Doppelganger/Pravda Network operations

Source reporting: https://dfrlab.org/2026/09/29/russia-banned-armenian-tomatoes-a-fake-politico-story-blamed-europe

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d59f193c-00a6-56d5-9d9a-df8745445c3e/pro-kremlin-network-spreads-fake-politico-tomato-hoax.
In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup