Editor’s Note: Russia is spending more on government media in 2026 than in any year since the full-scale war in Ukraine began. The 2026 draft federal budget allocates the equivalent of $1.78 billion—about 28 percent above the 2021 baseline, according to UACRISIS and United24 Media analyses—even as U.S. and European authorities have built out a public record showing how that money translates into operations on the ground.
For cybersecurity, information governance, regulatory compliance, and eDiscovery professionals, the topic has moved beyond foreign-policy analysis into operational risk. Sanctioned Russian outlets can generate content that flows through legitimate vendor pipelines into corporate research, marketing, monitoring, and AI-enabled analysis systems. Doppelganger-style typosquatting blurs the line between propaganda, brand impersonation, and phishing. Foreign-influence material can also surface in lawsuits, investigations, and regulatory reviews, sometimes after the platform that hosted it has removed or obscured the original source. That creates practical challenges for OFAC screening, EDRM provenance, evidentiary preservation, and AI-substrate exposure.
This article revisits what the Institute for the Study of War warned about in January 2020 and compares it with the past two years of indictments, sanctions, leaks, EU actions, OCCRP reporting, and NATO CCDCOE cognitive-warfare framing. The result is not a geopolitical essay. It is a documented risk map for in-house teams, outside counsel, investigators, compliance officers, and service providers responsible for regulated data and defensible workflows. Watch for further OFAC enforcement actions and EU sectoral designations during the second half of 2026.
Content Assessment: From warning to funding: Russia's expanding media machine and the risk signals ahead
Information - 92%
Insight - 94%
Relevance - 90%
Objectivity - 88%
Authority - 90%
91%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "From warning to funding: Russia's expanding media machine and the risk signals ahead."
Industry News – Geopolitics Beat
From warning to funding: Russia’s expanding media machine and the risk signals ahead
ComplexDiscovery Staff
Russia plans to spend the equivalent of $1.78 billion in 2026 to put Kremlin-shaped content in front of audiences outside Russia. Some of that content already reaches Western enterprise systems through legitimate vendor pipelines and search results. For cybersecurity, information governance, regulatory compliance, and eDiscovery teams, what happens after it arrives is a compliance and discovery question.
Building on a January 2020 warning from the Institute for the Study of War (ISW), a Washington-based think tank, the new budget data suggests the Kremlin’s foreign-facing media architecture has moved from the planning phase that ISW analysts described six years ago into a funded, permanent phase that U.S. and European authorities are now actively countering.
What ISW warned about in 2020
That January 2020 ISW report, “The Kremlin’s Expanding Media Conglomerate,” was authored by Nataliya Bugayova and George Barros. They documented at least 50 partnership deals Russia had signed with foreign news outlets over the previous five years. Some allow Russian state media to place its stories in local outlets abroad. Others trained foreign journalists in Russia or established government-to-government links between the Russian media ministry and its overseas counterparts. Bugayova and Barros warned that the strategy was meant to outlast any single counter-disinformation push and to make Russia’s media partnerships hard to dislodge once embedded.
The warning now reads as a roadmap — a six-year-old schematic for the partnerships and content channels that subsequent DOJ, EU, and OCCRP work has documented in detail.
What the 2026 budget actually commits
Russia’s draft 2026 federal budget commits real money to the buildout. The Moscow Times, citing the Russian Finance Ministry’s October 2025 budget release, reports that Russia will allocate 146 billion rubles ($1.78 billion) to state media — up 6.6 percent from 2025. RT (formerly Russia Today) receives roughly 32 billion rubles (about $388 million), and the All-Russia State Television and Radio Broadcasting Company, or VGTRK, receives roughly 25 billion rubles (about $299 million), according to budget summaries from Ukrainian crisis-tracking organization UACRISIS and United24 Media. About 25.96 billion rubles ($317 million) of the media envelope flows to the Institute for Internet Development, a Kremlin vehicle for youth-oriented online propaganda, the investigative outlet IStories reported. A separate program called Russia in the World, designed to reach young foreign audiences with what the Kremlin calls “traditional spiritual and moral values,” jumps from 5.5 billion rubles in 2025 to 11.9 billion in 2026.
The reach has grown, too. RT’s French-language channel was forced out of Paris in 2022 after the EU restricted Russian state media. It moved to Moscow and shifted its focus to French-speaking Africa. RT itself claims an audience of about 215 million viewers there — a figure that comes from RT editor-in-chief Margarita Simonyan and was repeated in October 2025 trade reporting from Broadcast Media Africa. RT Academy, the network’s training arm, says it has enrolled over 1,000 African journalists since launching its Africa program in 2024. Both numbers come from RT and should be read as the company’s own claims.
What ISW is tracking now
ISW’s 2020-2026 update adds buildout details that the budget table does not capture. TV BRICS, a Moscow-headquartered international media network created in 2017, has secured at least 44 partnership agreements since 2022, ISW reports. President Vladimir Putin personally announced the launch of RT India during his state visit to New Delhi on Dec. 4 and 5, 2025, and Sputnik opened its first African Editorial Center in Addis Ababa, Ethiopia, in February 2025 — Russia’s first Amharic-language media service. ISW also catalogs setbacks: Azerbaijan closed Rossiya Segodnya’s office there in February 2025, Sputnik ceased Azerbaijan operations in July 2025, and Kremlin spokesperson Dmitry Peskov admitted in March 2026 that Russia is “rapidly losing” its toolkit for “propaganda work abroad,” particularly in the near abroad.
What two years of enforcement records show
Where the 2020 ISW report described an architecture, the past two years have produced an evidence trail. The record below is a multi-institution convergence — the U.S. Department of Justice, the European Commission, the Council of the European Union, the OCCRP-led investigative consortium, and now NATO’s CCDCOE — not the analysis of any single source.
On Sept. 4, 2024, the U.S. Department of Justice (DOJ) unsealed an indictment in federal court charging two RT employees, Kostiantyn Kalashnikov and Elena Afanasyeva, with funneling nearly $10 million through shell companies to Tenet Media, a Tennessee-based content company. Tenet paid right-wing American online personalities — including Tim Pool, Dave Rubin, and Benny Johnson — to make videos. The same day, the DOJ seized 32 internet domains used in a separate Russian operation called Doppelganger.
According to the DOJ’s affidavit, three Russian companies — Social Design Agency, Structura National Technology, and ANO Dialog — operated under the direction of Sergei Vladilenovich Kiriyenko, First Deputy Chief of Staff of the Russian Presidential Executive Office. Doppelganger used cybersquatted domains, AI-generated content, fake personas posing as U.S. citizens, and paid social media advertisements to spread Kremlin-friendly stories. The DOJ release cites washingtonpost.pm as one example — a domain mimicking washingtonpost.com.
Researchers at EU DisinfoLab, an independent Brussels-based research group, have separately documented Doppelganger clones of European outlets including Bild, 20minutes, Ansa, and The Guardian.
“The sites we are seizing today were filled with Russian government propaganda that had been created by the Kremlin to reduce international support for Ukraine, bolster pro-Russian policies and interests, and influence voters in the United States and other countries,” then-Attorney General Merrick Garland said.
Across the Atlantic, on May 17, 2024, the Council of the European Union (EU) suspended the broadcasting activities of four Kremlin-linked outlets in the EU and directed at the EU: Voice of Europe, RIA Novosti, Izvestia, and Rossiyskaya Gazeta. The Council cited the outlets’ role in supporting and justifying Russia’s war on Ukraine. Voice of Europe was an online outlet launched in Czechia in May 2023 and run from Prague by Viktor Medvedchuk, a sanctioned Ukrainian-Russian businessman, and his associate Artem Marchevsky. The Czech Security Information Service (BIS), working with partner intelligence agencies in seven EU countries, identified Voice of Europe as a vehicle for paying far-right Members of the European Parliament. According to BIS-linked reporting, the recipients spanned at least six countries — Germany, France, Poland, Belgium, the Netherlands, and Hungary — and the payments reached up to 1 million euros a month, often delivered as cash carried by courier from Poland to Prague. National and EU-level investigations into the network are continuing. A year later, on May 20, 2025, the Council of the European Union sanctioned an additional 21 individuals and six entities for hybrid-threat activities and adopted new sectoral measures.
Then there is Pravfond — formally the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad. In 2025, Danish public broadcaster DR obtained about 50,000 of the foundation’s emails and shared them with the Organized Crime and Corruption Reporting Project (OCCRP), an investigative journalism consortium, and 28 partner outlets. According to DR and OCCRP’s reporting on the leaked emails, Pravfond had paid out over 1,000 grants since 2012, with at least 360 of them documented in the archive. The average grant was about $16,500. The same reporting showed that even after the EU sanctioned Pravfond in 2023, the foundation kept sending money to recipients across at least 11 EU countries — sometimes by physically moving cash, sometimes by routing payments through other people’s bank accounts.
What NATO calls this: cognitive warfare
NATO has now given the framework a name. In a 2026 paper titled “Ontological Foundations of Cognitive Warfare,” the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn argues that cognitive warfare is a category distinct from the five operational domains NATO formally recognizes — land, sea, air, space, and cyberspace. Cyber tools may deliver the attack; the target is what the authors call the meaning-making layer.
The CCDCOE authors — Fedir Korobeynikov of Ukraine’s Security Studies and Research Center, Andrii Davydiuk of the CCDCOE itself, and Volodymyr Mokhor of the National Academy of Sciences of Ukraine — name five building blocks that hold an organization together: shared standards for what counts as true, ranked values, identity, trust in institutions, and a shared picture of the future. The author lineup matters for calibration: one CCDCOE researcher and two Ukrainian-institution researchers mean the framework is informed by Ukrainian operational experience and by NATO-aligned concerns about Russian and other state-actor cognitive operations. Cognitive warfare targets those five layers directly. Because they are connected, hitting one ripples through the others. The institution’s components keep working; they stop working together. ComplexDiscovery’s prior April 2026 reporting on the CCDCOE paper, “Invisible by design,” walks through the five invariants and their implications for legal and compliance work in detail.
Two features of the framework matter for the work that follows. The first is what the CCDCOE authors call constitutive invisibility: the attack is engineered to be undetectable to the target. The person under attack experiences the change as their own evolving thinking, not as something done to them. There is no alarm, no incident ticket. The second is the durational claim French analyst François du Cluzel made in his foundational 2020 NATO Innovation Hub report and the CCDCOE paper quotes directly: cognitive warfare is “potentially endless since there can be no peace treaty or surrender for this type of conflict.” The defensive move NATO is calling for is cognitive resilience: protecting the five layers up front, while they are still intact, rather than running the conventional detect-attribute-respond loop after one of them has already been compromised.
The CCDCOE authors themselves concede the framework is at an early stage — a way of thinking about the problem rather than a measurement tool. Indicators for the connections among the five layers, methods for identifying which institutions and individuals hold those connections together, and metrics for tracking coherence remain work for future research.
What it means for security, governance, and discovery
What follows is this article’s reading of how the CCDCOE framework maps onto cybersecurity, information governance, regulatory compliance, and eDiscovery work. The CCDCOE authors do not prescribe these applications; the mapping is offered as a starting point for practitioners.
Three things, in descending order of how directly each will hit your day-to-day work. Information governance and sanctions compliance is the strongest tie. Cybersecurity is real but indirect — more about shared methods than direct targeting. eDiscovery is real but narrow, applying when foreign-influence material lands in a specific case.
Information governance and sanctions compliance is where the exposure is most concrete. When the U.S. or EU designates a Russian outlet under sanctions, content from that outlet does not stop circulating. It gets republished, summarized, scraped by automated tools, fed into market-research dashboards and sometimes mixed into licensed image libraries. A corporate research function paying a vendor whose feed includes sanctioned-outlet content, or a marketing team licensing photos that trace to a designated entity, can carry a sanctions problem without any direct dealing with Russia. The U.S. Office of Foreign Assets Control (OFAC) sharpened that point through 2025 enforcement, signaling that compliance obligations extend beyond formal corporate boundaries — see Sidley Austin’s year-end review for the practitioner synthesis.
Cybersecurity is a shared-infrastructure story. The cybersquatted domain pattern behind Doppelganger is the same one operators use for everyday phishing, and the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have noted in repeated public advisories that foreign influence operations and cyber intrusions share infrastructure and tradecraft. The actionable takeaway is narrower than it sounds: brand-protection programs that monitor only for typosquats of the company’s own domains are working with a partial threat model, because the trusted news domains employees and customers click on get cloned by the same actors. No public reporting yet shows propaganda domains repurposed against a specific company, so this is a model-breadth point, not a same-quarter alert.
eDiscovery is the narrowest of the three but the most acute when it applies. Most matters will not have a foreign-influence dimension. When one does — a defamation case naming a Kremlin-aligned source, a regulatory inquiry into vendor due diligence, a shareholder dispute touching on disinformation exposure — the preservation duty runs to the underlying content even after a platform has taken it down. Counsel handling such matters should expect requests for forensically sound captures of cloned-domain pages, archived versions of sanctioned outlets, and the metadata trail showing how the content reached enterprise systems. Based on recent matters and public filings through April 2026, DOJ domain seizures and EU sanctions designations are among the evidentiary anchors most often cited in such requests. For discovery professionals specifically, this complicates the Identification and Collection phases of the Electronic Discovery Reference Model (EDRM) — picking out state-shaped narratives inside legitimate corporate data streams calls for sentiment and provenance analysis on top of standard custodial-source review.
Two recent developments anchor this in concrete legal practice. In Mendones v. Cushman & Wakefield (No. 23CV027421), the Superior Court of Alameda County, California, on Sept. 9, 2025, issued terminating sanctions after finding that plaintiffs had submitted deepfake video and altered-image evidence — detected through metadata inconsistencies. On the federal side, the U.S. Advisory Committee on Evidence Rules has a vote scheduled for May 7, 2026, on proposed Rule 707, which would extend the kind of reliability standards that already govern human expert testimony to evidence generated by machines. Courts are already sanctioning fabricated evidence; the federal rules are catching up. The provenance question is no longer abstract for litigators.
What changes when AI sits underneath
The three exposures above all run through a fourth layer that is now part of every modern legal and compliance stack: large language models. LLMs trained on web crawls ingest whatever sits on the open web — including content from RT, Sputnik, RIA Novosti, Rossiyskaya Gazeta, and the dozens of TV BRICS partner outlets ISW catalogs. Pre-training filters help but remain imperfect, and the filtering bar is much weaker for non-English content. Sputnik’s new Urdu, Amharic, and Portuguese services — flagged in the ISW 2020-2026 update — reach markets where models have weaker filtering and less downstream human pushback. The same applies to retrieval-augmented systems that fetch live web content to construct answers. A typosquatted domain that ranks well in search is a domain a model can quote in an answer.
Doppelganger-style typosquatting compounds this. The campaign is designed to be indistinguishable from legitimate sources, so an AI system that ingests a story attributed to washingtonpost.pm — the example named in the DOJ release — does not necessarily know that the domain is not The Washington Post. Credibility weight transfers from the apparent publisher; if the publisher is spoofed, the credibility transfer is too. The DOJ release also names AI-generated content as one of the methods Doppelganger used to drive viewership. Western AI systems trained on open-web crawls would have ingested some of that material before the September 2024 seizures, which means today’s models can carry forward content produced by an adversarial AI pipeline — an observable feedback loop in principle, though specific instances are hard to attribute after the fact.
For legal research tools, sanctions-screening platforms, and eDiscovery classifiers built on LLM substrates, the implications track the gradient above. A sanctions-screening tool that uses an LLM to summarize a vendor’s content history can inherit the same provenance gaps. An eDiscovery classifier that uses LLM-based topic modeling can misclassify state-shaped content as neutral reporting. Brand-protection systems that rely on LLM-based threat detection can miss cloned-news-domain risks because the model has been trained to read those domains as legitimate. The sentiment and provenance analysis the EDRM line points to is, in practice, an AI evaluation problem now — and one worth interrogating with vendors before relying on AI output for high-stakes review.
The CCDCOE framing — and ComplexDiscovery’s prior reading of it — points to provenance as a discipline rather than an assumption. Three practical techniques sit on the practitioner’s shelf today. The first is signature-based handoff tracking: each transfer of a document gets cryptographically signed, so any later alteration is detectable rather than silent. The second is embedded origin metadata that travels with a file, letting source, creation time, and edit history be reconstructed downstream by any authorized reviewer. The third is going around the secondary source entirely — pulling a court order from PACER, an OFAC designation from Treasury, an SEC filing from EDGAR, an EU sanctions notice from the Council itself — rather than relying on a vendor summary that could be substituted without notice. Each closes a different gap a cognitive attack would otherwise exploit. Each is policy, not procurement.
The Kremlin built this system in plain sight. ISW described it in 2020 and has continued to map it through its 2020-2026 update. The DOJ, the European Council, a leaked Russian email archive, and now NATO’s CCDCOE have spent the past two years filling in the evidence and the framework. The hard work — for compliance teams now, for security teams as the threat model widens, for litigators when a matter calls for it, and for the AI systems sitting underneath all of those workflows — is figuring out how to identify and preserve this content when it lands inside enterprise systems. NATO has named the defensive posture that maps to this work: cognitive resilience. The frame is data hygiene, not political counter-speech — identify regulated content that has crossed enterprise systems, preserve it correctly, and treat its provenance as engineering.
That $1.78 billion is part of the story Russia does budget for. What your security, governance, and legal teams do when the content arrives is the part that Russia does not.
What is your organization’s current process for spotting — and preserving — influence-operation content that arrives through legitimate enterprise channels?
News sources
- The Kremlin’s Expanding Media Conglomerate 2020-2026 (Institute for the Study of War)
- More Taxes for More War: Unpacking Russia’s 2026 Budget (The Moscow Times)
- Justice Dept. Disrupts Russian Influence Campaign, Indicts Russian Nationals (Lawfare)
- Russian hybrid threats: EU lists further 21 individuals and 6 entities and introduces sectoral measures (Council of the European Union)
- Russian Foundation, Aimed at Helping ‘Compatriots’ Abroad, Supports Spies, Criminals, and Propagandists (OCCRP)
- Doppelganger – Media clones serving Russian propaganda (EU DisinfoLab)
- Kremlin-Funded Media: RT and Sputnik’s Role in Russia’s Disinformation and Propaganda Ecosystem (U.S. Department of State (Global Engagement Center))
- OFAC Recent Actions — primary enforcement releases (U.S. Department of the Treasury)
- Ontological Foundations of Cognitive Warfare (NATO CCDCOE (Korobeynikov, Davydiuk, Mokhor, 2026))
- Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery (ComplexDiscovery)
- Cognitive warfare (2020 NATO Innovation Hub report) (François du Cluzel, NATO ACT Innovation Hub)
Assisted by GAI and LLM Technologies
Additional reading
- Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery
- When Your Legal Tech Vendor Gets Breached: DocketWise Incident Exposes 116,666 Immigration Records and a Profession’s Blind Spot
- The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing
- FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
- White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
- The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.


























