The Document Trail of a Disinformation Asset
MOSCOW, November 11, 2026 — Hacked correspondence obtained by The Insider reveals that John Mark Dougan, a former U.S. sheriff’s deputy and Marine, served as a financial cutout and propaganda conduit for the Russian GRU. The records show how the former American law enforcement officer moved from an obscure fugitive seeking asylum to a central figure in Kremlin disinformation campaigns, before his influence collapsed amid personal financial struggles and frustration with domestic censorship.
The archive of messages provides a detailed timeline of Dougan’s integration into Russian security structures. It documents his coordination with GRU Unit 29155, his production of military training materials for Russian forces, and his role in amplifying unverified claims regarding biological laboratories in Ukraine. The documents also trace the deterioration of his status, showing a man who once commanded attention on Russian state television becoming a marginalized figure complaining about blocked internet services and low earnings.
Dougan’s journey began with his flight from the United States, where he faced legal issues related to his activities as a self-proclaimed hacker and whistleblower. He moved to Russia around 2016, claiming to seek political asylum to avoid prison. According to the filing, he initially operated within circles surrounding the ultranationalist ideologue Alexander Dugin. Over time, his interactions with Russian intelligence services became more formalized, leading to his designation as a key asset for spreading narratives aligned with Moscow’s strategic interests.
Financial Cutout for GRU Operations
The correspondence shows that Dougan acted as a financial intermediary for GRU Unit 29155, the branch responsible for disinformation and sabotage. Yuri Khoroshenky, a GRU officer who worked under cover as a deputy director at the Dugin-linked Center for Geopolitical Expertise, coordinated these transactions. The record shows that Khoroshenky transferred small amounts of money through Dougan’s accounts, with some funds intended for Dougan and others for unidentified third parties.
In November 2021, Khoroshenky complained in a message that Western Union would not allow him to send $200 to a recipient in Costa Rica. Dougan replied that he could send the money from his American account to a bank account or card. This interaction illustrates the mechanics of the operation: Dougan used his position as a U.S. citizen with access to Western financial systems to obscure the source of payments made by Russian intelligence. The messages indicate that Dougan asked no questions about the recipients, effectively serving as a blind conduit for funds.
This role as a “cutout” allowed the GRU to obscure its financial footprint while leveraging Dougan’s legal status and banking access. The documents do not specify the total volume of funds moved, but the pattern of transactions suggests a sustained effort to launder intelligence-related payments through a domestic U.S. account. Dougan’s willingness to facilitate these transfers, despite his own financial instability, points to a dependency on the Russian side for support, even if that support was irregular and modest.
Coordinating Biolab Narratives and Military Training
Dougan’s involvement in propaganda efforts extended to the promotion of false claims about U.S. biological weapons programs in Ukraine. In 2021, he published an investigation into alleged “biolabs,” which was adopted almost word for word by the Russian Defense Ministry in March 2022. That month, Defense Ministry spokesperson Igor Konashenkov stated that pathogens had been destroyed in laboratories in Poltava and Kharkiv, citing documents that confirmed the development of biological weapons components near Russian territory.
The narrative found traction in the U.S. far-right media ecosystem. Former Trump advisor Steve Bannon featured the biolab claims in an episode of his podcast, which was downloaded by at least 135 million users on Apple Podcasts. The story also spread widely within the QAnon community. Dougan’s 2021 investigation served as a primary source for these claims, lending a veneer of independent American verification to Russian state propaganda.
The records show that Dougan’s moment of perceived triumph came in June 2026, when Tulsi Gabbard, serving as Director of National Intelligence in the Trump administration, endorsed the biolab claims. On June 30, 2026, Gabbard “declassified” a map of supposed U.S. biolabs that placed Crimea and Kyiv next to Odesa, a geographically dubious arrangement. Days later, she resigned from her post, citing her husband’s serious illness. The endorsement by a U.S. intelligence official, however brief, validated Dougan’s years of work and reinforced his status as a key “source” for these narratives.
Beyond propaganda, Dougan was tasked with military applications of his expertise. In March 2022, Khoroshenky instructed Dougan to create a presentation on the use of U.S. Javelin anti-tank missile systems, which had been sent to Ukraine in large numbers. Dougan replied that he had completed the presentation, extracting key information from a 230-page instruction manual to allow Russian troops to learn the weapon within four hours. He expressed eagerness to travel to the front lines to teach Russian forces, stating, “I need to help fight the Ukrainians. I’ve seen what they did to our beautiful Russian boys, and I want to destroy as many as possible.”
Despite his enthusiasm, Dougan’s trip to the front was repeatedly delayed. He eventually accepted a role focused on cyber operations and press tours rather than direct combat instruction. He joined a Defense Ministry press tour to the Donbas, bringing along a translator, Maria Lelyanova, whom he introduced as a former “fierce liberal” who had changed her views after visiting the region. These tours served to legitimize Russian narratives by showcasing foreign visitors who appeared to endorse Moscow’s position.
The Storm-1516 Campaign and Fake News Infrastructure
Dougan’s activities in disinformation were not limited to amplifying existing narratives. The documents reveal his involvement in the creation of inauthentic media sites, specifically the Storm-1516 campaign. Researchers at Clemson University, NewsGuard, and Insikt Group had previously identified Dougan as the operator behind a network of hundreds of fake news outlets. These sites, purportedly based in small U.S. cities or European capitals, were populated with content generated by artificial intelligence and aggregated from sources like RT.
In 2018, Dougan published his autobiography, *BadVolf: The true story of an American cop’s retaliation against a corrupt system of justice and politics*, in which he detailed his methods. He described building websites that mixed genuine news stories with fabricated content to create a credible appearance. “An authentic-looking news site needs a dose of reality,” he wrote. “Truth laced with lies, facts intertwined with fiction.” He claimed to have operated as a “phantom,” using disinformation, doxing, and hacking to fight against what he described as a corrupt U.S. justice system.
The hacked messages provide concrete examples of this operation. In September 2024, Dougan coordinated with his assistant, Demid Vakhitov, to create a fake story about a Lithuanian exchange student who had attended a school in Mankato, Minnesota, where Vice Presidential candidate Tim Walz had previously taught. Dougan instructed Vakhitov to edit photographs of exchange student paperwork to show a “school kid from Lithuania that went to Waltz school.” He then messaged far-right conspiracy theorist Zak Paine, known as Redpill78, with a fabricated account of Walz allegedly making inappropriate advances toward a student. Dougan added graphic, pornographic details to the story, concluding with the claim that Walz was a pedophile. This fabrication was part of a broader effort to discredit political opponents using false personal narratives.
In 2026, The Insider gained access to the Storm-1516 control panel, which Dougan referred to as “DarkPulsar.” The infrastructure for this network was located in a small Moscow apartment. Despite the public attribution of these sites to him by researchers, Dougan denied involvement, even as he shared links to investigations exposing the network with friends, commenting with brief expletives. The documents confirm that the network was a significant component of Russian disinformation efforts, designed to sow confusion and distrust in Western media ecosystems.
Decline, Disillusionment, and Censorship
By 2026, Dougan’s standing in Russia had significantly deteriorated. Once a fixture on propaganda television and a self-styled “keeper of compromising material on U.S. authorities,” he became a largely forgotten and financially struggling figure. The messages show him complaining about meager earnings and the difficulty of meeting Russian residency requirements. In July 2022, he stood for three hours at the Sakharovo migration center to file documents for a residence permit, needing to prove he had 165,000 rubles in a Sberbank account. He did not have this money; his friend “oligarch Igor” had sent him 70,000 rubles just to show the authorities a bank statement.
Dougan’s frustration with the Russian government intensified as internet censorship tightened. In March 2026, after the communications regulator Roskomnadzor began blocking Telegram and restricting VPN services, Dougan expressed anger in chats with friends. “Whatever these stupid bastards in the Russian government are doing right now to block the internet, if they keep this up, it will shut us off completely,” he wrote. He threatened to start a campaign to turn the public against Roskomnadzor, claiming their policies were “getting people killed.” Valery Korovin, a close associate of Alexander Dugin, attempted to dissuade him, warning that it was not worth moving to Russia “just to end up in prison.”
Dougan’s relationships within the Russian expatriate community also strained. He became convinced that his close friend, former British Army serviceman Mike Jones, had leaked information about his activities to Western journalists. This suspicion was triggered by an October 2024 Washington Post article about his cooperation with the GRU. Dougan sent the article to all his contacts and considered suing Jones. His anger reflected a sense of betrayal, as well as a growing awareness that his activities were under scrutiny.
The documents also reveal Dougan’s interactions with FSB officers, including Vladislav Yevsyukov of Directorate K and Yevgeny Firsov of Directorate M. He helped these officers establish contact with a Swedish source recruited by Ben Stimson, another Briton who had fled to Russia. Dougan also made requests of his handlers, asking them to intervene on behalf of a troll factory manager who had previously financed his activities. These interactions show that Dougan was integrated into multiple Russian security services, not just the GRU, and that his role involved facilitating contacts and information exchange between these agencies and foreign assets.
Implications for Disinformation Studies
The hacked correspondence offers a rare, granular look at the operational mechanics of Russian disinformation campaigns. It shows how a single individual, with limited resources but specific skills and access, can be leveraged to amplify state narratives and generate fake content at scale. Dougan’s case illustrates the blurring of lines between independent actors and state-directed operations, as his personal grievances and ideological alignments were exploited to serve Russian strategic interests.
The documents also highlight the importance of financial trails in identifying disinformation networks. Dougan’s role as a financial cutout for the GRU demonstrates how intelligence services use domestic agents to obscure funding sources. The use of small, seemingly insignificant transfers, combined with the complexity of international banking systems, makes it difficult for Western investigators to trace the full extent of Russian influence operations.
Furthermore, the case underscores the persistence of false narratives even after their originators lose status. The biolab claims, initially promoted by Dougan and the Russian Defense Ministry, gained new legitimacy when endorsed by a U.S. intelligence official in 2026. This shows how disinformation can evolve and resurface, taking on new life through unexpected channels. The endorsement by Director of National Intelligence Tulsi Gabbard, even if brief, provided a significant boost to the credibility of these claims in certain segments of the U.S. public.
The decline of Dougan’s influence also reflects the changing dynamics within the Russian propaganda ecosystem. As the war in Ukraine continued, the Kremlin’s focus shifted toward more direct military and economic pressures, and the need for charismatic foreign figures like Dougan diminished. His frustration with censorship and financial neglect suggests that the relationship between the Kremlin and its foreign assets is transactional and fragile, dependent on continued utility and compliance.
The documents do not provide a complete picture of Dougan’s activities, but they offer a detailed snapshot of his role in the years leading up to 2026. They show a man who was both a victim of his own actions and a willing participant in a larger system of disinformation. His story is a reminder that the fight against disinformation requires not only identifying the sources of false information but also understanding the human elements that drive its creation and spread.
The hacked messages will likely be cited in future investigations into Russian influence operations. They provide concrete evidence of coordination between GRU officers and a U.S. citizen, as well as details on the production of fake news content. For researchers and policymakers, the archive is a valuable resource for understanding the tools and tactics used by state actors to manipulate public opinion in foreign countries.
Dougan’s current status remains unclear. The last messages in the archive show him still in Russia, struggling with financial and legal issues, and increasingly isolated from the centers of power that once supported him. His threat to “rise up” against censorship was not followed by any recorded action. The documents end with him still attempting to sell his services to security officials who had grown tired of him, a poignant end to a career that had once promised significant influence.
The case of John Mark Dougan highlights the complex interplay between individual agency and state direction in the realm of disinformation. It shows how personal grievances can be harnessed for geopolitical ends, and how the tools of propaganda can be repurposed to serve multiple agendas. The documents serve as a cautionary tale about the vulnerabilities of information ecosystems to manipulation, and the importance of maintaining robust defenses against such threats.
As the U.S. and its allies continue to grapple with the challenges of disinformation, the Dougan files offer a detailed case study in how these operations are conducted on the ground. They reveal the human faces behind the algorithms and the financial networks that sustain them. Understanding these details is crucial for developing effective countermeasures and for holding those responsible for spreading false information accountable.
The records also shed light on the internal dynamics of Russian intelligence services, showing how different agencies, such as the GRU and FSB, coordinate their activities. The involvement of multiple handlers and the use of various fronts, including the Center for Geopolitical Expertise, demonstrate the sophistication and reach of Russian influence operations. The documents provide insight into the methods used to recruit and manage foreign assets, and the incentives and pressures that drive their actions.
In the end, the hacked correspondence of John Mark Dougan is a document of significant historical and investigative value. It captures a moment in time when a former U.S. law enforcement officer became a key player in Russian disinformation, and then watched as his influence waned. The story is a testament to the resilience of false narratives and the challenges of combating them in an increasingly complex information environment.
Sources
Photo: Ruphotog (CC BY-SA 4.0)
