Russia's state TV network hid $9.7 million behind fake invoices for iPhones to pay a Tennessee company and the creators it hired. It's the clearest foreign money trail on record. It isn't the only one. And in 2025, Washington shut down most of the offices that watched for it.
By Joseph J. Jackson | FMNN Investigates: National (Nov. 12, 2026)
Part 3 of 6. Read Part 1: The Price List. Part 2: The Gap.
How to read this series: under current U.S. law, being paid to post political content is not treason, terrorism or sedition. This series does not call any named person a traitor or a terrorist. Where this story says "Israel," it means Israel's government or its Diaspora Affairs Ministry, never Jews. Where an outlet relied on unnamed sources, the claim is credited to that outlet, and the denial follows.
The short version
Russia paid American creators through a front. The Justice Department says RT wired about $9.7 million to a Tennessee company through shell firms in Turkey, the UAE and Mauritius. The commentators it paid weren't charged; prosecutors say they didn't know.
It kept going in 2026. Researchers tied fake videos attacking Democratic Senate candidates James Talarico and Sherrod Brown to a Russian network called Storm-1516. One drew about 857,000 views in a day.
China and Iran ran fakes too. Chinese-linked accounts posed as American voters days before the midterms. Iranian-linked accounts drew enormous audiences during the war, though tying the biggest hits to Tehran is uncertain.
An ally paid as well. The New York Times reported in 2024 that Israel's Diaspora Affairs Ministry paid about $2 million for fake accounts aimed at members of Congress. The ministry denies it.
Washington stopped watching. Within eight months in 2025, the FBI task force, the State Department office and most of the intelligence center that tracked foreign influence were closed or cut. In 2026, private researchers, not the government, named the operations in public.
The clearest money trail on record
From October 2023 to August 2024, RT, Russia's state-run media network, wired about $9.7 million to Tenet Media, a small company in Tennessee, according to a federal indictment. The money moved through shell companies in Turkey, the United Arab Emirates and Mauritius, and it made up nearly 90% of the company's bank deposits, the Justice Department said.
The wires were dressed up as trade. One, for $318,800, carried the memo "BUYING GOODS-INV.013-IPHONE 15 PRO MAX 512GB," according to the indictment. Tenet's founders told the talent they hired that a private investor named "Eduard Grigoriann" was paying the bills. Prosecutors say he didn't exist.
About $8.7 million went on to the production companies of three right-wing commentators, CBS News reported, and one had a contract worth $400,000 a month. Tenet posted nearly 2,000 videos that drew more than 16 million views on YouTube.
None of the commentators was charged. The Justice Department's own filing says they didn't know Russia was behind the money, and Tim Pool and Benny Johnson have said they were deceived. The two RT employees who were charged, Kostiantyn Kalashnikov and Elena Afanasyeva, are still at large.
One more detail matters for the money side of this series. Offshore wires, labeled as phone purchases, making up nine-tenths of a small U.S. company's deposits for ten months, are the pattern bank anti-money-laundering systems exist to catch. Whether any bank flagged them is unknown. Those reports are confidential by law.
In 2024, the government moved before Election Day. About two months out, prosecutors charged the RT employees and seized 32 web domains used by a separate Russian operation called Doppelganger.
2026: The same playbook, new fakes
In the last weeks of this fall's midterms, fake videos accused Talarico, the Texas Democrat, and Brown, the Ohio Democrat, of sexual assault. Researchers at Clemson University, Graphika, Alethea and NewsGuard tied them to Storm-1516, a Russian network known for staging fake videos and laundering them through big influencer accounts. A Dartmouth expert said the videos were likely made or altered with AI.
The route is the part that connects to this series. NPR reported that one fake was first shared by 15 accounts researchers flagged as bots. About 12 hours later, three large X accounts that had spread earlier Storm-1516 material posted it. One of them had advertised for paid partnerships on X. That video reached about 857,000 views within 24 hours, according to the firm Alethea. X later removed the first accounts.
A second Kremlin-linked network, which researchers call Operation Overload or Matryoshka, posted AI videos dressed up as reports from CNN, the BBC and The New York Times, attacking Democratic Senate candidates in at least nine states, the Times reported in September.
U.S. officials told the Times that classified assessments found Moscow had again authorized a covert campaign to undermine confidence in the midterms, though it looked less extensive than past efforts, and that there was no sign of any attempt to tamper with voting machines. Rep. Jim Himes, the top Democrat on the House Intelligence Committee, said the same about the mechanics of voting. The Russian Embassy didn't respond to reporters. It has denied interfering in past elections.
Clemson's Darren Linvill, who tracks the network, put its goal plainly to NPR: "It is hard to persuade anybody of anything, ever." What the fakes can do, he said, is reinforce what people already believe.
China: Fake voters, few real fans
On Oct. 30, four days before the election, Graphika reported that accounts tied to China's long-running Spamouflage network were posing as American voters on X, including MAGA-styled personas, and posting content questioning election integrity and the legitimacy of U.S. democracy, the Associated Press reported.
Linvill said the network is bad at sounding like real Americans and gets little real engagement. Its sharper edge, he said, is harassing members of the Chinese diaspora. China says it does not interfere in U.S. elections. U.S. officials told the Times that Beijing has been more cautious than Russia or Iran, partly for fear of getting caught.
Iran: A war, and a billion views
Iran's operations grew with the war that began after the U.S.-Israeli strikes in late February. In a July report, the threat-intelligence firm Recorded Future cited research finding that 47 fake accounts drew more than 40 million views of AI-made videos showing U.S. military funerals and grieving families, and that Iranian diplomatic meme accounts drew nearly 1 billion views in 50 days, about 30 times their prewar pace.
Recorded Future was careful about who made what. The strongest documented links are Iranian state outlets publishing and boosting the content, it said, and pinning the most viral videos on the Iranian state is still uncertain.
There's a Florida angle. The same report notes that a hacker group claimed to have disrupted the South Florida Regional Transportation Authority, which runs Tri-Rail, earlier in the conflict. The report doesn't treat that claim as confirmed.
Israel's government: Fake accounts aimed at Congress
In June 2024, The New York Times reported that Israel's Ministry of Diaspora Affairs set aside about $2 million for a campaign run by Stoic, a political marketing firm in Tel Aviv. At its peak, the Times reported, the campaign used hundreds of fake accounts posing as Americans on X, Facebook and Instagram, urging more than a dozen members of Congress, many of them Black Democrats, including Rep. Hakeem Jeffries and Sen. Raphael Warnock, to keep funding Israel's military. Meta and OpenAI had already traced the activity to Stoic and said it had little real reach.
The ministry denied it. A spokesman told JNS the ministry "does not engage in disinformation campaigns" and has no connection to Stoic. The Times based its report on documents and four current and former ministry officials.
Separately, The Wall Street Journal reported that Israel's government paid $900,000 through a firm called Bridges Partners for a creator effort it called the "Esther Project," which registered under the Foreign Agents Registration Act in September 2025. That's the version of this the law is built for: a foreign government paying for influence, on file, where anyone can look it up.
A note on AIPAC: it's an American lobbying group, not a foreign government, and its spending is covered in other FMNN stories. It isn't part of this one.
What Washington stopped watching
Part 2 laid out how quickly the federal watchers were taken apart. Here's the timeline:
Feb. 5, 2025: Attorney General Pam Bondi disbanded the FBI's Foreign Influence Task Force and limited criminal cases under the foreign-agent law to conduct resembling spying.
February 2025: 17 election-security staff at the Cybersecurity and Infrastructure Security Agency, or CISA, were put on leave.
April 16, 2025: Secretary of State Marco Rubio closed the State Department office that tracked foreign disinformation, saying it had worked to "silence and censor" Americans.
Aug. 20, 2025: The intelligence community's Foreign Malign Influence Center was "reduced and absorbed." A 2019 law bars closing it before 2028.
Mid-2025: About 1,000 CISA employees, roughly a third of the agency, were gone.
Latest budget request: The administration proposed eliminating CISA's election-security funding, with the Homeland Security Department saying CISA had been "focused on censorship."
The administration's case is that these offices were used against Americans' speech. Former officials say they tracked foreign governments. Either way, the effect showed up this fall. The Storm-1516 videos were attributed in public by private researchers. When the AP asked CISA about them, it didn't answer. FMNN found no public federal statement naming the operation.
In July, President Trump gave a prime-time address alleging a years-long "cover-up" about foreign influence and ordered a task force to declassify records. The Times reported the heavily redacted files showed no evidence that any foreign government had changed votes.
Enforcement didn't vanish. It moved. A September 2025 presidential memo, NSPM-7, told terrorism task forces to pursue foreign-agent and money-laundering cases against nonprofits and Americans with foreign ties, the law firm Mayer Brown wrote. Critics say that points the tool at domestic groups instead of foreign governments.
The Florida bill already on the table
Rep. Anna Paulina Luna, the Pinellas Republican, filed the Foreign Propaganda Disclosure Act on Aug. 24. It would add creators with monetized accounts to the foreign-agent law's definition of a "publicity agent," so a creator paid by a foreign government would have to register and label the content. Her co-leads include Rep. Jared Moskowitz, a South Florida Democrat, and Rep. Vicente Gonzalez of Texas. It hasn't had a vote.
It's a real fix with a real limit. The foreign-agent law already reaches some of this, lawyers at Paul Hastings noted, and the bill makes it explicit. But Tenet shows the harder problem: the commentators didn't know who was paying. A registration rule only works if someone in the chain knows the money is foreign. That's why the money trail, and the people who used to follow it, matter as much as the label.
What critics say
"Foreign influence" gets used to smear domestic speech. The administration says the closed offices pressured platforms over Americans' posts. Critics of the new NSPM-7 approach raise the same worry from the other direction. Both concerns point to narrow disclosure rules, not vague ones.
The reach is small. Linvill says Spamouflage has no chance of tipping an election, and officials say no one touched the vote count. That's fair. The story here is the method: foreign governments now use the same agencies, shell companies and creator accounts that domestic buyers use.
An ally isn't an adversary. Israel's government denies the Stoic campaign, and the Esther Project registered. FMNN's view: a disclosure rule shouldn't depend on whether the government paying is a friend.
The method is the story
Lisa Kaplan, who runs Alethea, told NPR that Russia operates like a "dark money PAC." That's the thread through all three parts so far. The same pipe carries a domestic super PAC's money and a foreign ministry's: an agency, an LLC, an account with a big following and no label.
The fix for the foreign side is the fix from Part 2, plus one more: a rule that makes the government tell the public, fast, when it finds a foreign operation aimed at an election. A bipartisan Senate Intelligence Committee report recommended exactly that in 2020. Congress never wrote it into law.
Coming next in this series
Part 4: The Megaphone Owners. Who owns the platforms and stations, and how "money is speech" changed who gets heard.
Part 5: Opinion | This Is a War. The front line is your phone, and the decade Washington could have had.
Part 6: The Hate Is the Product. How bigotry became America's domestic propaganda.
Sources
U.S. Department of Justice, two RT employees indicted (Sept. 2024) — https://www.justice.gov/archives/opa/pr/two-rt-employees-indicted-covertly-funding-and-directing-us-company-published-thousands
CBS News, Tenet Media and the commentators — https://cbsnews.com/news/russia-tenet-media-right-wing-influencers-justice-department
The Hacker News, Doppelganger domain seizures and Tenet's reach — https://thehackernews.com/2024/09/us-seizes-32-pro-russian-propaganda.html?m=0
NPR via Alaska Public Media, Russia steps up election influence efforts (Oct. 26, 2026) — https://alaskapublic.org/news/national/2026-10-26/russia-steps-up-election-influence-efforts-in-final-stretch-of-midterms
AP via MPR News, disinformation videos likely from Russia (Oct. 28, 2026) — https://www.mprnews.org/story/2026/10/28/disinformation-videos-likely-from-russia-exploiting-real-people-to-malign-senate-candidates
The New York Times via Hawaii Tribune-Herald, Russia aims to inject chaos into elections (Sept. 2026) — https://www.hawaiitribune-herald.com/?p=378016
AP via The Atlanta Journal-Constitution, Graphika finds China-linked Spamouflage accounts (Oct. 30, 2026) — https://www.ajc.com/news/2026/10/graphika-finds-china-linked-spamouflage-accounts-posing-as-us-voters-on-x/
Recorded Future, AI has enhanced Iran's asymmetric playbook (July 16, 2026) — https://www.recordedfuture.com/research/iran-ai-asymmetric-playbook
The New York Times via Honolulu Star-Advertiser, Israel's covert influence campaign (June 2024) — https://staradvertiser.com/?p=1328936
JNS, Diaspora Affairs Ministry denial — https://www.jns.org/jlem-pans-nyt-story-accusing-it-of-covert-campaign-to-influence-congress/
The Wall Street Journal via iTiger, political influencer payments and the Esther Project (Jan. 2026) — https://www.itiger.com/news/2602612665
CBS News, election security cuts at CISA, DOJ and FBI — https://www.cbsnews.com/news/trump-election-security-cisa-justice-department-fbi-federal-worker-cuts/
Times of Israel, Rubio closes the State Department's foreign disinformation office — https://www.timesofisrael.com/rubio-shutters-office-that-tracks-disinformation-from-iran-russia-and-china/
Defense One, ODNI reorganization — https://www.defenseone.com/policy/2025/08/odni-shrink-further-under-new-reorganization-plan/407618/
Just Security, dismantling the Foreign Malign Influence Center — https://www.justsecurity.org/119653/wjh-dismantling-foreign-malign-influence-center/
Defense One, CISA election security funding (May 2026) — https://www.defenseone.com/threats/2026/05/cisa-election-security-vulnerable/413410/
Mayer Brown, FARA enforcement in 2025 and NSPM-7 — https://www.mayerbrown.com/fr/insights/publications/2026/01/fara-enforcement-in-2025-from-the-bondi-memo-and-nspm-7-to-case-resolutions-and-quieter-administrative-developments
Rep. Anna Paulina Luna, Foreign Propaganda Disclosure Act (Aug. 24, 2026) — https://luna.house.gov/posts/rep-anna-paulina-luna-introduces-bipartisan-bill-requiring-influencers-to-disclose-payments-by-foreign-governments
Paul Hastings, new bill puts influencers in FARA focus — https://www.paulhastings.com/insights/client-alerts/new-bipartisan-bill-puts-social-media-influencers-in-fara-focus
Sen. Angus King, Senate Intelligence Committee report on the 2016 response (Feb. 2020) — https://www.king.senate.gov/newsroom/press-releases/senate-intel-releases-bipartisan-report-on-obama-administrations-response-to-russian-election-interference
Photo: The Robert F. Kennedy Department of Justice Building in Washington. Gunnar Klack via Wikimedia Commons, CC BY-SA 4.0.
