Information War Weekly Roundup: Russian Fakes, Binance

This information war weekly roundup covers the seven Information War daily reports Peter’s World published from Oct. 26 to Nov. 1, 2026. It leads with media lies and state propaganda, then cyber. Each fact appears once, with its source, and the full daily list is at the end.

The week in brief

Russia: three elections at once, and fake newscasts

A Russian influence operation known as Doppelgänger targeted voters in Israel, the United States and France at the same time, with about 150,000 posts in three days, the intelligence firm Alethea found, IsraelDefense reported. Before Israel’s Oct. 27 vote, Israeli police removed two election networks on X and Facebook, Ynet reported.

In the United States, a fake Cleveland television report accused Ohio Senate candidate Sherrod Brown of assaulting four former staffers, and NewsGuard linked the video to Russia’s Storm-1516 operation, according to NewsGuard. A former Brown intern pictured in the video called the claim “completely false,” IBTimes reported. Lead Stories found that a video carrying a FOCUS Online logo, which said a German law would limit people to three toilet flushes a day, was never reported by FOCUS Online, used AI-generated audio and appears to be part of Storm-1516, according to Lead Stories. The EU’s disinformation monitor said the Kremlin’s denial that Russia holds political prisoners is contradicted by 1,825 cases documented by the rights group Memorial, EUvsDisinfo said.

Iran: unproven claims and a stated aim

Iranian officials told The Telegraph that Tehran is preparing to disrupt the US midterm elections, a claim no government has confirmed, Iran International reported. Iran’s Revolutionary Guards claimed a second captured US drone near Qeshm Island, Anadolu Agency reported; US Central Command had dismissed the first claim, and no evidence for the second was published. Iran’s Mehr news agency headlined US jets striking Syria’s Homs, though the report it relayed described the aircraft as unidentified, per Mehr’s own story. Mehr also tied a Dammam fire to a Yemeni attack that Saudi authorities had not confirmed, in a separate Mehr report.

Elections in the Americas

President Trump said Brazil’s runoff looked like “another rigged election” without giving evidence, the BBC reported. After leaving Brazil, Flávio Bolsonaro called himself “president-elect” and alleged fraud without evidence, then changed the wording, g1 reported. A viral post claiming Trump walked an elderly woman home after an Iowa rally used an AI-generated image, Lead Stories found.

China, Israel and Australia

Taiwan rejected China’s account of a new coast guard patrol east of the island as routine law enforcement and said Beijing was harassing shipping, the Japan Times reported. Fact-checkers found that Gadi Eisenkot had not been declared Israel’s prime minister, despite viral posts saying so, Lead Stories reported. Facebook pages run from Vietnam spread a fabricated quote about Australian senator Pauline Hanson’s health, the AAP fact-check team found.

Cyber: the Binance theft and new hacking campaigns

Hackers stole about $6.3 billion from the Binance exchange on Oct. 29, likely the largest crypto theft ever, The Record reported. The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets, naming its TraderTraitor operation, Yonhap reported. Cisco researchers said a newly identified hacking group is stealing encryption keys from network controllers at satellite, defense and policy organizations, BleepingComputer reported.

US prosecutors charged six Madagascar-based suspects over a dating-site scam that hit about 800 American victims and sent stolen crypto to China-linked accounts, the Secret Service said. The Cybersecurity and Infrastructure Security Agency added exploited flaws to its must-patch catalog on at least four days this week, including two Ivanti flaws on Oct. 30, according to a CISA alert.

What changed this week

Analysis (Peter’s World’s view): Election lies moved from one-off fakes to campaigns running in several countries at once. Doppelgänger hit three electorates in the same days, and Storm-1516 used the same method, a fake local news report, in Ohio and in Germany. Iran’s information operations stayed focused on its war, through drone claims and headlines that went further than their own sources.

Why it matters

Analysis (Peter’s World’s view): With the US midterms on Nov. 3, fake local news videos are the format to watch, because they borrow the trust people place in a familiar station or outlet. A statement by Iranian officials about disrupting the vote, even unconfirmed, raises the stakes. On the cyber side, North Korea’s Binance theft shows state hackers can raise billions in a single attack, money that sanctions are meant to deny.

What to watch next week

Nov. 3: fake videos, forged messages and “rigged” claims around the US midterms.
Any official US statement on Iranian election interference.
Whether Iran publishes evidence for its drone claims.
Where the stolen Binance funds move, and whether exchanges freeze them.
New Storm-1516 fakes aimed at European audiences.

This week’s daily reports

For every report in this theater, see the Information War news hub or the War Room dashboard.

Sources

Additional sources

CISA: CISA adds two known exploited vulnerabilities to catalog, Oct. 27
U.S. Department of War: What’s in a name: “War” sends clarifying message to adversaries
Foundation for Defense of Democracies: Russian operatives plant deepfake targeting US midterm elections
Iran International: Fired US general admitted leaking classified information on Iran
BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
The Japan Times: GMO asks government for active cyber defense

Information War Weekly Roundup: Doppelgänger, Storm-1516, Binance

The week in brief