Cyprus: Anatomy of a Disinformation Campaign

A malicious video targeting Cyprus’s president reveals the sophisticated playbook of foreign information warfare – and why it threatens democracies everywhere

On January 8, 2026, an 8½-minute video appeared on X (formerly Twitter) that would shake Cyprus to its core. Posted by an account calling itself an “independent analyst,” the footage purported to show close associates of President Nikos Christodoulides discussing covert campaign donations, influence-peddling, and, most explosively, willingness to help Russian oligarchs evade EU sanctions in exchange for corporate payments.

The timing was surgical. Just one day earlier, Cyprus had assumed the rotating EU Council Presidency, with Ukraine’s President Volodymyr Zelenskyy attending the opening ceremony in Nicosia. Within hours, what should have been Cyprus’s moment of international prominence became a domestic political firestorm.

But as Cypriot authorities quickly determined, the video bore “all the hallmarks” of an organized foreign disinformation campaign, specifically mirroring past Russian “kompromat” operations designed to discredit public figures through leaked or manipulated media. The case offers a textbook study in how hostile actors weaponize information to destabilize democracies, regardless of whether the underlying allegations contain any truth.

The Video and Its Claims

The edited video compilation presented hidden-camera footage of apparent private meetings between individuals posing as foreign investors and three Cypriot figures: the President’s brother-in-law and chief of staff, Charalambos Charalambous; former Energy Minister Giorgos Lakkotrypis; and prominent construction executive Giorgos Chrysochos.

In spliced clips, the Cypriot interlocutors appeared to discuss channeling donations through a charity run by the First Lady, circumventing campaign finance limits using cash, and leveraging access to the President for potential investors. One figure was shown remarking that “sometimes you have to rely on cash” to exceed legal donation caps.

By late evening on January 8, the post had received tens of thousands of views. Local news outlets began reporting on an “explosive” video alleging a cash-for-access scheme reaching into the Presidential Palace. The following morning, Cyprus woke to headlines about a “political storm” and a “secret cash network” around the President.

Swift Denials, Deeper Questions

The Cypriot government moved immediately into damage control. Government Spokesman Constantinos Letymbiotis publicly condemned the video as “a collection of lies, deceptions and unfounded claims” calculated to tarnish the country. President Christodoulides denied all wrongdoing and challenged anyone with evidence of illicit financing to “bring it to the authorities.”

Opposition parties, however, seized on the content. The communist-rooted AKEL party’s leader called for immediate resignations pending investigation. The Speaker of Parliament stated her hope that “the footage does not reflect reality” but insisted on swift action to uncover the truth.

By midday January 9, Cyprus’s law enforcement and intelligence agencies announced a formal investigation examining two facets: whether crimes were committed in making and distributing the video, and whether its content revealed actual corruption offenses warranting prosecution. Notably, forensic analysts found no evidence of deepfake technology – the faces and voices appeared real – but detected heavy editing and splicing throughout.

The Phantom Analyst

The video was posted by an account under the name “Emily Thompson” (@EmilyTanalyst), claiming to belong to a UK-based “independent analyst.” Upon scrutiny, the profile raised multiple red flags.

According to the Fact Check Cyprus Centre at Cyprus University of Technology, the account was created in 2022 but showed little activity until recently. Crucially, it obtained a verification badge on X only in December 2025 – just weeks before the video’s release which is something users can purchase and sign up to it. Researchers found “no public or verifiable information” about any real Emily Thompson matching this profile.

The video was not released through any recognized media organization or whistleblower platform. There was no attempt to solicit comment from those implicated – a standard journalistic practice – nor any accompanying documentation. By bypassing traditional media gatekeepers, the perpetrators ensured the claims would hit the public unfiltered and unchallenged.

Two Years in the Making

Perhaps most revealing was what emerged about the operation’s genesis. Reporting by Politis, a leading Cypriot daily, indicated the sting had been nearly two years in the making. Individuals masquerading as wealthy investors from a Dutch firm called “Stratix Wealth” began approaching former Minister Lakkotrypis as far back as 2024, cultivating a business relationship and even hiring him as a paid consultant.

They held multiple meetings in European cities – London, Amsterdam – always in informal settings like hotels. These faux investors eventually gained enough trust to have private discussions, which were secretly recorded. Once the edited footage was released publicly, the operatives and their front company vanished: websites deleted, email contacts disconnected, digital traces wiped clean within hours.

This “disappearing act” strongly indicated a covert intelligence operation rather than legitimate whistleblowing. Genuine journalists do not typically erase their identities after publishing a story.

The Russian Connection

By Friday evening, January 9, Cyprus’s intelligence services had leaked an early assessment to the Associated Press: the video “exhibits the characteristics of organized Russian disinformation campaigns,” closely resembling a known 2021 hybrid operation against Western countries.

The style was likened to Russia’s “Doppelganger” campaign, a coordinated disinformation network active since 2021 that has previously targeted France, Germany, the United States, and Israel – often by releasing compromising material to sow chaos. The report noted that through selective editing and voice-over narration, the video provided no “tangible evidence” of corruption claims – a hallmark of classic kompromat tactics.

However, officials carefully noted that “another actor using similar methodology” could be at work. Intriguingly, cybersecurity analysts discovered that parts of the video’s on-screen text used characters unique to the Turkish alphabet – such as the dotted/undotted “i” and “ş” – even in English words. This could indicate the video was produced on a Turkish-language keyboard, or represent a deliberate false-flag planted to mislead investigators.

Strategic Timing

The operation’s timing was far from coincidental. Since his 2023 election, President Christodoulides had positioned Cyprus as “solidly pro-Western,” staunchly supporting Ukraine, enforcing EU sanctions on Russia, and deepening defense ties with the United States. This pivot may have antagonized Moscow.

The leaked video struck directly at this geopolitical shift: its most explosive allegation – that Cypriot officials would undermine EU sanctions on Russian oligarchs for cash – would, if believed, cast doubt on Cyprus’s loyalty to EU policy and tarnish its pro-Ukraine stance. Around the same time, senior U.S. officials were arriving in Cyprus to discuss expanded use of a Cypriot airbase by American forces.

Additionally, Cyprus is facing parliamentary elections scheduled for May 2026, just four months away. The timing ensures the allegations would potentially dominate the campaign season.

Cross-Border Amplification

The video’s spread revealed a multi-layered amplification ecosystem. Within hours, a cross-platform cascade was underway spanning multiple languages: Greek, English, Turkish, Russian, and Arabic.

Researchers observed that many newly created or low-follower accounts were among the early amplifiers, often with profile traits resembling bots – generic names, few original posts, disproportionate focus on political scandals. Turkish media reported on “bribery in South Cyprus” while Russian-state-affiliated outlets dismissed Cypriot accusations as baseless. Pro-Kremlin Telegram channels circulated the story as proof that an EU leader was “exposed.”

This multi-lingual, multi-platform spread exemplifies how modern disinformation exploits the fragmented global media environment. The message mutated and found resonance in unexpected quarters, long after the initial leak.

Why This Matters – Even If True

One might ask: if the video’s allegations contained some truth, shouldn’t exposing corruption be a good thing? The answer lies in distinguishing legitimate accountability from malicious manipulation.

In a democracy, corruption allegations against high officials should be investigated through proper legal channels – audits, parliamentary inquiries, independent journalism, judicial proceedings. This operation delivered a verdict to the public without due process, acting as judge and jury in the court of public opinion.

If a foreign actor held genuine evidence of corruption for two years, releasing it only at a moment calculated for maximum political damage indicates the motive was exploitation, not accountability. The people of Cyprus were manipulated as pawns in someone else’s geopolitical game.

Moreover, the disinformation taint can actually impede justice: any real elements now risk being dismissed as “just part of the fake campaign.” Truth revealed in bad faith is not as cleansing as truth revealed in good faith.

The Broader Stakes

The strategic effects extended beyond Cyprus. The operation succeeded in throwing Cypriot politics into reactive crisis management, consuming government bandwidth in damage control rather than EU Presidency priorities. Trust in the administration took a measurable hit. Public discourse polarized between those convinced of deep rot and those dismissing everything as a foreign hoax.

For Cyprus’s Western partners, the incident raised uncomfortable questions. The allegation that Cypriot officials would help Russian oligarchs evade sanctions – even if fabricated – revived old stereotypes of Cyprus as a “weak link” on Russian money. An EU diplomat was quoted saying, “Whether it’s true or not, it’s an open joke now in Brussels corridors.”

The operation serves as a demonstration effect – a warning to other small states that crossing certain interests can bring political destabilization via invisible means. It validates the view that information warfare can achieve strategic objectives that once required more drastic measures.

A Warning for Democracies

The Cyprus affair demonstrates that the battle for democracy now extends to the information realm. A small democracy was targeted at a symbolic moment – and while it withstood the immediate storm, the lessons remain urgent.

For Israel, which has faced its own online influence operations, and for democracies everywhere, the incident offers a stark warning. Today’s disinformation in one country can be tomorrow’s problem in another. The tactics are transnational, the playbooks are being refined, and the targets are expanding.

What is at stake is not just one presidency or one country’s reputation, but the integrity of the information that underpins free choice and sovereignty in the modern world. The lesson from Cyprus is clear: whether a lie or an inconvenient truth, information weaponized through manipulation can destabilize a democracy. And so democracies must respond by strengthening their defences – not through censorship or counter-propaganda, but through transparency, media literacy, and the patient work of rebuilding public trust in truth itself.