CopyCop Disinformation Network Expands Operations, Targets Western Democracies and Ukraine
A sophisticated Russian covert influence operation known as CopyCop (also designated Storm-1516) has dramatically escalated its disinformation activities, creating over 200 fake websites since March 2025. This expansion brings the network’s total fabricated media outlets to over 300, marking the largest documented growth of its infrastructure to date. Intelligence analysis reveals that CopyCop, led by US citizen John Mark Dougan based in Moscow, operates with support from the Center for Geopolitical Expertise (CGE) and Russia’s military intelligence agency, the GRU. These links have been corroborated by multiple intelligence agencies and the US Department of Treasury.
CopyCop’s primary targets include the United States, France, and Canada, with France bearing the brunt of the campaign, facing 141 new fake websites. The network impersonates local news outlets, political parties, and even fact-checking organizations, publishing content in languages previously unused by the group, such as Turkish, Ukrainian, and Swahili. The operation’s objectives are to undermine international support for Ukraine and exacerbate political divisions within Western nations backing Kyiv.
This expansion leverages advanced technologies, including self-hosted, uncensored large language models based on Meta’s Llama 3 open-source technology. This capability allows CopyCop to autonomously generate massive quantities of seemingly professional content without relying on Western AI service providers, thereby reducing detection risks and advancing pro-Russian and anti-Ukrainian narratives across diverse languages and regional contexts. This technological advancement marks a significant evolution in the group’s capabilities and underscores the growing sophistication of state-sponsored disinformation campaigns.
CopyCop’s disinformation campaign utilizes various tactics to achieve its objectives. In the United States, the network publishes fabricated “investigations” alleging Ukrainian President Volodymyr Zelenskyy’s misappropriation of American taxpayer funds and claiming Ukraine’s secret supply of weapons to Mexican drug cartels. These narratives exploit domestic political tensions regarding immigration and foreign aid. Furthermore, the network aims to create rifts between strategic allies, targeting, for example, the growing relationship between France and Armenia through deepfake videos and fabricated claims of misuse of French foreign aid.
The network’s reach extends beyond major Western nations, targeting smaller strategic countries ahead of critical elections. In Moldova, for instance, CopyCop has established websites alleging systematic electoral fraud by President Maia Sandu’s administration, aiming to influence the upcoming parliamentary elections. The creation of the “Truefact” network, comprised of nine subdomains impersonating a fictional fact-checking organization, further demonstrates CopyCop’s expanding global ambitions and technical capabilities. This marks the first time the network has linked its websites to active social media campaigns, signifying a notable tactical evolution.
CopyCop amplifies its disinformation through a coordinated network of sympathetic social media influencers and other Russian disinformation operations, including Portal Kombat and InfoDefense. The high-engagement content produced by the network has successfully infiltrated mainstream political discourse in target countries. This systematic approach, combining AI-generated content with targeted influence operations, exemplifies the evolving landscape of state-sponsored disinformation in the digital age. The continuous expansion and increasing sophistication of CopyCop’s activities highlight the persistent threat Russian influence networks pose to democratic institutions and international solidarity with Ukraine. Intelligence officials stress the importance of identifying and exposing these networks to safeguard democratic processes from foreign manipulation. The ongoing challenge for democracies lies in effectively countering these sophisticated and evolving disinformation campaigns. Vigilance, media literacy, and proactive exposure of such operations remain crucial in safeguarding democratic integrity.