The Russian covert influence network known as CopyCop has significantly expanded its disinformation operations, creating over 200 new fake websites since March 2025 to target audiences in the United States, France, and Canada.
Digital fingerprint over the Russian flag symbolizing Russian GRU cyber espionage and influence operations
This dramatic escalation represents the largest documented expansion of the network’s infrastructure to date, bringing its total number of fabricated media outlets to more than 300 websites established in 2025 alone.
Glitchy digital illustration of the phrase ‘Fake News’ amid encrypted code, symbolizing online disinformation and cyber influence operations
Intelligence analysis conducted by Insikt Group reveals that CopyCop, also designated as Storm-1516, has orchestrated an unprecedented expansion of its fake news ecosystem throughout 2025.
The network has created fictional media websites impersonating local news outlets across target countries, alongside websites masquerading as political parties and fact-checking organizations publishing content in previously unused languages including Turkish, Ukrainian, and Swahili.
The operation is attributed to John Mark Dougan, a US citizen based in Moscow, operating with support from the Moscow-based Center for Geopolitical Expertise (CGE) and Russia’s military intelligence agency, the GRU.
This attribution has been corroborated by multiple intelligence agencies and research organizations, including the US Department of Treasury, which has established direct links between Dougan, the CGE, and the GRU.
Chart showing the distribution of new fake websites created by the Russian CopyCop disinformation network in 2025, with France being the primary target followed by Germany and the United States
France has emerged as the primary target, with researchers identified 141 new fake websites registered between February and June 2025, significantly outnumbering operations targeting other nations.
Canadian operations specifically target Alberta’s growing independence movement, with the website “Alberta Separatist” promoting narratives about Ottawa’s alleged “systematic theft” of the province’s economic resources.
The United States follows with 35 newly registered domains, while Canada has been targeted with at least two websites specifically designed to exploit regional separatist movements, particularly in Alberta.
Advanced AI-Powered Content
The network has evolved its technical capabilities by deploying self-hosted, uncensored large language models based on Meta’s Llama 3 open-source technology.
This advancement allows CopyCop to generate massive quantities of AI-produced content without relying on Western AI service providers, giving the operation greater autonomy and reducing detection risks.
Infographic explaining the process of deepfake fabrication of private remarks in misinformation campaigns.
The video, titled “Whistleblower Claims Ukraine Selling US Weapons To Cartel on Red Pill News Live,” claimed to include an interview with an anonymous Mexican cartel member.
Evidence indicates the network maintains two uncensored versions of Meta Llama-3-8b model specifically configured for article generation.
These systems enable the rapid production of fabricated news content that appears professionally written while advancing pro-Russian and anti-Ukrainian narratives across multiple languages and regional contexts.
Strategic Targeting of Democratic Institutions
CopyCop’s primary objectives remain focused on undermining international support for Ukraine while exacerbating political divisions within Western nations backing Ukrainian defense efforts.
Starting in March 2025, CopyCop operators also began hosting website mirrors for websites impersonating French media outlets by combining different CopyCop website domains as subdomains.
The network achieves these goals through sophisticated disinformation campaigns that recycle content from Russian state media, amplify divisive messaging, and inject fabricated claims into Western information streams.
In the United States, CopyCop websites have published fabricated “investigations” alleging Ukrainian President Volodymyr Zelensky misappropriated American taxpayer funds and claiming Ukraine secretly supplies weapons to Mexican drug cartels designated as foreign terrorist organizations.
These narratives specifically target American audiences by exploiting domestic political tensions around immigration and foreign aid spending.
The network has also attempted to drive wedges between strategic allies, particularly targeting the strengthening relationship between France and Armenia.
Fabricated content has accused Armenian Prime Minister Nikol Pashinyan of sexual abuse through deepfake videos, while other operations falsely claim French foreign aid was used for personal property purchases by Armenian officials.
Beyond its traditional focus on major Western nations, CopyCop has expanded operations to target smaller strategic countries ahead of crucial electoral periods.
The network has established websites targeting Moldova’s September 2025 parliamentary elections, publishing fabricated investigations alleging systematic electoral fraud by President Maia Sandu’s administration.
The creation of the “Truefact” network represents a particularly sophisticated evolution, with nine subdomains impersonating a fictional fact-checking organization.
These websites publish content in Turkish, Ukrainian, and Swahili – languages never previously used by the network – demonstrating its expanding global ambitions and technical capabilities.
This represents a notable tactical evolution, as the associated social media accounts mark the first time CopyCop websites have been linked to active social media campaigns.
Sophisticated Amplification Networks
The influence network extends far beyond individual websites through coordinated amplification by sympathetic social media influencers and other Russian disinformation operations including Portal Kombat and InfoDefense.
Russian influence networks like CopyCop that use generative AI to produce biased content at scale risk degradation of the global information environment and threaten information integrity, especially during democratic processes and particularly in the context of elections.
Analysis reveals the network routinely produces high-engagement content that has successfully infiltrated mainstream political discourse in target countries.
The systematic approach combining AI-generated volume content with targeted influence operations demonstrates the evolution of state-sponsored disinformation campaigns in the digital age.
The continued expansion and sophistication of CopyCop’s operations underscores the persistent threat posed by Russian influence networks to democratic institutions and international solidarity with Ukraine.
Intelligence officials emphasize that identifying and publicly exposing these networks remains critical for defending democratic processes against foreign manipulation campaigns.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Source link
