CopyCop Deepens Its Playbook with New Websites and Targets
Executive Summary
Since March 2025, Insikt Group has observed CopyCop (also known as Storm-1516), a Russian covert influence network, creating at least 200 new fictional media websites targeting the United States (US), France, and Canada. CopyCop uses these websites to disseminate influence content targeting pro-Western leadership and publish AI-generated content with pro-Russian and anti-Ukrainian themes.
Key Findings
- CopyCop has widened its target languages and geographic scope to include Moldova, Canada, and Armenia while sustaining influence operations targeting the US and France.
- The network aims to erode public support for Ukraine and undermine democratic processes in Western countries.
- New tactics include using self-hosted LLMs for generating content and employing subdomains as mirrors.
Background
Insikt Group previously documented CopyCop in 2024, including its attempts at influencing major elections. Reporting from other organizations corroborates the assessments of the network’s objectives and activities, attributing part of the activities to John Mark Dougan.
Major Infrastructure Expansion
Since January 2025, Insikt Group has identified at least 200 new websites related to CopyCop, reflecting a significant expansion of its activities targeting new audiences. These websites serve to disseminate targeted influence content and publish AI-generated content.
US-Themed Websites
In April 2025, Insikt Group identified 35 new CopyCop websites registered almost certainly for engaging US-based audiences. Most of these websites are hosted on a specific IP address owned by Akamai/Linode.
Truefact Websites
Insikt Group identified another domain, truefact.news, which has several subdomains hosting CopyCop websites impersonating a fictional fact-checking organization named “Truefact.”
Table 1: Example Truefact websites and languages
| Domain | Name | Languages |
|---|---|---|
| africa.truefact.news | Habari Afrika | Swahili |
| turkey.truefact.news | The World Times | Turkish |
| ukraine.truefact.news | The World Times | Ukrainian, French |
French Websites
Insikt Group identified at least 141 new CopyCop websites posing as fictional French media outlets registered recently. The full list of CopyCop websites targeting France is available in Appendix C.
Canadian Websites
CopyCop is targeting pro-independence sentiment in Canada, with identified websites impersonating grassroots movements.
- albertaseparatist.com
- torontojournal.ca
Other Websites
Insikt Group has identified at least twelve other websites likely affiliated with Dougan or targeting various geographies, including the EU and Armenia.
TTPs Evolve to Enable Content Generation and Network Survivability
CopyCop continues using the same tactics, including registering websites masquerading as local outlets and leveraging AI-generated content. New tactics also involve more sophisticated impersonation of media outlets.
Mitigations
- Use Recorded Future’s tools to track and summarize narratives across CopyCop websites.
- Monitor amplification of CopyCop content on social media.
Outlook
Russian influence networks like CopyCop risk degrading the global information environment, especially during democratic processes. Continued scrutiny and public exposure of these narratives and their underlying infrastructure remain a priority.