CyberSIXT Search
Original
Image: SecurityOnline

SecurityOnlineDdos

CopyCop Expands Its Disinformation Network With AI-Generated Content and Global Targets

Part of the Storm-1516 story · 2 articles · 2 outlets · since 18 Sep 2025

According to Insikt Group, CopyCop, also known as Storm-1516, is rapidly expanding its disinformation infrastructure and global influence operations. Since March 2025, the Russian covert network has established over 200 new fictional media websites targeting audiences in the United States, France, Canada, and beyond, impersonating media brands and political parties across Europe and the Caucasus, with over 300 websites established by CopyCop’s operators in the year to date.

The analysis notes that CopyCop is increasingly relying on large language models to produce and amplify propaganda, using self-hosted, uncensored versions of Meta’s Llama 3 models, including dolphin-2.9-llama3-8b and Llama-3-8B-Lexi-Uncensored, to mass-produce fabricated narratives without restrictions.

Campaigns are no longer limited to NATO countries and now extend to Moldova, Armenia, and Africa, with target languages including Turkish, Ukrainian, and Swahili, and geographic scope to include Moldova, Canada, and Armenia while continuing to pursue influence in the US and France. In the United States, sites such as All States News and USA Times News have laundered forged documents, while France hosts over 140 fake media outlets impersonating public broadcasters like France Télévisions.

The report emphasises that CopyCop aims to undermine support for Ukraine and exacerbate political fragmentation in Western countries backing Ukraine, aligning closely with Kremlin influence objectives.

Story timeline Storm-1516

Full timeline
Show as table
Storm-1516 coverage
Published (UTC)OutletHeadline
Thu 18 Sep 2025 · 09:21 UTCGBHackersRussian CopyCop Network Expands: 200+ Fake News Sites Target US, Canada, and France
Mon 22 Sep 2025 · 02:01 UTCSecurityOnlineCopyCop Expands Its Disinformation Network With AI-Generated Content and Global Targets (this article)

Sources

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device