threat actor · Russia
CopyCop
On record in CyberSIXT · MISP Galaxy
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Sources name this actor but link nothing to it yet: no CVE, technique or software is on record.
Open CopyCop's actor pageCopyCop is a Russian covert influence network that has established over 300 fictional media websites targeting the US, France, Canada, and other countries, primarily to disseminate pro-Russian and anti-Ukrainian narratives. The network employs TTPs such as deepfakes, fake interviews, and self-hosted LLMs for content generation, while also impersonating local media outlets and fact-checking organizations. Its operations are supported by the Moscow-based Center for Geopolitical Expertise and the GRU, aiming to undermine support for Ukraine and exacerbate political fragmentation in Western nations. CopyCop's influence content is amplified by a network of pro-Russian social media influencers and other Russian influence networks.
Source: MISP Galaxy. MISP Galaxy threat-actor cluster, by the MISP Project (CC0 1.0).
- Also known as
- Storm-1516
- Origin
- Russia
- On record in
- CyberSIXT · MISP Galaxy
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.