CopyCop Expands Russian Disinformation Campaigns with 300 New Fake Websites in 2025
Published on September 18, 2025
- Disinformation campaigns: Approximately 300 new websites relying on fictional media and impersonation have been spotted.
- Attribution: Security researchers linked these domains to a Russian covert influence network known as CopyCop or Storm-1516.
- Why it matters: These are seen as an escalation of the group's efforts to undermine the West’s support for Ukraine and fuel political divisions.
The Russian covert influence network, known as CopyCop or Storm-1516, significantly expanded its operations in 2025, creating approximately 300 new fictional media and impersonation websites to advance its geopolitical agenda.
This expansion marks a substantial escalation in the group's efforts to undermine Western support for Ukraine and exacerbate political divisions.
AI-Generated Fake News and Expanded Targeting
Since March 2025, the CopyCop influence network has established at least 200 new websites targeting audiences in the U.S., France, Canada, and Armenia. This is in addition to 94 sites targeting Germany that were identified earlier in the year, a comprehensive Recorded Future report says.
The network, very likely operated by John Mark Dougan with support from Russia's GRU, uses these sites to disseminate AI-generated fake news, deepfakes, and fabricated "whistleblower" interviews.
![CopyCop website partiroyaliste[.]fr impersonating a French royalist political party](https://cdn.technadu.com/wp-content/uploads/2025/09/image-34.png)
The primary objectives remain consistent: eroding public support for Ukraine and destabilizing democratic processes in NATO countries, the report says.
The operation has also broadened its linguistic and geographic scope, now publishing content in Turkish, Ukrainian, and Swahili. It has also initiated campaigns targeting Moldova and Armenia ahead of their parliamentary elections in 2025 and 2026, respectively, demonstrating a clear alignment with broader Russian geopolitical influence operations, according to the report.
Security researchers say the network leverages self-hosted, uncensored large language models (LLMs), likely based on Meta's Llama 3, to generate pro-Russian content at scale, bypassing the safeguards of commercial AI services.
TTPs and Infrastructure
CopyCop's tactics, techniques, and procedures (TTPs) remain largely unchanged but now include using subdomains as mirrors to increase resilience against takedowns. The content is amplified through an ecosystem of social media influencers and other Russian influence networks like Portal Kombat and InfoDefense.
This significant infrastructure expansion underscores the persistent and evolving threat posed by sophisticated Russian disinformation campaigns. Iranian hackers reportedly distributed fake news before the U.S. election, and 5,000 fake X accounts controlled by AI were used in a disinformation campaign linked to China in August 2024.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular