Since early 2025, CopyCop, also known as Storm-1516, has intensified its covert influence operations by launching at least 200 new fictional media websites aimed at the United States, Canada, and France.
Attributed to US expatriate John Mark Dougan with support from the Moscow-based Center for Geopolitical Expertise and Russia’s GRU, this network now comprises over 300 sites globally after the February report of 94 German-targeted domains.
Bulk Domain Registrations Signal Coordinated Scale-Up
Technical analysis of registration and hosting data shows CopyCop operators registering domain batches between January and June 2025.
A cluster of 35 US-focused sites, including allstatesnews.us, usatimes.news, and capitalcitydaily.com, is shielded by Cloudflare yet hosted on Akamai/Linode infrastructure (AS63949). DNS queries and WHOIS records confirm shared IP ranges, indicating a deliberate bulk-registration campaign.
These sites mimic legitimate local outlets, rewriting authentic newswire copy through AI to embed pro-Russian narratives within sections labeled “Investigations” and “Exclusive Reports.”
AI-Driven Content Generation on Self-Hosted Infrastructure
Recent telemetry reveals CopyCop’s migration to self-hosted, uncensored large language models based on Meta’s Llama 3 open-source code, likely versions such as dolphin-2.9-llama3-8b or llama-3-8B-Lexi-Uncensored running on privately provisioned servers funded by the GRU.
Artifacts within published articles (e.g., knowledge-cutoff headers) and Python scripts invoking Ollama functions for local inference confirm in-house content generation.
This shift removes reliance on Western AI APIs, reduces attribution risk, and enables high-volume production of pro-Kremlin, anti-Ukraine narratives tailored to specific audiences.
Geographic and Linguistic Diversification to Evade Countermeasures
CopyCop’s infrastructure expansion includes at least 141 .fr domains registered with throwaway Gmail, ProtonMail, and Zoho addresses, impersonating French media outlets and a faux public broadcaster via WordPress “Zeen News” themes.
In Canada, torontojournal.ca and albertaseparatist.com exploit regional fault lines, with the latter’s TikTok and YouTube channels marking a new tactic for cross-platform amplification.
Furthermore, the Truefact. News network launched nine subdomains in Swahili, Turkish, and Ukrainian languages previously unused across geolocated IPs in Russia and North America. Mirrored subdomains and multi-regional hosting bolster network resilience and complicate takedown efforts.
By continuously refining its domain portfolio, leveraging self-hosted AI, and expanding into new linguistic and geographic theaters, CopyCop poses an escalating threat to information integrity in democracies supporting Ukraine.
Persistent collaboration among security researchers, media organizations, and platform operators is essential to detect, disrupt, and dismantle this rapidly evolving influence network.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
