Storm-1516
Also known as CopyCop
CopyCop is a Russian covert influence network that has established over 300 fictional media websites targeting the US, France, Canada, and other countries, primarily to disseminate pro-Russian and anti-Ukrainian narratives. The network employs TTPs such as deepfakes, fake interviews, and self-hosted LLMs for content generation, while also impersonating local media outlets and fact-checking organizations. Its operations are supported by the Moscow-based Center for Geopolitical Expertise and the GRU, aiming to undermine support for Ukraine and exacerbate political fragmentation in Western nations. CopyCop's influence content is amplified by a network of pro-Russian social media influencers and other Russian influence networks.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- IC Brief Morning — 2026-11-02 The US enters Election Day with active Russian influence operations, collapsed threat-sharing channels, and no statutory threat remastodon · Nov 2, 2026
- IC Brief Morning — 2026-10-27 Prosecutions of former FBI officials and withholding of oversight records constrain IC operations and congressional access before mastodon · Oct 27, 2026
- IC Brief Morning — 2026-10-23 Adversary intelligence campaigns against Western elections, exercises, and defense personnel are outpacing countermeasures, as premastodon · Oct 23, 2026
References
- https://www.recordedfuture.com/research/copycop-deepens-its-playbook-with-new-websites-and-targets
- https://www.recordedfuture.com/research/russian-influence-assets-converge-on-moldovan-elections
- https://www.recordedfuture.com/research/stimmen-aus-moskau-russian-influence-operations-target-german-elections
- https://www.defense.gouv.fr/actualites/storm-1516-dessous-dune-operation-dinfluence-russe
- https://www.sgdsn.gouv.fr/publications/analyse-du-mode-operatoire-informationnel-russe-storm-1516
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.