Thousands of miles from the Kremlin, a Russian troll network known as CopyCop has grown into a sprawling AI-assisted disinformation operation, researchers say. In a paper published today by Recorded Future’s Insikt Group, investigators detail how hundreds of new fake-news websites have been created to push phony political commentary, with self-hosted, uncensored large language models based on Meta’s Llama 3 open-source technology used to generate some of the content. The researchers say the aim is to influence audiences in the United States and other Western countries.
Insikt Group ties the operation to the Kremlin-backed network that previously posted a controversial video about Democratic candidate Kamala Harris. The team notes that the group behind the effort, CopyCop (also known as Storm-1516), uses infrastructure that is almost certainly funded by the Russian military intelligence service, the GRU, to rewrite articles from legitimate outlets and to produce deepfakes and other false content targeting political leaders in the US, Ukraine, France and beyond.
The researchers emphasize that the network is not a single site but a constellation of outlets designed to look like local media portals. They point to a pattern of impersonation across the US, France, Canada and Norway, with content skewing toward Russia and Ukraine coverage and sometimes citing fabricated documents. The paper also notes a March 2025 story on clearstory.news that was used to illustrate how fake outlets reproduce sensational national and international news, sometimes employing AI to rewrite material from legitimate outlets.
According to Insikt Group, at least 200 new websites linked to CopyCop emerged since January, bringing the total for the year to no fewer than 300. Most of these outlets present themselves as regional or local news portals but push national and international stories with a heavy emphasis on Russia and Ukraine. Some articles were rewritten with an LLM, and only six of the affected sites – allstatesnews.us, capitalcitydaily.com, fldaily.news, silvercity.news, usatimes.news, and wval.news – earned mentions on social media to date.
The research also highlights geographic expansion, including attempts to entrench a foothold in Canada with new sites such as albertaseparatist.com and torontojournal.ca, both aimed at leveraging regional tensions to polarize voters. The study notes that the mining of pro-independence sentiment in Alberta and related topics is used to seed content in political discussions across North America.
Insikt Group cautions that CopyCop’s infrastructure expansion signals intent to persist and evolve in the global information environment. The researchers also point to a broader trend of foreign influence operations seeking to shape elections through a combination of AI-generated content, deepfakes and strategically targeted local-media facades.
Context for U.S. election security also looms large. The report arrives as U.S. Homeland Security Secretary Kristi Noem has been described as reducing the counter-disinformation capabilities of the Cybersecurity and Infrastructure Security Agency (CISA), fueling concerns among election officials about federal support ahead of the 2026 midterm elections. In a related development, Senators Mark Warner and Alex Padilla urged U.S. Director of National Intelligence Tulsi Gabbard to brief lawmakers on foreign election threats, including potential shifts in how information about interference is disclosed. The accompanying briefing letter and related materials can be viewed here.