GINC-APT-0392 · Targeted, sponsor unknown

CopyCop

Also Neva Flood, Storm-1516.

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Russia(high confidence)
Agency named
GRU
Sources
5 sources carry it
Identifier
GINC-APT-0392 · copycop

What it is

CopyCop is a Russian covert influence network that has established over 300 fictional media websites targeting the US, France, Canada, and other countries, primarily to disseminate pro-Russian and anti-Ukrainian narratives. The network employs TTPs such as deepfakes, fake interviews, and self-hosted LLMs for content generation, while also impersonating local media outlets and fact-checking organizations. Its operations are supported by the Moscow-based Center for Geopolitical Expertise and the GRU, aiming to undermine support for Ukraine and exacerbate political fragmentation in Western nations. CopyCop's influence content is amplified by a network of pro-Russian social media influencers and other Russian influence networks.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Microsoft
Neva Flood, Storm-1516

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • Xpert

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de