Full Report
The Russian influence network CopyCop is targeting Western-backed AI and infrastructure projects in Armenia, including the Firebird AI data center, to undermine the country’s westward geopolitical realignment.
Analysis Summary
# Threat Actor: CopyCop
## Attribution & Identity
**CopyCop** is a Russian-aligned influence network, also tracked by Microsoft as **Storm-1516**. It is an established information operations (IO) actor known for laundering pro-Kremlin narratives through impersonation of legitimate Western media outlets and high-engagement social media amplifier networks.
## Activity Summary
Between June 24 and July 13, 2026, CopyCop launched a multi-stage influence campaign targeting the **Firebird AI data center** in Armenia. The operation aimed to sabotage Armenia’s westward geopolitical pivot and undermine US-Armenian infrastructure cooperation.
- **Instance 1 (June 24):** Fabricated a "TechCrunch" report claiming the facility was at risk of an imminent 7.4 magnitude earthquake.
- **Instance 2:** Cast doubt on the facility’s economic viability and impact on local infrastructure.
- **Instance 3:** Impersonated Iranian military communications to frame the data center as a legitimate military target, reaching over 1.6 million views.
## Tactics, Techniques & Procedures
- **Media Impersonation:** Creating "doppelganger" websites that mimic the branding, CSS, and logos of Western outlets (e.g., TechCrunch, Gizmodo).
- **Narrative Laundering:** Fabricating alarming news (natural disasters, military threats) to create public panic or investor hesitation.
- **Social Media Amplification:** Utilizing a persistent network of bot/amplifier accounts to distribute content across Western social media platforms.
- **Typosquatting:** Registering domains visually similar to legitimate news organizations.
- **Cross-Platform Propagation:** Moving content from hosted "fake news" domains to social media platforms to gain viral reach.
## Targeting
- **Sectors:** Artificial Intelligence (AI), Cloud Infrastructure, Energy (Nuclear/Reactors), Government/Diplomacy, Media.
- **Geography:** Armenia, United States (Western-backed projects in the South Caucasus).
- **Victims:**
- **Organizations:** Firebird AI, NVIDIA, TechCrunch (impersonated), Gizmodo (impersonated).
- **Projects:** The TRIPP project, Metsamor nuclear reactor negotiations.
- **Political Entities:** Prime Minister Nikol Pashinyan and the Civil Contract party.
## Tools & Infrastructure
- **Impersonated Domains:**
- tech-crunch[.]org
- haaretz24[.]com
- euronews[.]us[.]com
- politico-24[.]com
- **Registrars:** Namecheap (AS22612).
- **Amplifier Accounts:**
- @Truthtellerftm
- @GreenwaySh57854
- @Ibrahim_alFiqar
- **Technical Indicators:** Unique CSS stylesheet hashes shared across the actor's infrastructure.
## Implications
CopyCop serves as a primary tool for Russian hybrid warfare in the South Caucasus. As Russia loses traditional military and economic leverage (such as CSTO withdrawal and energy dominance), it is increasingly relying on "low-cost, high-reach" influence operations. By targeting high-value AI investments, CopyCop attempts to signal that Western alignment brings instability, physical danger, or military risk to the host nation.
## Mitigations
- **Brand Protection:** Organizations should proactively monitor for typosquatted domains and unauthorized use of corporate logos.
- **Takedown Services:** Media outlets and targeted firms should employ automated services to identify and shutter impersonation infrastructure.
- **Strategic Communication:** Pre-emptive messaging ("pre-bunking") by governments and firms regarding project safety and economic benefits can neutralize disinformation.
- **Platform Engagement:** Direct coordination with social media Trust and Safety teams to blacklist known amplifier accounts (e.g., @Truthtellerftm).