Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Threat Actors Storm-1516

Also known as: CopyCop, tracked as, Sandworm Team, France, Canada, GRIMBOLT, UAC-0050

Description

CopyCop is a Russian covert influence network that has established over 300 fictional media websites targeting the US, France, Canada, and other countries, primarily to disseminate pro-Russian and anti-Ukrainian narratives. The network employs TTPs such as deepfakes, fake interviews, and self-hosted LLMs for content generation, while also impersonating local media outlets and fact-checking organizations. Its operations are supported by the Moscow-based Center for Geopolitical Expertise and the GRU, aiming to undermine support for Ukraine and exacerbate political fragmentation in Western nations. CopyCop's influence content is amplified by a network of pro-Russian social media influencers and other Russian influence networks.

Goals & Targeting

Targeted Sectors

Government
Media
Financial services
Defense
Telecommunications
Education
Nuclear
Energy
Non profit
Chemical
Healthcare
Hospitality
Retail
Think tank
Transportation
Critical infrastructure

Targeted Countries / Regions

RU
FR
US
UA
CA
DE
CN
RO
IL
KP
GB
IN
NL

AI Analysis

No AI analysis yet.

ATT&CK Techniques

Impact
1 technique
Lateral Movement
1 technique
Reconnaissance
1 technique
1 technique

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

References

  1. attack.mitre.org — Cited by web research for: Sandworm Team
  2. www.recordedfuture.com — Cited by web research for: France
  3. cert.europa.eu — Cited by web research for: GRIMBOLT
  4. learn.microsoft.com — Cited by web research for: Tsunami

Intel Summary

40

Techniques

41

Tools

0

Campaigns

40

IOCs

0

Observed Data

15

Tactics

Details

Type
Unknown
Primary Motivation
Financial gain
Country of Origin
R
Confidence
60%
Added
May 17, 2026
No notes yet. Click "Add Note" to create the first analysis note.
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.