Article Details

Russian fake-news network, led by an ex-Florida sheriff's deputy, storms back into action with 200+ new sites. As the Trump administration guts efforts to counter election disinfo. The Russian troll farm that in the lead-up to the 2024 US presidential election posted a bizarro video claiming Democratic candidate Kamala Harris was a rhino poacher, is back with hundreds of new fake news websites serving up phony political commentary with an AI assist. In a paper published today, Recorded Future's Insikt Group threat researchers also unveil evidence that the pro-Putin posters known as CopyCop, aka Storm-1516, use self-hosted, uncensored LLMs based on Meta's Llama 3 open-source models to generate at least some of these fictional news stories. These websites are likely operated by John Mark Dougan, the security researchers claim. Dougan is a former deputy sheriff from Florida who gained political asylum in Moscow in 2016, and is allegedly a disinformation purveyor supported by the Kremlin. His phony media outlets have been cited in news articles or social media posts thousands of times, and both the US Treasury and Washington Post allege connections between Dougan, the Moscow-based Center for Geopolitical Expertise (CGE), and the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). In fact, the GRU reportedly funds the LLM servers that "almost certainly" rewrite articles from legitimate news sites to post on its fake media outlets, and also create deepfakes and other false content targeting political leaders in the US, Ukraine, France, and other countries, Insikt Group said. Since January, the researchers have uncovered at least 200 new websites that they attribute to CopyCop. "These websites are almost all impersonating fictional local media outlets in the US, France, Canada, and Norway, political parties and movements in France, Canada, and Armenia, or fictional fact-checking organizations publishing in Turkish, Ukrainian, and Swahili," the report notes. This includes 35 sites registered in January but not spotted by Insikt Group until April, and "almost certainly designed for engaging US-based audiences." The security company provides a full list of all of the CopyCop websites in the paper published on Wednesday. This is in addition to the previously documented 94 CopyCop sites targeting Germany's federal elections in February, bringing the Russian trolls' total number this year to at least 300. Most of the US-themed sites portray themselves as local news portals, but their coverage skews national and international with a big focus on Russia and Ukraine. This includes a March 2025 story on clearstory[.]news about President Volodymyr Zelensky "misappropriating US taxpayer funds" by paying journos to depict US President Donald Trump negatively, and citing a likely forged document on Ukrainian presidential letterhead. Several of the articles have been rewritten using an LLM, we're told, with just six earning mentions on social media to date: allstatesnews[.]us, capitalcitydaily[.]com,  fldaily[.]news, silvercity[.]news, usatimes[.]news, and wval[.]news.  When asked about the implications for future US elections, Insikt Group's Director of Global Issues Matt Mooney pointed to CopyCop's effort to influence elections inMoldova  Germany. "We assess that CopyCop's substantial expansion of infrastructure demonstrates intent to persist and evolve in the global information environment," he toldThe Register. Interestingly, the Kremlin-backed network appears to be trying to establish more of a foothold in Canada with at least two new websites: albertaseparatist[.]com and torontojournal[.]ca. The fake news stories populating these websites use the growing pro-independence sentiment in the province of Alberta to further polarize people based on their political beliefs. The Insikt Group's research comes as US Homeland Security Secretary Kristi Noem has gutted the US Cybersecurity and Infrastructure Security Agency's efforts to counter online disinformation - especially as it relates to election security, prompting concern from election officials who fear less federal support for the mid-term elections in 2026. Earlier this week, US Senators Mark Warner and Alex Padilla, both Democrats, urged US Director of National Intelligence Tulsi Gabbard to provide a briefing for lawmakers on foreign election threats and address concerns that she may have directed the intelligence community to stop disclosing details about attempted foreign interference in US elections.