Storm-1516Threat actor
- CopyCop
CopyCop is a Russian covert influence network that has established over 300 fictional media websites targeting the US, France, Canada, and other countries, primarily to disseminate pro-Russian and anti-Ukrainian narratives.From MISP Galaxy
Last reported 27 days ago, by CERT-EU5 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1684Social Engineering
“Apple adds Impersonation Risk Detection: Apple has shipped a new security feature with iOS 27 designed to detect active social engineering scams.”
- T1195Supply Chain Compromise
“We noted several global China-linked campaigns, such as APT group Lotus Blossom's Notepad++ supply-chain compromise and UNC2814’s campaign targeting telecoms and government entities worldwide.”
- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1505.003Web Shell
“Activity spanned over 100 countries and led to confirmed compromises, including administrative takeovers and web shell deployments, enabling follow-on access and potential credential theft.”
- T1552.004Private Keys
“…t 341 malicious “skills” published to ClawHub and GitHub that deliver info-stealing malware targeting cryptocurrency API keys, wallet private keys, SSH credentials and browser passwords.”
- T1657Financial Theft
“…ack spoofed Ukrainian judicial domains to target a senior legal advisor, aiming to gain remote access for intelligence gathering or financial theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Cyber Brief 26-03 - February 2026“In terms of digital foreign interference, a pro-Russia Storm-1516 disinformation campaign reportedly falsely associated French President Emmanuel Macron with Jeffrey Epstein.”
-
Cyber Brief 26-09 - August 2026“In terms of digital foreign interference, pro-Russia Matryoshka and Storm-1516 targeted upcoming elections in Germany and France.”
-
Russia Escalating Hybrid Attacks Across Europe“These operations include Doppelgänger, Operation Overload, Operation Undercut, and CopyCop.”
-
Risky Bulletin: Network of 10,000 AI servers masks Chinese malicious activity“Storm-1516 targets the Baltics: On the disinformation front, Russian info-op group Storm-1516 has been seen targeting the Baltic states with narratives attacking their pro-EU governments and trying to blame Ukraine for various drone incidents.”
-
CopyCop Targets AI Investment in Armenia“CopyCop Targets AI Investment in Armenia”
Indicators in its reports
named in the reports above- tech-crunch[.]orgin 1 report
- haaretz24[.]comin 1 report
- politico-24[.]comin 1 report
- gizmodo[.]ccin 1 report
- www.forbrukerradet[.]noin 1 report
- airavn.eurosky[.]socialin 1 report
- safeonweb[.]bein 1 report
- pylos[.]coin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.