# CopyCop Targets US-Armenian AI Project, Undermining Westward Shift

> Russian influence network CopyCop (Storm-1516) targets the Firebird AI data center in Armenia with media impersonations to undermine US-Armenian ties.

- Published: 2026-08-19T00:42:40.000Z
- Severity: info
- Category: Threat Intel
- Tags: Disinformation, Geopolitics, CopyCop, Storm 1516, Influence Operation
- Author: Runtime Rebel Intel
- Primary source: https://www.recordedfuture.com/blog/copycop-targets-ai-investment
- Canonical: https://runtimerebel.com/blog/copycop-targets-us-armenian-ai-project-undermining-westward-shift

## Key points

- Russian influence network CopyCop targets the US-Armenian Firebird AI data center with disinformation campaigns.
- The campaign aims to undermine Armenia's growing economic and geopolitical alignment with Western nations.
- Organizations should prioritize media literacy and actively monitor for sophisticated media impersonations.

## Overview: CopyCop's Geopolitical Disinformation Campaign

The Russian influence network, identified as CopyCop (Storm-1516), has actively targeted the joint United States and Armenian-backed Firebird [AI](/glossary#ai) data center project in Hrazdan, Armenia. This campaign is part of a broader strategic effort to undermine Armenia's ongoing geopolitical and economic realignment towards Western nations. Between June 24 and July 13, 2026, CopyCop engaged in at least three distinct media impersonations, leveraging fabricated narratives to discredit the Firebird facility, which is slated for its Phase One opening in July 2026, according to [Recorded Future's Insikt Group](https://www.recordedfuture.com/blog/copycop-targets-ai-investment).

The Firebird AI data center, a significant public-private collaboration involving the US and Armenian governments and NVIDIA, represents an approximately $500 million investment in its initial phase, expanding to $4 billion in Phase Two. It is designed to be the Caucasus region's first large-scale AI data center, housing over 6,000 NVIDIA Blackwell GPUs. This project has become a central pillar in the heightened US-Armenian diplomatic relationship and Armenia's strategic pivot westward, making it a high-value target for influence operations seeking to disrupt this shift.

## CopyCop's Disinformation Campaign Against Firebird AI

### Fabricated Narratives and Expanding Reach

CopyCop's campaign employed a series of sophisticated media impersonations, each designed to cast doubt on the Firebird project's viability and legitimacy:

*   **Earthquake Risk Impersonation**: On June 24, 2026, CopyCop amplified a video impersonating TechCrunch. This video, hosted on `tech-crunch[.]org`, falsely claimed an imminent magnitude 7.4 earthquake threat to Kotayk Province, endangering the Firebird facility. Initial amplification was limited to a small network of known CopyCop-linked accounts.
*   **Economic Viability Concerns**: A second wave of disinformation began on June 30, 2026, impersonating Gizmodo journalist Webb Wright. This video, hosted on `gizmodo[.]cc`, alleged that power outages, transmission limitations, and inadequate backup capacity posed a "real risk" of rendering the multi-billion-dollar investment economically unsustainable.
*   **Military Target Justification**: The most recent incident, observed starting July 7, 2026, involved an impersonation of official Iranian military communications, bizarrely justifying the treatment of the data center as a legitimate military target.

The reach of these operations substantially expanded over time, growing from limited initial engagement to over 1.6 million combined views by the third instance, indicating increasing audience viewership and the evolving effectiveness of the campaign.

### Technical Modus Operandi and Infrastructure

Insikt Group's analysis revealed consistent technical patterns linking these impersonations to previous CopyCop activities. The domains `tech-crunch[.]org` and `gizmodo[.]cc` were both registered through Namecheap and utilized hosting providers like Hostinger (AS47583). Crucially, CSS stylesheet hash analysis connected these new domains to previously confirmed CopyCop infrastructure used for imitating other media brands, including `haaretz24[.]com`, `euronews[.]us[.]com`, and `politico-24[.]com`. This reuse of social media amplifier networks against Western investment projects indicates a methodical approach to targeting. Independent researchers at the Gnida Project also corroborated the [attribution](/glossary#attribution) of the TechCrunch impersonation to CopyCop.

### Geopolitical Context: Armenia's Westward Pivot

The CopyCop campaign leverages heightened media attention on AI investments and megaprojects to amplify pro-Russian narratives within a critical geopolitical context. Armenia's shift away from Russia has been pronounced, including freezing its participation in the Russia-led Collective Security Treaty Organization (CSTO) since February 2024. This pivot has been met with signaling from the Kremlin regarding economic repercussions, such as preferential gas pricing. The Firebird AI project itself is a direct outcome of a framework signed between Armenia and the United States in August 2025 on semiconductors and AI, with high-profile visits from US Vice President JD Vance and Secretary of State Marco Rubio underscoring its strategic importance.

CopyCop's targeting of the Firebird facility follows a multi-month campaign aimed at Armenia’s June 7, 2026, parliamentary elections, which sought to denigrate Prime Minister Nikol Pashinyan and his pro-Western Civil Contract party. The current operations are a clear redirection of efforts to advance the overall objective of undermining Armenia’s pivot westward through timely and impactful disinformation.

## Actionable Recommendations for Countering Influence Operations

### Detecting CopyCop Influence Operations and Media Impersonations

Security professionals and organizations operating in geopolitically sensitive regions must enhance their capabilities to **detecting CopyCop influence operations** and similar disinformation campaigns. This involves a multi-faceted approach:

*   **Source Verification**: Implement rigorous processes for verifying the authenticity of news and information, especially when it pertains to critical infrastructure, economic projects, or geopolitical events. Always check official sources and cross-reference information from multiple reputable outlets.
*   **Social Media Monitoring**: Establish proactive monitoring of social media platforms for unusual patterns of content amplification, newly registered domains mimicking legitimate news organizations, and the spread of unverified claims related to sensitive projects.
*   **Domain and Infrastructure Analysis**: Security teams should analyze newly observed domains, particularly those that appear to mimic established media brands. Identifying consistent infrastructure patterns (e.g., specific registrars like Namecheap, hosting providers like Hostinger) and linking them via unique identifiers like CSS stylesheet hashes can reveal connections to known influence networks.
*   **Media Literacy Training**: Provide employees and stakeholders with training on identifying disinformation tactics, deepfakes, and media impersonations. Understanding the motivations behind such attacks, especially those aimed at **Armenia geopolitical realignment disinformation**, is crucial for critical evaluation.

Security professionals seeking guidance on **countering media impersonations targeting AI infrastructure** should focus on continuous [threat intelligence](/glossary#threat-intelligence) gathering specific to influence operations. This proactive stance helps to rapidly identify and mitigate the impact of campaigns designed to sow distrust and undermine strategic initiatives. Incident response plans should include procedures for publicly refuting disinformation with verified facts, working with social media platforms to remove inauthentic content, and informing affected stakeholders transparently.

**Related:** [Cal Water Incident: No OT Impact Confirmed After Handala Claims](/blog/cal-water-incident-no-ot-impact-confirmed-after-handala-claims), [Cloudflare H1 2026 DDoS Trends: Hyper-Volumetric & Geopolitics](/blog/cloudflare-h1-2026-ddos-trends-hyper-volumetric-geopolitics)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/copycop-targets-us-armenian-ai-project-undermining-westward-shift