Loading story…
A likely Russian influence operation linked to CopyCop (also tracked as Storm-1516) targeted Firebird’s AI data center project in Hrazdan, Armenia, ahead of the facility’s Phase One opening. Researchers said the campaign used repeated media impersonation to spread false claims designed to damage confidence in the project, including a fabricated TechCrunch video published on the spoofed domain tech-crunch[.]org that warned of a nonexistent magnitude 7.4 earthquake threat near the site. Infrastructure analysis tied the domain to previously identified CopyCop assets, and independent researchers at the Gnida Project corroborated the attribution.
The operation reportedly unfolded across three incidents between June 24 and July 13, 2026, with narratives escalating from earthquake risk to claims that the project was economically and infrastructurally unsound, and later to messaging that portrayed the facility as a legitimate military target by impersonating official Iranian military communications. Recorded Future assessed the campaign as part of a broader shift from election-focused messaging against Armenian Prime Minister Nikol Pashinyan toward efforts to undermine Armenia’s westward geopolitical alignment and deter Western investment, with the three incidents drawing more than 1.6 million combined views.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Between June 24 and July 13, 2026, Insikt Group documented three separate CopyCop media impersonations targeting the Firebird AI data center ahead of its planned July 2026 opening. After the initial earthquake-themed spoof, later incidents questioned the project’s economic and infrastructure viability, and the most recent impersonated official Iranian military communications to frame the facility as a legitimate military target.
On June 24, 2026, researchers observed a CopyCop amplifier account sharing a fabricated video impersonating TechCrunch that falsely warned of an imminent magnitude 7.4 earthquake threatening Firebird’s AI data center in Hrazdan, Armenia. The video was hosted on the spoofed domain tech-crunch[.]org, which infrastructure analysis linked to previously identified CopyCop media-impersonation infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Since early 2025, the Russian influence network CopyCop (Storm-1516) has launched over 300 fake news and impersonation websites targeting the US, France, Canada, Germany, Armenia, and Moldova. These sites, operated by John Mark Dougan with support from the GRU and CGE, use self-hosted, uncensored LLMs based on Meta’s Llama 3 to generate pro-Russian, anti-Ukraine, and anti-Western content. The network’s expansion includes new languages and regions, with tactics such as deepfakes, fake interviews, and impersonation of media and political entities.
Jun 30, 2026
Armenian authorities opened an investigation after a threat actor using the alias **dk0m** advertised for sale a dataset allegedly containing nearly **8 million** government-related records tied to a state notification system used to distribute official legal and administrative communications. The data was marketed on an underground forum for **$2,500** and was described as including notifications and communications associated with police and judicial bodies; officials in Yerevan publicly denied that the country’s **government email infrastructure** had been breached while acknowledging the possibility that another state platform was accessed. Armenia’s Public Relations and Information Center (PRIC) said a preliminary review indicates the leaked material may have originated from the **electronic civil litigation** platform, and that an internal probe is ongoing to confirm the source and access path. Researchers at **CyberHUB-AM** assessed dk0m as a recurring data broker active since at least 2024 and reported the actor commonly uses **infostealer malware** to harvest credentials/session data and identify access to sensitive government portals before repackaging and reselling datasets; screenshots reportedly dating to **August 2024** were cited as supporting evidence. The alleged exposure could increase **social engineering** risk by enabling highly credible scams referencing real case numbers, fines, or enforcement actions.
Jun 29, 2026
Researchers at **Acronis** reported a cyberespionage campaign—tracked as **CrescentHarvest**—targeting Farsi-speaking individuals sympathetic to Iran’s anti-government protests, including potential dissidents and supporters abroad. The operation uses social engineering lures packaged as malicious archive files containing authentic-looking protest media and a Farsi-language report that portrays the protests positively and repeats protest slogans, likely exploiting heightened demand for information amid Iranian internet blackouts. The archive includes files disguised as a video and an image that deploy a previously undocumented malware family dubbed **CRESCENTHARVEST**, assessed to function as both a **remote access trojan** and **information stealer**. Reported capabilities include command execution, keystroke logging, and theft of sensitive data such as saved credentials, browser history/cookies, and **Telegram** account information, along with checks for installed antivirus to modulate behavior. While no specific APT group was named, Acronis assessed the code, infrastructure, and victimology as consistent with an **Iran-aligned** actor; reporting also noted operational quirks (e.g., unused C2 endpoints and buggy User-Agent handling) that may indicate lower maturity or a rapidly assembled campaign tied to the protest-driven geopolitical moment.
Jun 29, 2026