CopyCop Impersonated Media and Iranian Military to Target Armenia’s Firebird AI Data Center
Summary
Recorded Future linked three CopyCop influence operations to fabricated claims about Armenia’s Firebird AI data center, including earthquake risks, power instability, and Iranian military targeting. The campaign’s third video reached more than 1.6 million views.
Key points
- Insikt Group documented three CopyCop operations targeting Firebird between June 24 and July 7, 2026, ahead of the data center’s planned opening.
- The first video impersonated TechCrunch and fabricated an imminent earthquake risk; its recently registered domain was linked to known CopyCop infrastructure.
- A second video impersonated Gizmodo to question the facility’s power supply and financial viability.
- The third video presented fabricated Iranian military messaging that portrayed Firebird as a military target; CopyCop amplifiers generated more than 1.6 million combined views.
- The same amplifier network had previously promoted false claims about the TRIPP corridor, and researchers assess that other Western-backed Armenian projects may be targeted.
- Recorded Future recommends monitoring CopyCop infrastructure and accounts, and that impersonated organizations work with domain takedown services and social media trust-and-safety teams.
Article Details
- Attack Vectors
- CopyCop used fabricated videos impersonating TechCrunch and Gizmodo to spread false claims about earthquake risk and power-grid instability at the Firebird AI data center.
- CopyCop published a video impersonating Iranian state messaging and depicting a purported military threat against the facility.
- CopyCop amplified the narratives through tracked social media accounts and websites impersonating media brands.
- Defensive Notes
- Monitor CopyCop infrastructure and amplifier accounts for early warning of further targeting.
- Use brand-intelligence and takedown services to identify and remove impersonating domains and accounts.
- Coordinate with social media trust and safety teams to seek removal of infringing content.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | euronews[.]us[.]com | Previously confirmed CopyCop infrastructure imitating a media brand, linked by stylesheet analysis. |
| DOMAIN | gizmodo[.]cc | CopyCop-attributed site hosting a fabricated video impersonating Gizmodo. |
| DOMAIN | haaretz24[.]com | Previously confirmed CopyCop infrastructure imitating a media brand, linked by stylesheet analysis. |
| DOMAIN | politico-24[.]com | Previously confirmed CopyCop infrastructure imitating a media brand, linked by stylesheet analysis. |
| DOMAIN | tech-crunch[.]org | CopyCop-attributed site hosting a fabricated video impersonating TechCrunch. |
Threat Actors
Vendors
Products
Countries
Armenialikely targeted the joint United States (US) and Armenian-backed Firebird AI data center in Hrazdan, Armenia, as part of a broader campaign to undermine Armenia's westward geopolitical and economic realignment.RussiaArmenia’s westward shift has come at the expense of its relationship with Russia, especially in the fields of security and energy.United StatesThe Russian influence network CopyCop (Storm-1516) very likely targeted the joint United States (US) and Armenian-backed Firebird AI data center in Hrazdan, Armenia, as part of a broader campaign to undermine Armenia's