Russia-linked troll farm led by Florida ex-cop is powered by Meta’s Llama 3

CopyCop, a Russian influence network discovered early last year, uses Meta’s Llama 3 to create hundreds of fake websites and serve up pro-Kremlin political commentary on them. The mastermind? A former deputy sheriff from Florida.

US citizen and fugitive John Mark Dougan fled to Russia in 2016 after gaining political asylum in Moscow. He soon began working as a disinformation purveyor supported by the Kremlin.

According to Insikt Group, Recorded Future's threat research division, Dougan is more specifically a tool for the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), publishing content prepared by the Moscow-based Center for Geopolitical Expertise (CGE).

The AI-powered CopyCop network plagiarizes mainstream media content, turns it into politically-biased propaganda, and automatically spreads it around using inauthentic media outlets in the United States, the United Kingdom, or France.

“No good AI models for Russian news”

Now, researchers have unveiled evidence that CopyCop, also known as Storm-1516, has expanded its operations to more countries.

It also turns out that the propagandists use self-hosted, uncensored large language models (LLMs) based on Meta’s Llama 3 open-source models to generate fictional news stories, Insikt Group revealed in a paper published on Thursday.

It was already known that CopyCop operators are using LLMs to rewrite articles from legitimate news outlets to post on inauthentic websites. But it seems they’ve been unhappy with the results.

Curious what others think about this story? Contribute your thoughts to the debate below.

Dougan expressed his frustration with using Western LLMs to generate pro-Russian content in a January 2025 roundtable in Moscow, stating that “right now there are no very good models for AI to amplify Russian news.”

“We need to start training AI models without this Western bias. We need to train it from the Russian perspective,” he said.

According to Insikt Group, this framing reinforces the assessment that CopyCop is “very likely” using self-hosted, uncensored LLMs for content generation rather than relying on commercial LLM APIs.

During that same roundtable, Dougal mentioned an “uncensored” version of Meta’s Llama models. Researchers say he most probably meant a model based on Meta’s Llama-3.1-8b.

Spreading anti-Ukrainian narratives

According to Insikt Group, using local, uncensored models is likely a constraint that “hampers the network’s ability to consistently generate content without including operational security mistakes.”

Still, at least 200 new websites have been created. Some serve fake news, others impersonate political parties and movements in, for instance, France, Canada, or Armenia.

The disinformation network is targeting pro-Western leadership with pro-Russian and anti-Ukrainian themes in support of Russia’s invasion.

“CopyCop has also established a regionalized network of websites posing as a fictional fact-checking organization publishing content in Turkish, Ukrainian, and Swahili, languages never featured by the network before,” said Insikt Group.

The disinformation network is targeting pro-Western leadership with pro-Russian and anti-Ukrainian themes in support of Russia’s invasion, the researchers explained. The goal is to undermine support for Kyiv.

For example, in March 2025, the CopyCop-attributed source clearstory[.]news published content suggesting that the Ukrainian President Volodymyr Zelensky was “misappropriating US taxpayer funds” by paying journalists to negatively depict US President Donald Trump, citing a forged document on Ukrainian presidential letterhead.

In a separate instance, the Ukrainian government was accused of covertly sponsoring military aid to Mexican cartel groups, which were designated as foreign terrorist organizations in the US in February 2025.

In late 2024, the US Treasury explicitly said in a press release that the Moscow-based CGE works directly with a GRU unit that oversees sabotage, political interference operations, and cyberwarfare targeting the West.

However, the Trump administration has since chosen to pay a lot less attention to efforts to counter online disinformation. Some reports allege that the White House wants the intelligence organizations to stop disclosing details about attempted foreign interference in US elections.

Unlock more exclusive Cybernews content on YouTube