Background

Firebird, a US and Armenia-based AI cloud and infrastructure company, is constructing the Caucasus region’s first large-scale AI data center on a 200,000 square-mile site in Hrazdan, Kotayk Province. The project is a public-private collaborative effort with the US and Armenian governments and NVIDIA. Phase One of the project, scheduled for launch in July 2026, amounts to an approximately $500 million investment. Once operational, the facility will host more than 6,000 NVIDIA Blackwell GPUs delivering up to 110.6 exaflops of AI compute at 18 megawatts of power capacity. The data center’s Phase Two raises investment to approximately $4 billion, adding more than 41,000 additional GPUs to the facility, and placing Armenia among the top five countries globally for AI computing infrastructure.

The Firebird AI project has become a pillar of heightened US-Armenian diplomacy and Armenia's shift westward. The project rests on a framework signed between Armenia and the United States in August 2025 on semiconductors and AI. In February 2026, US Vice President JD Vance personally announced Phase Two during his visit to Yerevan. In May 2026, US Secretary of State Marco Rubio was the first sitting Secretary of State to visit the South Caucasus since 2012; during his visit to Yerevan, he signed a Charter on Comprehensive Strategic Partnership and a framework for critical minerals and rare earths. Armenia’s westward shift has come at the expense of its relationship with Russia, especially in the fields of security and energy. Armenia has frozen its participation in the Russia-led Collective Security Treaty Organization (CSTO) since February 2024, with Armenian Prime Minister Nikol Pashinyan describing the shift in December 2024 as "irreversible." The Kremlin has since signaled, for example, that Armenia's preferential gas pricing, a fraction of the rate charged to unaligned European buyers, depends on remaining within Russia's regional integration frameworks.

What Happened

CopyCop has targeted the Firebird facility in at least three documented instances since June 2026, occurring in the weeks immediately preceding the facility's scheduled Phase One opening. This campaign follows CopyCop’s multi-month campaign targeting Armenia’s June 7, 2026, parliamentary elections, during which the influence network frequently attempted to denigrate the public image of Prime Minister Pashinyan and the pro-Western Civil Contract party. Since Pashinyan’s reelection, CopyCop has almost certainly redirected operations to target the Firebird data center, shifting to a more timely narrative that continues to advance the overall objective of undermining Armenia’s pivot westward.

June 24, 2026, Fabricated Earthquake Risk Narrative

Beginning on June 24, 2026, Insikt Group observed a CopyCop amplifier account on a major Western social media platform sharing a video impersonating TechCrunch. The video, titled "Armenia AI Hub at Risk, Authorities Warn of Major Quake," claimed a magnitude 7.4 earthquake could imminently strike Kotayk Province and threaten the Firebird facility. The video was hosted on tech-crunch[.]org, a website registered June 21, 2026, through Namecheap (AS22612) just three days before publication. CSS stylesheet hash analysis linked the domain to previously confirmed CopyCop infrastructure imitating media brands, including haaretz24[.]com, euronews[.]us[.]com, and politico-24[.]com.

Amplification was limited to a small set of known CopyCop-linked accounts, including @Truthtellerftm, @GreenwaySh57854, and @Ibrahim_alFiqar, with overall viewership remaining low at the time of reporting. Independent researchers at the Gnida Project separately corroborated Insikt Group's attribution of the video to CopyCop.

June 30, 2026, Fabricated Power Grid Instability Claim

Beginning on June 30, 2026, Insikt Group observed a second CopyCop-attributed impersonation attempting to undermine confidence in the data center facility. This video impersonated Gizmodo journalist Webb Wright to claim that a combination of power outages, transmission limitations, and inadequate backup capacity created a "real risk that the multi-billion-dollar investment could become economically unsustainable, leaving investors facing substantial financial losses." It was hosted on gizmodo[.]cc, a domain registered June 26, 2026, through Namecheap and hosted via Hostinger (AS47583), an infrastructure pattern consistent with the June 24 instance and previous CopyCop operations. Amplification ran through four frequently tracked CopyCop accounts: @Truthtellerftm, @DangerousThinkg, @TheWyteRabbit1, and @SprinterPress.

July 7, 2026, Iranian Military Impersonation and Military Target Justification

Beginning on July 7, 2026, Insikt Group observed a third video attributed to CopyCop, this time impersonating Iranian state messaging, showing Iranian military assets signaling an intent to target the facility. The fabricated threat of strikes against the facility was justified by claims that the US had violated a ceasefire agreement, and that the Firebird facility provides "intelligence gathering" and "target acquisition data for American aggression." Unlike the two previous instances, the video was presented to audiences as authentic Iranian state messaging rather than framed as an independent media report.

Amplification was driven by @SprinterPress, @RoaaWarStudies, and @TheSaviour, with combined viewership across amplifiers exceeding 1.6 million, including more than 1.4 million views on the single @SprinterPress post, a substantially larger reach than either previous instance achieved.

Western Investment in Armenia is Likely at Risk of Being Targeted by Russian Influence Operations

Private-sector organizations involved in high-visibility infrastructure linked to the US or other Western governments or investment projects in Armenia likely face a growing risk of being targeted directly by CopyCop and similar Russia-aligned influence networks.

Russian influence in the South Caucasus is almost certainly a near-term and long-term priority for the Kremlin. Any efforts by South Caucasus governments to realign their relationship with Russia, whether through electing pro-Western parties or advancing pro-Western business deals, will almost certainly face heightened scrutiny from Moscow. As such, there are several additional high-profile Western investment activities that could be CopyCop targets in the future, given their shared profile with Firebird as US government-linked, publicly milestone-driven projects tied to Armenia's westward realignment.

TRIPP Corridor

The Trump Route for International Peace and Prosperity (TRIPP) is a proposed 43-kilometer road-and-rail corridor through southern Armenia connecting Azerbaijan to its Nakhchivan exclave, opening an east-west transit route bypassing both Russia and Iran. TRIPP originates from the Armenia-Azerbaijan peace agreement brokered at the Washington Peace Summit on August 8, 2025, followed by a TRIPP Implementation Framework released in January 2026. On May 26, 2026, US Secretary of State Marco Rubio and Armenian Foreign Minister Ararat Mirzoyan signed a framework agreement on strategic cooperation to formalize the development of TRIPP, alongside a separate agreement on critical minerals and rare earths cooperation.

CopyCop has already targeted TRIPP, predating the Firebird campaign by more than three months. On March 8, 2026, CopyCop amplifiers falsely claimed Armenia had granted Turkish company Limak Construction a 40-year concession over the Zangezur Corridor, contradicting the actual deal, which grants the US, not Türkiye, development rights of up to 99 years. Unlike its media impersonations, however, CopyCop’s content targeting Limak Construction was initially published in a legitimate Turkish media outlet, dikGAZETTE.

Metsamor Nuclear Power Plant

Armenia's Metsamor Nuclear Power Plant, a Soviet-era facility that remains the country's primary source of nuclear power, is the subject of ongoing negotiations to replace it with a US-designed small modular reactor. On February 9, 2026, Armenia and the US signed a civil nuclear cooperation agreement, known as a "123 Agreement," permitting up to $5 billion in nuclear technology exports to Armenia alongside $4 billion in long-term fuel and maintenance contracts. Notably, this deal faces a direct competing bid: Russian Deputy Foreign Minister Mikhail Galuzin stated publicly that Russia's state nuclear corporation, Rosatom, remains committed to its own nuclear power proposal for Armenia, giving Russia a concrete commercial and strategic stake in the outcome of the facility.

As of writing, Insikt Group has not observed CopyCop targeting the Metsamor facility or broader nuclear cooperation with the US, but we do assess that, like TRIPP, it is a likely candidate for future influence operations targeting Armenia, based on the following:

• Rosatom's competing proposal gives Russia a direct commercial stake in Armenia's nuclear future, distinct from its broader opposition to Armenia's westward realignment generally.
• CopyCop targeting Firebird on June 30 indicated the influence operation has already tested a narrative asserting critical infrastructure is unsafe or unreliable; attempting to reapply this template to Metasmor would carry a substantially higher potential to generate public fear if redirected at a nuclear facility.
• The multi-year decision window would give CopyCop considerably more time to develop a malign influence narrative than Firebird’s single Phase One launch date.

Critical Minerals and Rare Earths Development

On May 26, 2026, Armenia and the United States signed the Framework for Securing Supply in the Mining and Processing of Critical Minerals and Rare Earths, alongside the TRIPP agreement and the Charter on Comprehensive Strategic Partnership. The Framework commits both countries to securing and accelerating critical mineral supply chains needed for advanced technology manufacturing, drawing on existing mining and processing operations and new capacity expected from 2026 onward. It explicitly recognizes TRIPP's role in facilitating the transit of critical minerals from the South Caucasus and Central Asia. As of writing, Insikt Group has not observed CopyCop targeting the critical minerals framework specifically.

Implementation of the Framework will almost certainly be complicated by Russia's already entrenched ownership position in Armenia's mining sector. Russian billionaire Roman Trotsenko's GeoProMining controls Armenia's largest gold and copper-molybdenum mines, including the Sotk and Agarak sites, giving Russian business interests a direct commercial stake in the critical minerals and rare earth sector. The US sanctioned GeoProMining in 2024, after which ownership was restructured through new entities registered in the United Arab Emirates.

Mitigations

• Recorded Future customers can use the Recorded Future Intelligence Operations Platform to track CopyCop and related Russian influence operations, and to receive ongoing updates on newly identified infrastructure and amplifier accounts targeting Firebird and other Armenia-linked Western investment projects.
• Customers can use Recorded Future's Geopolitical Intelligence dashboard to monitor Insikt Group's ongoing analysis of Armenia's westward realignment and Russia's response, including developments tied to TRIPP, the Metsamor nuclear negotiations, and the critical minerals framework.
• Media organizations can use Recorded Future Brand Intelligence to identify impersonation attempts targeting their brand, including the typosquatting and logo abuse associated with CopyCop's impersonation of TechCrunch and Gizmodo.
• Impersonated organizations, including media outlets named in fabricated content, should engage takedown services to remove domains and accounts impersonating their brand.
• Impersonated organizations should also engage directly with social media trust and safety teams to expedite the removal of infringing content.

Outlook

CopyCop will likely continue targeting Armenia's flagship Western investment projects, with the Metsamor reactor decision and the critical minerals framework's implementation representing the next probable areas of influence narrative activity. The confirmed reuse of CopyCop amplifying accounts on a prominent Western social media platform to disseminate messages against TRIPP and Firebird indicates CopyCop maintains a persistent, redeployable network to launder targeted influence narratives. Organizations monitoring the indicators in this report will likely gain early warning of the network's next target before a full campaign develops. Insikt Group maintains a list of CopyCop amplifiers, which are used for continuous monitoring and regular updates to customers.

Russia will almost certainly continue relying on influence operations in an attempt to undermine the growing cooperation between Armenia and the West. Russia has lost significant conventional security and economic leverage over Armenia, stemming from Armenia’s freeze in Collective Security Treaty Organization (CSTO) participation and the recent US-Armenian commitments toward Firebird, TRIPP, the nuclear reactor negotiations, and the critical minerals framework. As the Kremlin’s influence over Armenia has waned, indirect operations such as influence operations have become the avenue for advancing Russian interests. Any future US-Armenia bilateral agreements would likely deepen Russia's reliance on influence operations, making future targeting more likely.

About Insikt Group^®

Recorded Future’s Insikt Group, the company’s threat research division, comprises analysts and security researchers with deep government, law enforcement, military, and intelligence agency experience. Its mission is to produce intelligence that reduces risk for customers, enables tangible outcomes, and prevents business disruption.

Related Resources

Explore expert insights, reports, and tools to strengthen your cybersecurity strategy.