{"id":59364,"date":"2025-09-18T00:00:07","date_gmt":"2025-09-18T00:00:07","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/"},"modified":"2025-09-18T00:00:07","modified_gmt":"2025-09-18T00:00:07","slug":"russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/","title":{"rendered":"Russian fake-news network, led by an ex-Florida sheriff&#8217;s deputy, storms back into action with 200+ new sites"},"content":{"rendered":"<p>The Russian troll farm that in the lead-up to the 2024 US presidential election posted a bizarro video claiming Democratic candidate Kamala Harris was a rhino poacher, is back with hundreds of new fake news websites serving up phony political commentary with an AI assist.<\/p>\n<p>In a paper published today, Recorded Future&#8217;s Insikt Group threat researchers also unveil evidence that <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2024\/10\/25\/russia_china_iran_election_disinfo\/\">the pro-Putin posters<\/a> known as CopyCop, aka <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2024\/09\/18\/russia_putin_trump_white_house\/\">Storm-1516<\/a>, use self-hosted, uncensored LLMs based on Meta&#8217;s Llama 3 open-source models to generate at least some of these fictional news stories.<\/p>\n<p>These websites are likely operated by <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/www.newsguardtech.com\/special-reports\/john-mark-dougan-russian-disinformation-network\/\">John Mark Dougan<\/a>, the security researchers claim.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,dmpu,\" data-sm=\",fluid,mpu,dmpu,\" data-md=\",fluid,mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Dougan is a former deputy sheriff from Florida who gained political asylum in Moscow in 2016, and is allegedly a <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/www.nytimes.com\/2024\/05\/29\/business\/mark-dougan-russia-disinformation.html\">disinformation purveyor<\/a> supported by the Kremlin. His phony media outlets have been cited in news articles or social media posts thousands of times, and both the <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/home.treasury.gov\/news\/press-releases\/jy2766\">US Treasury<\/a> and <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/www.washingtonpost.com\/world\/2024\/10\/23\/dougan-russian-disinformation-harris\/\">Washington Post<\/a> allege connections between Dougan, the Moscow-based Center for Geopolitical Expertise (CGE), and the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>In fact, the GRU reportedly funds the LLM servers that &#8220;almost certainly&#8221; rewrite articles from legitimate news sites to post on its fake media outlets, and also create deepfakes and other false content targeting political leaders in the US, Ukraine, France, and other countries, Insikt Group said.<\/p>\n<p>Since January, the researchers have uncovered at least 200 new websites that they attribute to CopyCop. &#8220;These websites are almost all impersonating fictional local media outlets in the US, France, Canada, and Norway, political parties and movements in France, Canada, and Armenia, or fictional fact-checking organizations publishing in Turkish, Ukrainian, and Swahili,&#8221; the report notes.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,dmpu,\" data-sm=\",fluid,mpu,dmpu,\" data-md=\",fluid,mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>This includes 35 sites registered in January but not spotted by Insikt Group until April, and &#8220;almost&nbsp;certainly designed for engaging US-based audiences.&#8221; The security company provides a full list of all of the CopyCop websites in the paper published on Wednesday.<\/p>\n<p>This is in addition to the <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/www.recordedfuture.com\/research\/stimmen-aus-moskau-russian-influence-operations-target-german-elections\">previously documented 94 CopyCop sites<\/a> targeting Germany&#8217;s federal elections in February, bringing the Russian trolls&#8217; total number this year to at least 300.<\/p>\n<p>Most of the US-themed sites portray themselves as local news portals, but their coverage skews national and international with a big focus on Russia and Ukraine. This includes a March 2025 story on <a target=\"_blank\" href=\"https:\/\/archive.is\/YsRAr\/\" rel=\"nofollow\">clearstory[.]news<\/a> about President Volodymyr Zelensky &#8220;misappropriating US taxpayer funds&#8221; by paying journos to depict US President Donald Trump negatively, and citing a likely forged document on Ukrainian presidential letterhead.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Several of the articles have been rewritten using an LLM, we&#8217;re told, with just six earning mentions on social media to date: allstatesnews[.]us, capitalcitydaily[.]com,&nbsp; fldaily[.]news, silvercity[.]news, usatimes[.]news, and wval[.]news.&nbsp;<\/p>\n<p>When asked about the implications for future US elections, Insikt Group&#8217;s Director of Global Issues Matt Mooney pointed to CopyCop&#8217;s effort to influence elections in<a target=\"_blank\" href=\"https:\/\/www.recordedfuture.com\/research\/russian-influence-assets-converge-on-moldovan-elections\" rel=\"nofollow\">Moldova<\/a>&nbsp;&nbsp;<a target=\"_blank\" href=\"https:\/\/www.recordedfuture.com\/research\/stimmen-aus-moskau-russian-influence-operations-target-german-elections\" rel=\"nofollow\">Germany<\/a>. &#8220;We assess that CopyCop&#8217;s substantial expansion of infrastructure demonstrates intent to persist and evolve in the global information environment,&#8221; he told<i>The Register<\/i>.<\/p>\n<p>Interestingly, the Kremlin-backed network appears to be trying to establish more of a foothold in Canada with at least two new websites: albertaseparatist[.]com and&nbsp;torontojournal[.]ca. The fake news stories populating these websites use the <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/www.nytimes.com\/2025\/05\/22\/world\/canada\/alberta-separatism-referendum.html\">growing pro-independence sentiment<\/a> in the province of Alberta to further polarize people based on their political beliefs.<\/p>\n<p>The Insikt Group&#8217;s research comes as US Homeland Security Secretary <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/01\/18\/cisa_election_security_isnt_political\/\">Kristi Noem has gutted<\/a> the US Cybersecurity and Infrastructure Security Agency&#8217;s efforts to counter online disinformation &#8211; especially as it relates to <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2024\/08\/08\/election_tech_is_fine_says\/\">election security<\/a>, prompting <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/08\/16\/election_workers_fears_after_cisa_cuts\/\">concern from election officials<\/a> who fear less federal support for the mid-term elections in 2026.<\/p>\n<p>Earlier this week, US Senators Mark Warner and Alex Padilla, both Democrats, <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/www.warner.senate.gov\/public\/_cache\/files\/8\/3\/833d45bd-0e4a-4e8e-8064-d6c2720459aa\/4EE6FBAFA6B84E8289F027DE52767D8BD9229E8CCE587A5E807ADF94D0186AA4.25.09.15-dni-election-briefing-letter-rules-intel.pdf\">urged<\/a> US Director of National Intelligence Tulsi Gabbard to provide a briefing for lawmakers on foreign election threats and address concerns that she may have directed the intelligence community to stop disclosing details about attempted foreign interference in US elections. \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2025\/09\/18\/russian_fakenews_network\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>As the Trump administration guts efforts to counter election disinfo The Russian troll farm that in the lead-up to the 2024 US presidential election posted a bizarro video claiming Democratic candidate Kamala Harris was a rhino poacher, is back with hundreds of new fake news websites serving up phony political commentary with an AI assist.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-59364","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Russian fake-news network, led by an ex-Florida sheriff&#039;s deputy, storms back into action with 200+ new sites 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Russian fake-news network, led by an ex-Florida sheriff&#039;s deputy, storms back into action with 200+ new sites 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-18T00:00:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Russian fake-news network, led by an ex-Florida sheriff&#8217;s deputy, storms back into action with 200+ new sites\",\"datePublished\":\"2025-09-18T00:00:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/\"},\"wordCount\":681,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/\",\"name\":\"Russian fake-news network, led by an ex-Florida sheriff's deputy, storms back into action with 200+ new sites 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2025-09-18T00:00:07+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Russian fake-news network, led by an ex-Florida sheriff&#8217;s deputy, storms back into action with 200+ new sites\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Russian fake-news network, led by an ex-Florida sheriff's deputy, storms back into action with 200+ new sites 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/","og_locale":"en_US","og_type":"article","og_title":"Russian fake-news network, led by an ex-Florida sheriff's deputy, storms back into action with 200+ new sites 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2025-09-18T00:00:07+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Russian fake-news network, led by an ex-Florida sheriff&#8217;s deputy, storms back into action with 200+ new sites","datePublished":"2025-09-18T00:00:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/"},"wordCount":681,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/","url":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/","name":"Russian fake-news network, led by an ex-Florida sheriff's deputy, storms back into action with 200+ new sites 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2025-09-18T00:00:07+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMtjprHQjyi_em_esQw23gAAAAQ&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/russian-fake-news-network-led-by-an-ex-florida-sheriffs-deputy-storms-back-into-action-with-200-new-sites\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Russian fake-news network, led by an ex-Florida sheriff&#8217;s deputy, storms back into action with 200+ new sites"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=59364"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59364\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=59364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=59364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=59364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}