GamaCopy is a cyberespionage threat actor, first identified in August 2021, known for its distinctive false-flag operation of mimicking the tactics, techniques, and procedures of the Russia-linked Gamaredon group. Assessed with high confidence to have a pro-Ukraine alignment, GamaCopy's primary motivation is state-sponsored espionage, specifically targeting Russian entities to gather sensitive intelligence amid the Russia-Ukraine conflict. This group stands apart due to its deliberate obfuscation of origin by using Russian-language lures and replicating Gamaredon's operational style, while exclusively targeting Russian defense industrial base, military facilities, government agencies, and critical infrastructure sectors.