IO-Campaign-Collections

Collection of reports on Influence Operation campaigns.

2024

• Nov 26 - [Recorded Future] "Operation Undercut" Shows Multifaceted Nature of SDA’s Influence Operations

• Sep 17 - [Microsoft Threat Intelligence] Russia leverages cyber proxies and Volga Flood assets in expansive influence efforts

• Aug 13 - [Redcorded Future] Malign Influence Threats Mount Ahead of US 2024 Elections

• Jun 28 - [Recorded Future] Sombres Influences: Russian and Iranian Influence Networks Target French Elections

• Jun 24 - [Recorded Future] Russia-Linked CopyCop Expands to Cover US Elections, Target Political Leaders

• May 30 - [OpenAI] Disrupting deceptive uses of AI by covert influence operations

• May 21 - [Sekoia] Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign

• May 09 - [Recorded Future] Russia-Linked CopyCop Uses LLMs to Weaponize Influence Content at Scale

• May 08 - [Recorded Future] Iran-Aligned Emerald Divide Influence Campaign Evolves to Exploit Israel-Hamas Conflict

• Apr 17 - [Microsoft Threat Analysis Center] Nation-states engage in US-focused influence operations ahead of US presidential election

• Apr 16 - [AI Forensics] No Embargo in Sight: Meta Lets Pro-Russia Propaganda Ads Flood the EU

• Apr 05 - [Microsoft Threat Intelligence] Same targets, new playbooks: East Asia threat actors employ unique methods

• Mar 28 - [Mandiant] Life After Death? IO Campaigns Linked to Notorious Russian Businessman Prigozhin Persist After His Political Downfall and Death

• Mar 27 - [Alethea] Writing with Invisible Ink: Russia's Newest Disinformation Tactic

• Feb 29 - [Recorded Future] Russia Seeks to Exploit Western "War Fatigue" to Win in Ukraine

• Feb 22 - [SentinelOne] Doppelgänger | Russia-Aligned Influence Operation Targets Germany

• Feb 21 - [ESET] Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

2023

• Dec 05 - [Recorded Future] Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics

• Sep 07 - [Althea Group] Chinese Influence Operation Spreads to American Alt-Platforms

• Sep 07 - [Microsoft Threat Analysis Center] Digital threats from East Asia increase in breadth and effectiveness

• Aug 30 - [Recorded Future] Empire Dragon Accelerates Covert Information Operations, Converges with Russian Narratives

• Aug 29 - [Meta] Meta’s Adversarial Threat Report, Second Quarter 2023

• Aug 21 - [Graphika] Summit Old, Summit New - Russia-Linked Actors Leverage New and Old Tactics in Influence Operations Targeting Online Conversations About NATO Summit

• Jul 24 - [Mandiant] Pro-PRC HaiEnergy Campaign Exploits U.S. News Outlets via Newswire Services to Target U.S. Audiences; Evidence of Commissioned Protests in Washington, D.C.

• Jul 19 - [VIGINUM] RRN: A Complex and Persistent Information Manipulation Campaign

• Jul 11 - [Nisos] Chinese State-Linked Information Operation Revealed Social Media Account Takeover Potential

• May 24 - [Nisos] Election Manipulation as a Business Model

• May 04 - [Nisos] Venezuelan Marketing Specialist Behind AI-Generated Journalists Linked to Known Disinformation Network

• May 03 - [Meta] Meta’s Adversarial Threat Report, First Quarter 2023

• May 02 - [Microsoft Threat Intelligence] Iran turning to cyber-enabled influence operations for greater effect

• May 02 - [Nisos] Inauthentic Network Counters The Great Translation Movement

• Apr 26 - [Nisos] From Race to Bioweapons: Tracing Inauthentic Network Narratives to Pro-China Bloggers

• Apr 26 - [Australian Strategic Policy Institute] Gaming Public Opinion: The CCP’s increasingly sophisticated cyber-enabled influence operations

• Apr 19 - [Nisos] How Bots Spread a Viral Disinformation Video Prior to the 2022 Brazilian Presidential Election

• Feb 27 - [Cardiff University] The Ghostwriter Campaign

• Feb 23 - [Graphika] Deepfake It Till You Make It - Pro-Chinese Actors Promote AI-Generated Video Footage of Fictitious People in Online Influence Operation

2022

• Dec 19 - [Mandiant] Information Operations Targeting 2022 U.S. Midterm Elections Include Trolling, Narratives Surrounding Specific Races, Politicians

• Dec 19 - [Nisos] Colombian Election Disinformation Networks – Identifying the Role of Paramilitary Groups

• Dec 13 - [Graphika & Stanford Internet Observatory] Bad Reputation: Suspected Russian Actors Leverage Alternative Tech Platforms in Continued Effort to Covertly Influence Right-Wing U.S. Audiences

• Nov 10 - [Google Threat Analysis Group] Prigozhin interests and Russian information operations

• Nov 03 - [Graphika] Same Schmitz, Different Day

• Nov 01 - [Election Integrity Partnership] Assessing Inauthentic Networks Commenting on the US Midterms

• Oct 26 - [Mandiant] Pro-PRC DRAGONBRIDGE Influence Campaign Leverages New TTPs to Aggressively Target U.S. Interests, Including Midterm Elections

• Oct 25 - [Althea Group] Network of Inauthentic Twitter Accounts Spreads Polarizing Content Ahead of U.S. Midterm Elections

• Oct 19 - [Nisos] Twitter: Fake Accounts Amplify Chinese State Media for the 20th National Congress

• Oct 05 - [Nisos] Russian’s RT Leads a Global “Information Militia” on Social Media to Bypass Censorship on Ukraine-Related Disinformation

• Sep 21 - [Stanford Internet Observatory] My Heart Belongs to Kashmir: An Analysis of a Pro-Indian Army Covert Influence Operation on Twitter

• Sep 12 - [Graphika] Trolling Taiwan

• Aug 24 - [Graphika & Stanford Internet Observatory] Unheard Voice: Evaluating five years of pro-Western covert influence operations

• Aug 04 - [Stanford Internet Observatory] Mind Farce: An Investigation into an Inauthentic Facebook and Instagram Network Linked to an Israeli Public Relations Firm

• Aug 04 - [Meta] Meta’s Adversarial Threat Report, Second Quarter 2022

• Aug 04 - [Mandiant] Pro-PRC “HaiEnergy” Information Operations Campaign Leverages Infrastructure from Public Relations Firm to Disseminate Content on Inauthentic News Sites

• Jul 12 - [Google Threat Analysis Group] TAG Bulletin: Q2 2022

• Jul 07 - [Recorded Future] Russian Information Operations Aim to Divide the Western Coalition on Ukraine

• Jun 28 - [Mandiant] Pro-PRC DRAGONBRIDGE Influence Campaign Targets Rare Earths Mining Companies in Attempt to Thwart Rivalry to PRC Market Dominance

• Jun 22 - [Microsoft] Defending Ukraine: Early Lessons from the Cyber War

• May 18 - [Mandiant] The IO Offensive: Information Operations Surrounding the Russian Invasion of Ukraine

• May 09 - [CEPA] Post-Mortem: Russian and Chinese COVID-19 Information Operations

• Apr 07 - [Graphika] Slash and Burner Accounts

• Feb 28 - [Google Threat Analysis Group] TAG Bulletin: Q1 2022

2021

• Dec 02 - [Stanford Internet Observatory] One Topic, Two Networks: Evaluating Two Chinese Influence Operations on Twitter Related to Xinjiang

• Dec 02 - [Stanford Internet Observatory] In Bed with Embeds: How a Network Tied to IRA Operations Created Fake “Man on the Street” Content Embedded in News Articles

• Oct 11 - [Graphika] Likes for Lorestan - Unraveling a Decade of Iran-Linked Information Operations Targeting Domestic Audiences and International Critics

• Sep 07 - [Mandiant] Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.

• Jul 07 - [Stanford Internet Observatory] My Heart Loves the Army: An Investigation into a Jordanian Disinformation Campaign on Facebook, TikTok and Twitter

• Jun 16 - [Facebook] Removing Coordinated Inauthentic Behavior From Ethiopia

• Jun 07 - [Graphika] Posing as Patriots

• Mar 17 - [FireEye] Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity

• Mar 12 - [CEPA] Information Bedlam: Russian and Chinese Information Operations During COVID-19

• Feb - [Stanford Internet Observatory] Sockpuppets Target Nagorno-Karabakh

• Jan 12 - [Graphika] Echoes of Fake News

2020

• Dec 15 - [Stanford Internet Observatory] Stoking Conflicts by Keystroke: An Operation Run by IRA-Linked Individuals Targeting Libya, Sudan, and Syria

• Dec 15 - [Facebook] Removing Coordinated Inauthentic Behavior from France and Russia

• Oct 22 - [Omelas] Minds Besieged - Digital Warfare Against the American Electorate

• Sep 24 - [Graphika] GRU and the Minions

• Jul 28 - [Mandiant] 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests

• Jun 16 - [Graphika] Secondary Infektion

• Jun 11 - [Stanford Internet Observatory] Sockpuppets Spin COVID Yarns: An Analysis of PRC-Attributed June 2020 Twitter takedown

• May 12 - [Omelas] Viral Overload - An Analysis of COVID-19 Information Operations

• Apr 29 - [Recorded Future] Chinese Influence Operations Evolve in Campaigns Targeting Taiwanese Elections, Hong Kong Protests

• Apr 08 - [Recorded Future] Intent to Infekt: ‘Operation Pinball’ Tactics Reminiscent of ‘Operation Secondary Infektion’

• Apr 02 - [Stanford Internet Observatory] “Fighting Like a Lion for Serbia”: An Analysis of Government-Linked Influence Operations in Serbia

• Apr 02 - [Stanford Internet Observatory] Blame it on Iran, Qatar, and Turkey: An analysis of a Twitter and Facebook operation linked to Egypt, the UAE, and Saudi Arabia

• Mar 30 - [Recorded Future] Chinese State Media Seeks to Influence International Perceptions of COVID-19 Pandemic

• Mar 12 - [Facebook] Removing Coordinated Inauthentic Behavior From Russia

• Mar 02 - [Graphika] Operation Red Card

• Feb 21 - [FireEye] ‘Ghostwriter’ Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned with Russian Security Interests

• Feb 12 - [Graphika] From Russia With Blogs

• Feb 12 - [FireEye] "Distinguished Impersonator" Information Operation That Previously Impersonated U.S. Politicians and Journalists on Social Media Leverages Fabricated U.S. Liberal Personas to Promote Iranian Interests

2019

• Oct 29 - [Stanford Internet Observatory] Evidence of Russia-Linked Influence Operations in Africa

• Nov 08 - [Stanford Internet Observatory] Potemkin Pages & Personas: Assessing GRU Online Operations, 2014-2019

• Sep 19 - [Graphika] Cross-Platform Spam Network Targeted Hong Kong Protests

• Jun 20 - [Atlantic Council] The “Macron Leaks” Operation: A Post-Mortem

• May 28 - [FireEye] Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests

• May 17 - [DFRLab] Inauthentic Israeli Facebook Assets Target the World

• Mar 06 - [Recorded Future] Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion

2018

• Nov - [New Knowledge] The Tactics & Tropes of the Internet Research Agency

• Aug 21 - [FireEye] Suspected Iranian Influence Operation Leveraging Inauthentic News Sites and Social Media Aimed at U.S., U.K., Other Audiences

Unknown Date

• [Omelas] Digital Assault on the US Defense Industrial Base - How US Defense Contractors are Targeted by Information Operations

Analysis Frameworks

• [DISARM Foundation] DISARM Disinformation TTP (Tactics, Techniques and Procedures) Framework

• [Recorded Future] The Diamond Model for Influence Operations Analysis

• [FFI] Understanding Influence Operations in Social Media: A Cyber Kill Chain Approach

• [Atlantic Council] SCOTCH: A Framework for Rapidly Assessing Influence Operations

• [Brookings] The Breakout Scale: Measuring the Impact of Influence Operations

• [Francois] Disinformation ABC (+D)

• [CogSec Collaborative] AMITT Disinformation Tactics, Techniques and Processes (TTP) Framework