# IO-Campaign-Collections
Collection of reports on Influence Operation campaigns.

## 2024

* Nov 26 - [[Recorded Future] "Operation Undercut" Shows Multifaceted Nature of SDA’s Influence Operations](https://go.recordedfuture.com/hubfs/reports/TA-RU-2024-1126.pdf)

* Sep 17 - [[Microsoft Threat Intelligence] Russia leverages cyber proxies and Volga Flood assets in expansive influence efforts](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/MTAC-Election-Report-4.pdf)

* Aug 13 - [[Redcorded Future] Malign Influence Threats Mount Ahead of US 2024 Elections](https://go.recordedfuture.com/hubfs/reports/ta-2024-0813.pdf)

* Jun 28 - [[Recorded Future] Sombres Influences: Russian and Iranian Influence Networks Target French Elections](https://go.recordedfuture.com/hubfs/reports/TA-2024-0628.pdf)

* Jun 24 - [[Recorded Future] Russia-Linked CopyCop Expands to Cover US Elections, Target Political Leaders](https://go.recordedfuture.com/hubfs/reports/cta-ru-2024-0624.pdf)

* May 30 - [[OpenAI] Disrupting deceptive uses of AI by covert influence operations](https://downloads.ctfassets.net/kftzwdyauwt9/5IMxzTmUclSOAcWUXbkVrK/3cfab518e6b10789ab8843bcca18b633/Threat_Intel_Report.pdf)

* May 21 - [[Sekoia] Master of Puppets: Uncovering the DoppelGänger pro-Russian influence campaign](https://blog.sekoia.io/master-of-puppets-uncovering-the-doppelganger-pro-russian-influence-campaign/)

* May 09 - [[Recorded Future] Russia-Linked CopyCop Uses LLMs to Weaponize Influence Content at Scale](https://go.recordedfuture.com/hubfs/reports/cta-2024-0509.pdf)

* May 08 - [[Recorded Future] Iran-Aligned Emerald Divide Influence Campaign Evolves to Exploit Israel-Hamas Conflict](https://go.recordedfuture.com/hubfs/reports/ta-2024-0508.pdf)

* Apr 17 - [[Microsoft Threat Analysis Center] Nation-states engage in US-focused influence operations ahead of US presidential election](https://blogs.microsoft.com/wp-content/uploads/prod/sites/5/2024/04/MTAC-Report-Elections-Report-Nation-states-engage-in-US-focused-influence-operations-ahead-of-US-presidential-election-04172024.pdf)

* Apr 16 - [[AI Forensics] No Embargo in Sight: Meta Lets Pro-Russia Propaganda Ads Flood the EU](https://aiforensics.org/uploads/No_Embargo_in_Sight_AI_Forensics_Report_ad7ede416b.pdf)

* Apr 05 - [[Microsoft Threat Intelligence] Same targets, new playbooks: East Asia threat actors employ unique methods](https://aka.ms/EastAsiaReport-Apr2024)

* Mar 28 - [[Mandiant] Life After Death? IO Campaigns Linked to Notorious Russian Businessman Prigozhin Persist After His Political Downfall and Death](https://cloud.google.com/blog/topics/threat-intelligence/io-campaigns-russian-prigozhin-persist/)

* Mar 27 - [[Alethea] Writing with Invisible Ink: Russia's Newest Disinformation Tactic](https://www.alethea.com/post/writing-with-invisible-ink)

* Feb 29 - [[Recorded Future] Russia Seeks to Exploit Western "War Fatigue" to Win in Ukraine](https://go.recordedfuture.com/hubfs/reports/ta-2024-0229.pdf)

* Feb 22 - [[SentinelOne] Doppelgänger | Russia-Aligned Influence Operation Targets Germany](https://www.sentinelone.com/labs/doppelganger-russia-aligned-influence-operation-targets-germany/)

* Feb 21 - [[ESET] Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war](https://www.welivesecurity.com/en/eset-research/operation-texonto-information-operation-targeting-ukrainian-speakers-context-war/)

## 2023

* Dec 05 - [[Recorded Future] Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics](https://go.recordedfuture.com/hubfs/reports/ta-2023-1205.pdf)

* Sep 07 - [[Althea Group] Chinese Influence Operation Spreads to American Alt-Platforms](https://www.alethea.com/post/chinese-influence-operation-spreads-to-american-alt-platforms)

* Sep 07 - [[Microsoft Threat Analysis Center] Digital threats from East Asia increase in breadth and effectiveness](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW)

* Aug 30 - [[Recorded Future] Empire Dragon Accelerates Covert Information Operations, Converges with Russian Narratives](https://go.recordedfuture.com/hubfs/reports/cta-2023-0830.pdf)

* Aug 29 - [[Meta] Meta’s Adversarial Threat Report, Second Quarter 2023](https://scontent-lga3-1.xx.fbcdn.net/v/t39.8562-6/10000000_180063885098584_6098733693167598956_n.pdf?_nc_cat=110&ccb=1-7&_nc_sid=ae5e01&_nc_ohc=xfoti16XMyMAX_jDnpK&_nc_ht=scontent-lga3-1.xx&oh=00_AfC5bDHMlCJo1RLcQfH79xiyB-UfTyVu_s64wu7zlM5y0Q&oe=64F1F5AE)

* Aug 21 - [[Graphika] Summit Old, Summit New - Russia-Linked Actors Leverage New and Old Tactics in Influence Operations Targeting Online Conversations About NATO Summit](https://public-assets.graphika.com/reports/graphika_report_summit_old_summit_new.pdf)

* Jul 24 - [[Mandiant] Pro-PRC HaiEnergy Campaign Exploits U.S. News Outlets via Newswire Services to Target U.S. Audiences; Evidence of Commissioned Protests in Washington, D.C.](https://www.mandiant.com/resources/blog/pro-prc-haienergy-us-news)

* Jul 19 - [[VIGINUM] RRN: A Complex and Persistent Information Manipulation Campaign](https://www.sgdsn.gouv.fr/files/files/20230719_NP_VIGINUM_RAPPORT-CAMPAGNE-RRN_EN.pdf)

* Jul 11 - [[Nisos] Chinese State-Linked Information Operation Revealed Social Media Account Takeover Potential](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/chinese-info-ops-account-takeover.pdf)

* May 24 - [[Nisos] Election Manipulation as a Business Model](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/election-manipulation-business-model.pdf)

* May 04 - [[Nisos] Venezuelan Marketing Specialist Behind AI-Generated Journalists Linked to Known Disinformation Network](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/ai-generated-venezuelan-disinformation-network.pdf)

* May 03 - [[Meta] Meta’s Adversarial Threat Report, First Quarter 2023](https://about.fb.com/wp-content/uploads/2023/05/Meta-Quarterly-Adversarial-Threat-Report-Q1-2023.pdf)

* May 02 - [[Microsoft Threat Intelligence] Iran turning to cyber-enabled influence operations for greater effect](https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/05/Iran-turning-to-cyber-enabled-influence-operations-for-greater-effect-05022023.pdf)

* May 02 - [[Nisos] Inauthentic Network Counters The Great Translation Movement](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/inauthentic-network-translation-movement.pdf)

* Apr 26 - [[Nisos] From Race to Bioweapons: Tracing Inauthentic Network Narratives to Pro-China Bloggers](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/inauthentic-chinese-network-narratives.pdf)

* Apr 26 - [[Australian Strategic Policy Institute] Gaming Public Opinion: The CCP’s increasingly sophisticated cyber-enabled influence operations](https://ad-aspi.s3.ap-southeast-2.amazonaws.com/2023-04/Gaming%20public%20opinion.pdf)

* Apr 19 - [[Nisos] How Bots Spread a Viral Disinformation Video Prior to the 2022 Brazilian Presidential Election](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/brazlilian-election-disinformation-campaign-2022.pdf)

* Feb 27 - [[Cardiff University] The Ghostwriter Campaign](https://www.cardiff.ac.uk/__data/assets/pdf_file/0005/2699483/Ghostwriter-Report-Final.pdf)

* Feb 23 - [[Graphika] Deepfake It Till You Make It - Pro-Chinese Actors Promote AI-Generated Video Footage of Fictitious People in Online Influence Operation](https://public-assets.graphika.com/reports/graphika-report-deepfake-it-till-you-make-it.pdf)

## 2022

* Dec 19 - [[Mandiant] Information Operations Targeting 2022 U.S. Midterm Elections Include Trolling, Narratives Surrounding Specific Races, Politicians](https://www.mandiant.com/resources/blog/information-operations-2022-midterm-elections)

* Dec 19 - [[Nisos] Colombian Election Disinformation Networks – Identifying the Role of Paramilitary Groups](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/colombian-election-disinformation-networks.pdf)

* Dec 13 - [[Graphika & Stanford Internet Observatory] Bad Reputation: Suspected Russian Actors Leverage Alternative Tech Platforms in Continued Effort to Covertly Influence Right-Wing U.S. Audiences](https://public-assets.graphika.com/reports/graphika_stanford_report_bad_reputation.pdf)

* Nov 10 - [[Google Threat Analysis Group] Prigozhin interests and Russian information operations](https://blog.google/threat-analysis-group/prigozhin-interests-and-russian-information-operations/)

* Nov 03 - [[Graphika] Same Schmitz, Different Day](https://graphika.com/posts/same-schmitz-different-day)

* Nov 01 - [[Election Integrity Partnership] Assessing Inauthentic Networks Commenting on the US Midterms](https://www.eipartnership.net/blog/inauthentic-foreign-networks)

* Oct 26 - [[Mandiant] Pro-PRC DRAGONBRIDGE Influence Campaign Leverages New TTPs to Aggressively Target U.S. Interests, Including Midterm Elections](https://www.mandiant.com/resources/blog/prc-dragonbridge-influence-elections)

* Oct 25 - [[Althea Group] Network of Inauthentic Twitter Accounts Spreads Polarizing Content Ahead of U.S. Midterm Elections](https://www.aletheagroup.com/post/network-of-inauthentic-twitter-accounts-spreads-polarizing-content-ahead-of-u-s-midterm-elections)

* Oct 19 - [[Nisos] Twitter: Fake Accounts Amplify Chinese State Media for the 20th National Congress](https://www.nisos.com/library/twitter-fake-accounts-amplify-ccp-for-national-congress-report/)

* Oct 05 - [[Nisos] Russian’s RT Leads a Global “Information Militia” on Social Media to Bypass Censorship on Ukraine-Related Disinformation](https://6068438.fs1.hubspotusercontent-na1.net/hubfs/6068438/Nisos-Report-on-RT-Global-Information-Militia.pdf)

* Sep 21 - [[Stanford Internet Observatory] My Heart Belongs to Kashmir: An Analysis of a Pro-Indian Army Covert Influence Operation on Twitter](https://stacks.stanford.edu/file/druid:zs105tw7107/20220921%20India%20takedown.pdf)

* Sep 12 - [[Graphika] Trolling Taiwan](https://graphika.com/posts/trolling-taiwan)

* Aug 24 - [[Graphika & Stanford Internet Observatory] Unheard Voice: Evaluating five years of pro-Western covert influence operations](https://stacks.stanford.edu/file/druid:nj914nx9540/unheard-voice-tt.pdf)

* Aug 04 - [[Stanford Internet Observatory] Mind Farce: An Investigation into an Inauthentic Facebook and Instagram Network Linked to an Israeli Public Relations Firm](https://stacks.stanford.edu/file/druid:vh191ny7721/20220804%20Mind%20Force.pdf)

* Aug 04 - [[Meta] Meta’s Adversarial Threat Report, Second Quarter 2022](https://about.fb.com/wp-content/uploads/2022/08/Quarterly-Adversarial-Threat-Report-Q2-2022.pdf)

* Aug 04 - [[Mandiant] Pro-PRC “HaiEnergy” Information Operations Campaign Leverages Infrastructure from Public Relations Firm to Disseminate Content on Inauthentic News Sites](https://www.mandiant.com/resources/pro-prc-information-operations-campaign-haienergy)

* Jul 12 - [[Google Threat Analysis Group] TAG Bulletin: Q2 2022](https://blog.google/threat-analysis-group/tag-bulletin-q2-2022/)

* Jul 07 - [[Recorded Future] Russian Information Operations Aim to Divide the Western Coalition on Ukraine](https://s3.documentcloud.org/documents/22080550/ta-2022-0707-1.pdf)

* Jun 28 - [[Mandiant] Pro-PRC DRAGONBRIDGE Influence Campaign Targets Rare Earths Mining Companies in Attempt to Thwart Rivalry to PRC Market Dominance](https://www.mandiant.com/resources/dragonbridge-targets-rare-earths-mining-companies)

* Jun 22 - [[Microsoft] Defending Ukraine: Early Lessons from the Cyber War](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE50KOK)

* May 18 - [[Mandiant] The IO Offensive: Information Operations Surrounding the Russian Invasion of Ukraine](https://www.mandiant.com/resources/information-operations-surrounding-ukraine)

* May 09 - [[CEPA] Post-Mortem: Russian and Chinese COVID-19 Information Operations](https://cepa.org/wp-content/uploads/2022/05/COVID-Phase-4-v3.pdf)

* Apr 07 - [[Graphika] Slash and Burner Accounts](https://public-assets.graphika.com/reports/graphika_report_slash_and_burner_accounts.pdf)

* Feb 28 - [[Google Threat Analysis Group] TAG Bulletin: Q1 2022](https://blog.google/threat-analysis-group/tag-bulletin-q1-2022/)

## 2021

* Dec 02 - [[Stanford Internet Observatory] One Topic, Two Networks: Evaluating Two Chinese Influence Operations on Twitter Related to Xinjiang](https://stacks.stanford.edu/file/druid:sn407zm8237/20211202-china-twitter-takedown.pdf)

* Dec 02 - [[Stanford Internet Observatory] In Bed with Embeds: How a Network Tied to IRA Operations Created Fake “Man on the Street” Content Embedded in News Articles](https://stacks.stanford.edu/file/druid:xw115vb5420/20211202-mena-twitter-takedown.pdf)

* Oct 11 - [[Graphika] Likes for Lorestan - Unraveling a Decade of Iran-Linked Information Operations Targeting Domestic Audiences and International Critics](https://public-assets.graphika.com/reports/graphika_report_likes_for_lorestan.pdf)

* Sep 07 - [[Mandiant] Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.](https://www.mandiant.com/resources/pro-prc-influence-campaign-expands-dozens-social-media-platforms-websites-and-forums)

* Jul 07 - [[Stanford Internet Observatory] My Heart Loves the Army: An Investigation into a Jordanian Disinformation Campaign on Facebook, TikTok and Twitter](https://stacks.stanford.edu/file/druid:hh528nc2557/20210707-jordan-fb-takedown.pdf)

* Jun 16 - [[Facebook] Removing Coordinated Inauthentic Behavior From Ethiopia](https://about.fb.com/news/2021/06/removing-coordinated-inauthentic-behavior-from-ethiopia/)

* Jun 07 - [[Graphika] Posing as Patriots](https://public-assets.graphika.com/reports/graphika_report_posing_as_patriots.pdf)

* Mar 17 - [[FireEye] Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/unc1151-ghostwriter-update-report.pdf)

* Mar 12 - [[CEPA] Information Bedlam: Russian and Chinese Information Operations During COVID-19](https://cepa.org/wp-content/uploads/2021/03/CEPA-Russia-China-9.14.21.pdf)

* Feb - [[Stanford Internet Observatory] Sockpuppets Target Nagorno-Karabakh](https://stacks.stanford.edu/file/druid:ym664kv8876/twitter-takedown-about-azerbaijan-feb-2021.pdf)

* Jan 12 - [[Graphika] Echoes of Fake News](https://public-assets.graphika.com/reports/graphika_report_echoes_of_fake_news.pdf)

## 2020

* Dec 15 - [[Stanford Internet Observatory] Stoking Conflicts by Keystroke: An Operation Run by IRA-Linked Individuals Targeting Libya, Sudan, and Syria](https://stacks.stanford.edu/file/druid:qg973fs1649/IRALibyaSudanSyriaReport.pdf)

* Dec 15 - [[Facebook] Removing Coordinated Inauthentic Behavior from France and Russia](https://about.fb.com/news/2020/12/removing-coordinated-inauthentic-behavior-france-russia/)

* Oct 22 - [[Omelas] Minds Besieged - Digital Warfare Against the American Electorate](https://www.omelas.io/mb-report)

* Sep 24 - [[Graphika] GRU and the Minions](https://public-assets.graphika.com/reports/graphika_report_gru_minions.pdf)

* Jul 28 - [[Mandiant] 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests](https://www.mandiant.com/resources/ghostwriter-influence-campaign)

* Jun 16 - [[Graphika] Secondary Infektion](https://secondaryinfektion.org/downloads/secondary-infektion-report.pdf)

* Jun 11 - [[Stanford Internet Observatory] Sockpuppets Spin COVID Yarns: An Analysis of PRC-Attributed June 2020 Twitter takedown](https://stacks.stanford.edu/file/druid:zf032rd0838/20200611_China_Report.pdf)

* May 12 - [[Omelas] Viral Overload - An Analysis of COVID-19 Information Operations](https://www.omelas.io/viral-overload)

* Apr 29 - [[Recorded Future] Chinese Influence Operations Evolve in Campaigns Targeting Taiwanese Elections, Hong Kong Protests](https://go.recordedfuture.com/hubfs/reports/cta-2020-0429.pdf)

* Apr 08 - [[Recorded Future] Intent to Infekt: ‘Operation Pinball’ Tactics Reminiscent of ‘Operation Secondary Infektion’](https://go.recordedfuture.com/hubfs/reports/cta-2020-0408.pdf)

* Apr 02 - [[Stanford Internet Observatory] “Fighting Like a Lion for Serbia”: An Analysis of Government-Linked Influence Operations in Serbia](https://fsi-live.s3.us-west-1.amazonaws.com/s3fs-public/serbia_march_twitter.pdf)

* Apr 02 - [[Stanford Internet Observatory] Blame it on Iran, Qatar, and Turkey: An analysis of a Twitter and Facebook operation linked to Egypt, the UAE, and Saudi Arabia](https://fsi-live.s3.us-west-1.amazonaws.com/s3fs-public/20200402_blame_it_on_iran_qatar_and_turkey_v2_0.pdf)

* Mar 30 - [[Recorded Future] Chinese State Media Seeks to Influence International Perceptions of COVID-19 Pandemic](https://go.recordedfuture.com/hubfs/reports/cta-2020-0330.pdf)

* Mar 12 - [[Facebook] Removing Coordinated Inauthentic Behavior From Russia](https://about.fb.com/news/2020/03/removing-coordinated-inauthentic-behavior-from-russia/)

* Mar 02 - [[Graphika] Operation Red Card](https://public-assets.graphika.com/reports/graphika_report_operation_redcard.pdf)

* Feb 21 - [[FireEye] ‘Ghostwriter’ Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned with Russian Security Interests](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/Ghostwriter-Influence-Campaign.pdf)

* Feb 12 - [[Graphika] From Russia With Blogs](https://public-assets.graphika.com/reports/graphika_report_from_russia_with_blogs.pdf)

* Feb 12 - [[FireEye] "Distinguished Impersonator" Information Operation That Previously Impersonated U.S. Politicians and Journalists on Social Media Leverages Fabricated U.S. Liberal Personas to Promote Iranian Interests](https://www.fireeye.com/blog/threat-research/2020/02/information-operations-fabricated-personas-to-promote-iranian-interests.html)

## 2019

* Oct 29 - [[Stanford Internet Observatory] Evidence of Russia-Linked Influence Operations in Africa](https://fsi-live.s3.us-west-1.amazonaws.com/s3fs-public/29oct2019_sio_-_russia_linked_influence_operations_in_africa.final_.pdf)

* Nov 08 - [[Stanford Internet Observatory] Potemkin Pages & Personas: Assessing GRU Online Operations, 2014-2019](https://fsi-live.s3.us-west-1.amazonaws.com/s3fs-public/potemkin-pages-personas-sio-wp.pdf)

* Sep 19 - [[Graphika] Cross-Platform Spam Network Targeted Hong Kong Protests](https://public-assets.graphika.com/reports/graphika_report_spamouflage.pdf)

* Jun 20 - [[Atlantic Council] The “Macron Leaks” Operation: A Post-Mortem](https://www.atlanticcouncil.org/wp-content/uploads/2019/06/The_Macron_Leaks_Operation-A_Post-Mortem.pdf)

* May 28 - [[FireEye] Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](https://www.fireeye.com/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html)

* May 17 - [[DFRLab] Inauthentic Israeli Facebook Assets Target the World](https://medium.com/dfrlab/inauthentic-israeli-facebook-assets-target-the-world-281ad7254264)

* Mar 06 - [[Recorded Future] Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion](https://go.recordedfuture.com/hubfs/reports/cta-2019-0306.pdf)

## 2018

* Nov - [[New Knowledge] The Tactics & Tropes of the Internet Research Agency](https://int.nyt.com/data/documenthelper/533-read-report-internet-research-agency/7871ea6d5b7bedafbf19/optimized/full.pdf)

* Aug 21 - [[FireEye] Suspected Iranian Influence Operation Leveraging Inauthentic News Sites and Social Media Aimed at U.S., U.K., Other Audiences](https://www.fireeye.com/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html)

## Unknown Date

* [[Omelas] Digital Assault on the US Defense Industrial Base - How US Defense Contractors are Targeted by Information Operations](https://www.omelas.io/defense-contractors)

## Analysis Frameworks

* [[DISARM Foundation] DISARM Disinformation TTP (Tactics, Techniques and Procedures) Framework](https://github.com/DISARMFoundation/DISARMframeworks)

* [[Recorded Future] The Diamond Model for Influence Operations Analysis](https://go.recordedfuture.com/hubfs/white-papers/diamond-model-influence-operations-analysis.pdf)

* [[FFI] Understanding Influence Operations in Social Media: A Cyber Kill Chain Approach](https://publications.ffi.no/nb/item/asset/dspace:7027/1855480.pdf)

* [[Atlantic Council] SCOTCH: A Framework for Rapidly Assessing Influence Operations](https://www.atlanticcouncil.org/blogs/geotech-cues/scotch-a-framework-for-rapidly-assessing-influence-operations/)

* [[Brookings] The Breakout Scale: Measuring the Impact of Influence Operations](https://www.brookings.edu/wp-content/uploads/2020/09/Nimmo_influence_operations_PDF.pdf)

* [[Francois] Disinformation ABC (+D)](https://science.house.gov/imo/media/doc/Francois%20Addendum%20to%20Testimony%20-%20ABC_Framework_2019_Sept_2019.pdf)

* [[CogSec Collaborative] AMITT Disinformation Tactics, Techniques and Processes (TTP) Framework](https://github.com/cogsec-collaborative/AMITT)