IO-Campaign-Collections

Collection of reports on Influence Operation campaigns.

2022

• Dec 19 - [Mandiant] Information Operations Targeting 2022 U.S. Midterm Elections Include Trolling, Narratives Surrounding Specific Races, Politicians

• Nov 10 - [Google Threat Analysis Group] Prigozhin interests and Russian information operations

• Nov 03 - [Graphika] Same Schmitz, Different Day

• Nov 01 - [Election Integrity Partnership] Assessing Inauthentic Networks Commenting on the US Midterms

• Oct 26 - [Mandiant] Pro-PRC DRAGONBRIDGE Influence Campaign Leverages New TTPs to Aggressively Target U.S. Interests, Including Midterm Elections

• Oct 25 - [Althea Group] Network of Inauthentic Twitter Accounts Spreads Polarizing Content Ahead of U.S. Midterm Elections

• Oct 19 - [Nisos] Twitter: Fake Accounts Amplify Chinese State Media for the 20th National Congress

• Oct 05 - [Nisos] Russian’s RT Leads a Global “Information Militia” on Social Media to Bypass Censorship on Ukraine-Related Disinformation

• Sep 21 - [Stanford Internet Observatory] My Heart Belongs to Kashmir: An Analysis of a Pro-Indian Army Covert Influence Operation on Twitter

• Sep 12 - [Graphika] Trolling Taiwan

• Aug 24 - [Graphika & Stanford Internet Observatory] Unheard Voice: Evaluating five years of pro-Western covert influence operations

• Aug 04 - [Stanford Internet Observatory] Mind Farce: An Investigation into an Inauthentic Facebook and Instagram Network Linked to an Israeli Public Relations Firm

• Aug 04 - [Meta] Meta’s Adversarial Threat Report, Second Quarter 2022

• Aug 04 - [Mandiant] Pro-PRC “HaiEnergy” Information Operations Campaign Leverages Infrastructure from Public Relations Firm to Disseminate Content on Inauthentic News Sites

• Jul 12 - [Google Threat Analysis Group] TAG Bulletin: Q2 2022

• Jul 07 - [Recorded Future] Russian Information Operations Aim to Divide the Western Coalition on Ukraine

• Jun 28 - [Mandiant] Pro-PRC DRAGONBRIDGE Influence Campaign Targets Rare Earths Mining Companies in Attempt to Thwart Rivalry to PRC Market Dominance

• Jun 22 - [Microsoft] Defending Ukraine: Early Lessons from the Cyber War

• May 18 - [Mandiant] The IO Offensive: Information Operations Surrounding the Russian Invasion of Ukraine

• May 09 - [CEPA] Post-Mortem: Russian and Chinese COVID-19 Information Operations

• Apr 07 - [Graphika] Slash and Burner Accounts

• Feb 28 - [Google Threat Analysis Group] TAG Bulletin: Q1 2022

2021

• Dec 02 - [Stanford Internet Observatory] One Topic, Two Networks: Evaluating Two Chinese Influence Operations on Twitter Related to Xinjiang

• Dec 02 - [Stanford Internet Observatory] In Bed with Embeds: How a Network Tied to IRA Operations Created Fake “Man on the Street” Content Embedded in News Articles

• Oct 11 - [Graphika] Likes for Lorestan - Unraveling a Decade of Iran-Linked Information Operations Targeting Domestic Audiences and International Critics

• Sep 07 - [Mandiant] Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.

• Jul 07 - [Stanford Internet Observatory] My Heart Loves the Army: An Investigation into a Jordanian Disinformation Campaign on Facebook, TikTok and Twitter

• Jun 16 - [Facebook] Removing Coordinated Inauthentic Behavior From Ethiopia

• Jun 07 - [Graphika] Posing as Patriots

• Mar 17 - [FireEye] Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity

• Mar 12 - [CEPA] Information Bedlam: Russian and Chinese Information Operations During COVID-19

• Feb - [Stanford Internet Observatory] Sockpuppets Target Nagorno-Karabakh

• Jan 12 - [Graphika] Echoes of Fake News

2020

• Dec 15 - [Stanford Internet Observatory] Stoking Conflicts by Keystroke: An Operation Run by IRA-Linked Individuals Targeting Libya, Sudan, and Syria

• Dec 15 - [Facebook] Removing Coordinated Inauthentic Behavior from France and Russia

• Oct 22 - [Omelas] Minds Besieged - Digital Warfare Against the American Electorate

• Sep 24 - [Graphika] GRU and the Minions

• Jul 28 - [Mandiant] 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests

• Jun 16 - [Graphika] Secondary Infektion

• Jun 11 - [Stanford Internet Observatory] Sockpuppets Spin COVID Yarns: An Analysis of PRC-Attributed June 2020 Twitter takedown

• May 12 - [Omelas] Viral Overload - An Analysis of COVID-19 Information Operations

• Apr 29 - [Recorded Future] Chinese Influence Operations Evolve in Campaigns Targeting Taiwanese Elections, Hong Kong Protests

• Apr 08 - [Recorded Future] Intent to Infekt: ‘Operation Pinball’ Tactics Reminiscent of ‘Operation Secondary Infektion’

• Apr 02 - [Stanford Internet Observatory] “Fighting Like a Lion for Serbia”: An Analysis of Government-Linked Influence Operations in Serbia

• Apr 02 - [Stanford Internet Observatory] Blame it on Iran, Qatar, and Turkey: An analysis of a Twitter and Facebook operation linked to Egypt, the UAE, and Saudi Arabia

• Mar 30 - [Recorded Future] Chinese State Media Seeks to Influence International Perceptions of COVID-19 Pandemic

• Mar 12 - [Facebook] Removing Coordinated Inauthentic Behavior From Russia

• Mar 02 - [Graphika] Operation Red Card

• Feb 21 - [FireEye] ‘Ghostwriter’ Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned with Russian Security Interests

• Feb 12 - [Graphika] From Russia With Blogs

• Feb 12 - [FireEye] "Distinguished Impersonator" Information Operation That Previously Impersonated U.S. Politicians and Journalists on Social Media Leverages Fabricated U.S. Liberal Personas to Promote Iranian Interests

2019

• Oct 29 - [Stanford Internet Observatory] Evidence of Russia-Linked Influence Operations in Africa

• Nov 08 - [Stanford Internet Observatory] Potemkin Pages & Personas: Assessing GRU Online Operations, 2014-2019

• Sep 19 - [Graphika] Cross-Platform Spam Network Targeted Hong Kong Protests

• Jun 20 - [Atlantic Council] The “Macron Leaks” Operation: A Post-Mortem

• May 28 - [FireEye] Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests

• May 17 - [DFRLab] Inauthentic Israeli Facebook Assets Target the World

• Mar 06 - [Recorded Future] Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion

2018

• Nov - [New Knowledge] The Tactics & Tropes of the Internet Research Agency

• Aug 21 - [FireEye] Suspected Iranian Influence Operation Leveraging Inauthentic News Sites and Social Media Aimed at U.S., U.K., Other Audiences

Unknown Date

• [Omelas] Digital Assault on the US Defense Industrial Base - How US Defense Contractors are Targeted by Information Operations

Analysis Frameworks

• [DISARM Foundation] DISARM Disinformation TTP (Tactics, Techniques and Procedures) Framework

• [Recorded Future] The Diamond Model for Influence Operations Analysis

• [FFI] Understanding Influence Operations in Social Media: A Cyber Kill Chain Approach

• [Atlantic Council] SCOTCH: A Framework for Rapidly Assessing Influence Operations

• [Brookings] The Breakout Scale: Measuring the Impact of Influence Operations

• [Francois] Disinformation ABC (+D)

• [CogSec Collaborative] AMITT Disinformation Tactics, Techniques and Processes (TTP) Framework