IO-Campaign-Collections

Collection of reports on Influence Operation campaigns.

2022

• May 18 - [Mandiant] The IO Offensive: Information Operations Surrounding the Russian Invasion of Ukraine

• Apr 07 - [Graphika] Slash and Burner Accounts

2021

• Dec 02 - [Stanford Internet Observatory] One Topic, Two Networks: Evaluating Two Chinese Influence Operations on Twitter Related to Xinjiang

• Dec 02 - [Stanford Internet Observatory] In Bed with Embeds: How a Network Tied to IRA Operations Created Fake “Man on the Street” Content Embedded in News Articles

• Oct 11 - [Graphika] Likes for Lorestan - Unraveling a Decade of Iran-Linked Information Operations Targeting Domestic Audiences and International Critics

• Sep 07 - [Mandiant] Pro-PRC Influence Campaign Expands to Dozens of Social Media Platforms, Websites, and Forums in at Least Seven Languages, Attempted to Physically Mobilize Protesters in the U.S.

• Jul 07 - [Stanford Internet Observatory] My Heart Loves the Army: An Investigation into a Jordanian Disinformation Campaign on Facebook, TikTok and Twitter

• Jun 16 - [Facebook] Removing Coordinated Inauthentic Behavior From Ethiopia

• Jun 07 - [Graphika] Posing as Patriots

• Mar 17 - [FireEye] Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity

• Feb - [Stanford Internet Observatory] Sockpuppets Target Nagorno-Karabakh

• Jan 12 - [Graphika] Echoes of Fake News

2020

• Dec 15 - [Stanford Internet Observatory] Stoking Conflicts by Keystroke: An Operation Run by IRA-Linked Individuals Targeting Libya, Sudan, and Syria

• Dec 15 - [Facebook] Removing Coordinated Inauthentic Behavior from France and Russia

• Sep 24 - [Graphika] GRU and the Minions

• Jul 28 - [Mandiant] 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests

• Jun 16 - [Graphika] Secondary Infektion

• Jun 11 - [Stanford Internet Observatory] Sockpuppets Spin COVID Yarns: An Analysis of PRC-Attributed June 2020 Twitter takedown

• Apr 29 - [Recorded Future] Chinese Influence Operations Evolve in Campaigns Targeting Taiwanese Elections, Hong Kong Protests

• Apr 08 - [Recorded Future] Intent to Infekt: ‘Operation Pinball’ Tactics Reminiscent of ‘Operation Secondary Infektion’

• Apr 02 - [Stanford Internet Observatory] “Fighting Like a Lion for Serbia”: An Analysis of Government-Linked Influence Operations in Serbia

• Apr 02 - [Stanford Internet Observatory] Blame it on Iran, Qatar, and Turkey: An analysis of a Twitter and Facebook operation linked to Egypt, the UAE, and Saudi Arabia

• Mar 30 - [Recorded Future] Chinese State Media Seeks to Influence International Perceptions of COVID-19 Pandemic

• Mar 12 - [Facebook] Removing Coordinated Inauthentic Behavior From Russia

• Mar 02 - [Graphika] Operation Red Card

• Feb 21 - [FireEye] ‘Ghostwriter’ Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned with Russian Security Interests

• Feb 12 - [Graphika] From Russia With Blogs

• Feb 12 - [FireEye] "Distinguished Impersonator" Information Operation That Previously Impersonated U.S. Politicians and Journalists on Social Media Leverages Fabricated U.S. Liberal Personas to Promote Iranian Interests

2019

• Oct 29 - [Stanford Internet Observatory] Evidence of Russia-Linked Influence Operations in Africa

• Nov 08 - [Stanford Internet Observatory] Potemkin Pages & Personas: Assessing GRU Online Operations, 2014-2019

• Sep 19 - [Graphika] Cross-Platform Spam Network Targeted Hong Kong Protests

• Jun 20 - [Atlantic Council] The “Macron Leaks” Operation: A Post-Mortem

• May 28 - [FireEye] Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests

• May 17 - [DFRLab] Inauthentic Israeli Facebook Assets Target the World

• Mar 06 - [Recorded Future] Beyond Hybrid War: How China Exploits Social Media to Sway American Opinion

2018

• Nov - [New Knowledge] The Tactics & Tropes of the Internet Research Agency

• Aug 21 - [FireEye] Suspected Iranian Influence Operation Leveraging Inauthentic News Sites and Social Media Aimed at U.S., U.K., Other Audiences

Analysis Frameworks

• [Recorded Future] The Diamond Model for Influence Operations Analysis

• [FFI] Understanding Influence Operations in Social Media: A Cyber Kill Chain Approach

• [Atlantic Council] SCOTCH: A Framework for Rapidly Assessing Influence Operations

• [Brookings] The Breakout Scale: Measuring the Impact of Influence Operations

• [Francois] Disinformation ABC (+D)

• [CogSec Collaborative] AMITT Disinformation Tactics, Techniques and Processes (TTP) Framework