Foreign interference

Influence Operations

Documented foreign interference and coordinated information operations — with attribution, techniques, and the evidence behind each.

Attributed to

Confidence

Showing 20 of 20

Storm-1679 / Matryoshka

2023-09 – ongoing · Persistent pro-Russian information-manipulation set; VIGINUM records only probable links with Russian actors and does not establish state direction; individual operators not publicly identified · 2 targets

media and institutional impersonationfabricated video reportsRussian-language Telegram seedingcoordinated cross-platform amplificationfact-checker baiting

1 elections · 3 evidence

Storm-1516

2023-08 – ongoing · Russia · 3 targets

staged source materialfabricated local-news sitesAI-generated contentdeepfakes and manipulated videocoordinated amplification

3 elections · 4 people · 3 evidence

Doppelganger / RRN

2022-05 – ongoing · Russia · 5 targets

media cloning / typosquattingcoordinated inauthentic amplificationforged official documents

1 elections · 5 evidence

Ghostwriter

2017 – ongoing · Belarus · 4 targets

website compromise (fabricated articles)hack-and-leakcredential theft / account compromiseforged documentsanti-NATO disinformation

1 elections · 3 evidence

Portal Kombat

2013 – ongoing · Russia · 8 targets

country-targeted portal networksautomated content republishingsearch-engine optimisationlocalised domain infrastructuresource laundering

1 elections · 3 evidence

Rokh Solis

2026-02 – 2026-03 · Indicators involving Blackcore; exact operator role unresolved · 1 targets

fabricated websitescoordinated cross-platform relaysinauthentic accountsartificial amplificationpolarising paired narratives

1 elections · 1 evidence

Romania TikTok Amplification Operation, 2024

2024-11 – 2024-12 · Unidentified coordinated promoter network · 1 targets

algorithm manipulationcoordinated inauthentic amplificationcovert influencer recruitmentundeclared political promotionrecycled account networks

1 elections · 1 people · 4 evidence

Șor Network Moldova Election Operations, 2024–2025

2024-09 – 2025-09 · Russia · 1 targets

vote buyingillegal political financingsanctioned-bank transfersTelegram coordinationcoordinated disinformation

2 elections · 1 people · 8 evidence

Iran 2024 U.S. Hack-and-Leak Campaign

2024-05 – 2024-09 · Iran · 1 targets

credential spearphishingsocial engineeringaccount compromisedocument thefthack-and-leak

1 elections · 2 people · 2 evidence

Zero Zeno India 2024 activity

2024-05 – 2024-05 · STOIC · 1 targets

generative-AI text productionfabricated personascomment seedingmulti-platform postingoperation-controlled websites

1 elections · 1 evidence

CGE U.S. 2024 AI Disinformation Operation

2024 – 2024-11 · Russia · 1 targets

generative-AI disinformationmanipulated videoimitation news websitesfalse corroboration across sitesorigin obfuscation

1 elections · 1 evidence

DRAGONBRIDGE / Spamouflage Taiwan 2024 Campaign

2023 – 2024-01 · China · 1 targets

coordinated inauthentic postingsynthetic audioAI-generated avatarscross-platform narrative seedingcomment spam

1 elections · 1 people · 1 evidence

Iran CDPC U.S. 2024 Influence Planning

2023 – 2024-11 · Iran · 1 targets

planned influence operationssocial and political tension amplification

1 elections · 1 evidence

PRC-linked WeChat narratives in Canada's 2021 election

2021-08 – 2021-09 · China · 1 targets

false narrativescoordinated WeChat amplificationDouyin distributionChinese-language media amplificationcandidate targeting

1 elections · 2 people · 2 evidence

Iran 2020 Voter-Threat and Disinformation Campaign

2020-08 – 2020-11 · Iran · 1 targets

voter-data theftfalse-flag impersonationvoter intimidation emailsfabricated election-security videomedia-system intrusion

1 elections · 3 evidence

Star Blizzard UK 2019 trade-document hack-and-leak

2019-10 – 2019-12 · Russia · 1 targets

spearphishingcredential theftdocument theftselective leakingonline amplification

1 elections · 2 evidence

MacronLeaks

2017-03 – 2017-05 · Russia · 1 targets

spear-phishinghack-and-leakdocument forgerycoordinated bot amplification

1 elections · 1 people · 4 evidence

GRU 2016 Hack-and-Leak Operation

2016-03 – 2016-11 · Russia · 1 targets

spear-phishingnetwork intrusionhack-and-leakfalse online personasstaged document releases

1 elections · 1 people · 4 evidence

Ukraine CEC Cyberattack, 2014

2014-03 – 2014-05 · Russia · 1 targets

election-system intrusionmalware deploymentdata deletiondistributed denial of servicefabricated result display

1 elections · 2 people · 3 evidence

Internet Research Agency 2016 Campaign

2014 – 2017 · Russia · 1 targets

fake personascoordinated inauthentic amplificationpolitical advertisingstaged rallies

1 elections · 5 evidence