This blog analyzes a recent cyfluence operation that briefly hijacked Iranian state TV amid a nationwide internet blackout. It focuses onRecently, activists briefly hijacked Iranian state television. This blog analyzes the events surrounding what may be a recent cyfluence operation.

Following Iran’s nationwide internet blackout, the sockpuppet accounts driving several coordinated narrative strands abruptly stopped posting in near unison. This repeated blackout-to-silence pattern is a strong indicator of foreign CIB and materially increases confidence in attribution to Iran-based operators.

China is increasingly using “counter-operator” measures: instead of only targeting content, it pressures the people behind influence and cyber operations through bounties, doxxing, sanctions, and “naming and shaming” (e.g., Taiwan, Canada). The aims are deterrence, degrading adversary capabilities, and narrative control.

Anthropic claims that Claude Code ran most parts of a cyber-espionage intrusion on its own. Experts doubt this because clear technical proof is missing. The text applies this disputed case to HIC and Cyfluence. It asks how agentic AI could speed up influence workflows, automate key tasks, and scale operations. If such autonomy becomes reliable, the technical phases of influence campaigns could expand in speed and impact.

Tonga votes on 20 Nov 2025. The Pacific monarchy faces economic dependence, regional competition, and growing information disorder. Local efforts exist, but limited institutional capacity leaves gaps ahead of the elections.

The blog introduces the actor-specific, granular analytical approach, which assesses digital influence operations by examining actors, structures, and intentions, rather than treating them as a uniform threat. Using IRSEM’s "Baybridge" case, it shows how bureaucratic incentives and commercial self-interest can undermine strategic effectiveness.

A September 3 data leak exposed internal files of pro-Russian Moldovan politician Ilan Shor and his “Victorie Bloc,” revealing a financed influence network linked to Russia. The leak, paired with targeted intimidation messages, severely disrupted the group. Analysts view it as a coordinated “Cyfluence Counteroperation” that effectively neutralized and delegitimized Shor’s organization just before Moldova’s elections.

The Czech parliamentary elections on 3–4 October 2025 face heavy digital interference. Russia and increasingly China exploit Telegram networks, disinformation portals, and fake TikTok accounts to spread distrust, voter apathy, and anti-Western narratives. According to CERA, the main risks are erosion of democratic trust, voter demobilization, and the strengthening of populist and pro-Russian forces.

The FDEI Country Report highlights how influence in Moldova is being shaped by coordinated campaigns targeting the 2025 elections. Russian-linked networks deploy cloned news sites, Telegram bots, and AI-generated content to spread disinformation and manipulate public perception. These campaigns aim to erode trust in institutions, polarize the electorate, and undermine cooperation with the EU and neighboring states.

This blog examines how Stark Industries Solutions acted as a Threat Activity Enabler (TAE) in hostile cyber and influence operations. It explores the company’s role in providing resilient infrastructure for disinformation and attacks, its sanctioning by the EU in May 2025, subsequent rebranding moves, and why infrastructure-focused analysis is essential to track continuity behind shifting names and entities.

This week, we turn to a case study from Philstar. The report examines a coordinated influence operation on X (formerly Twitter) that was active from late 2024 to mid-2025, with the goal of framing Vietnam as the main aggressor in the South China Sea.

This week, our Weekly Blog highlights a recent DFRLab report uncovering a coordinated network of at least 215 cross-platform accounts – 116 on Facebook, 79 on TikTok, and 17 on Instagram. Between December 2024 and June 6, 2025, these accounts generated 8,514 posts, attracting more than 16 million views and 681,000 likes. The investigation reveals how pro-Russian influence targeting Romania Moldova has been systematically amplified through this network, exploiting major social

The China cyber militia model shows how civilian, state, and military actors are fully interconnected. Rather than outsourcing, Beijing embeds information operations within this system, blurring boundaries and ensuring all parts can be mobilized as extensions of state power.

China tends to respond to accusations of information operations in a recurring pattern. A recent example is the Ministry of State Security’s reaction to Australian espionage allegations, which once again reflected this established approach.

Singapore’s public attribution of cyber intrusions to UNC3886 marks a shift in its stance toward China, departing from past discretion. The move highlights the role of attribution as both technical evidence and strategic messaging. China’s swift counteraccusations illustrate a pattern in hostile influence, redirecting attention and reframing narratives to challenge Singapore’s position and shape international perception.

Between March and April 2025, Doublethink Lab identified a coordinated influence campaign on Threads involving 51 fake accounts posing as Taiwanese users, spreading anti-DPP narratives alongside sexually suggestive content. The operation showed signs of outsourced amplification, blending political messaging with dating spam.

Examiniation of a recent VIGINUM report (June 2025), which analyzes the activities and organizational structure of the "African Initiative," an organization operating across several African countries.

Meta’s latest Adversarial Threat Report details the detection and dismantling of three global Coor-dinated Inauthentic Behaviour (CIB) campaigns attributed to actors based in China, Iran, and Romania.

This week’s post highlights key findings from Beyond Operation Doppelgänger: A Capability Assessment of the Social Design Agency (Pamment & Tsurtsumia, 2025), published by the Psychological Defence Agency at Lund University. Drawing on over 3,100 leaked internal documents, the study offers new insights into the structure, strategy, and objectives of the Russian influence campaign known as “Doppelgänger.”

VIGINUM Report Storm-1516 is a coordinated Russian disinformation campaign targeting Western democracies. It uses AI, deepfakes, and fake media outlets—often distributed via the CopyCop network—and follows a five-phase operational model. Evidence points to potential links with GRU Unit 29155 and broader state-backed influence networks.

Anthropic uncovers and disrupts four coordinated influence operations in April 2025, run by a commercial "Influence-as-a-Service" provider. These AI-driven disinformation campaigns—unlinked to any specific state actor—underscore the rising threat of private sector influence operations in digital security, social media manipulation, and global information warfare.

This week on our blog, we are presenting a new report by ClearSkySec that highlights a compelling case of a long-term influence operation.

This week, we examine the recent developments involving the hackergroup "Codebreakers" and the Iranian Sepah Bank, which have surprisingly not made international headlines yet.

This week, we are also reviewing the latest VIGINUM report . While it presents few new insights, it offers a structured overview of key...

This week, we examine Norway’s most recent national threat assessment (1) , which delineates key developments and emerging dynamics...

Artificial intelligence (AI) is transforming the world at a rapid pace, increasingly shaping various aspects of life. With its...

The rapid advancement of AI-generated content has transformed the landscape of disinformation, making it harder than ever to detect and...

State-linked actors from Iran, China, and Russia use AI tools like Google’s Gemini to enhance disinformation and information operations...

A new report reveals how sanctioned Russian entities are exploiting Meta’s ad platform to spread state-sponsored propaganda. Despite...

Ahead of Germany’s 2025 federal election, 102 fake news websites were discovered spreading pro-Russian disinformation to influence public...

A new report by Iran International raises allegations against the Iranian IT company Parsian Afzar Rayan Borna. According to the report,...

A recent report by Taiwan's National Security Bureau illuminates the escalating influence operations (IO) conducted by the Chinese...

Meta’s shift from independent fact-checkers to user-driven “community notes” sparks debate over the effectiveness of moderating...

The U.S. Treasury's Office of Foreign Assets Control (OFAC) has sanctioned Beijing-based cybersecurity firm Integrity Tech , alleging...

Unclassified U.S. Department of the Treasury systems were breached through vulnerabilities in a contractor’s security system. Hackers...

A recent investigation by Snoop.ro sheds light on the role of influencer campaigns in Romanian politics. At the center is a...

The Moldovan Intelligence and Security Service (SIS) has published a report investigating Russian interference in the 2024 referendum on...

This Blog Post examines how Romania's 2024 presidential election was annulled due to coordinated disinformation campaigns and foreign...

This Blog Post by the Cyfluence Research Center analyzes a recent influence operation. The focus is on the X account “ElectionsFocus.” ...

The Glassbridge Report, released by Google’s Threat Intelligence Group in collaboration with Mandiant, analyzes a large-scale pro-China...

Recorded Future’s report on Operation Undercut details a covert influence campaign by Russia’s Social Design Agency (SDA), active since...

CrowdStrike’s recent intelligence assessment identifies LIMINAL PANDA as a cyber threat actor aligned with Chinese strategic objectives,...

Correctiv, in collaboration with Qurium, has disrupted the infrastructure of Doppelganger , a Russian-linked propaganda operation. Their...

The hacktivist group Hunt3r Kill3rs recently claimed to have leaked excerpts of classified U.S. government documents , allegedly...

A new investigation reveals how fake videos and bots are being used to spread lies about the 2024 U.S. presidential election. With...

This report highlights the evolving tactics of Iranian-linked cyber group ASA (Aria Sepehr Ayandehsazan), formerly known as Emennet Pasargad

This report delves into the U.S.'s failed attempts to destabilize Venezuela's Maduro regime through cyber and influence operations.

This report examines UNC5812 conducting hybrid cyber-espionage and influence operations against Ukrainian military recruits.

The Office of the Director of National Intelligence (ODNI) has released a report focused specifically on post-Election Day threats.

The recent blog report reveals how Russia, Iran, and China are actively working to influence the 2024 U.S. election.