top of page
CRC logo (2).png

Weekly Report: Cyber based influence campaigns 7th - 13th July 2025

  • Writer: CRC
    CRC
  • Jul 17
  • 9 min read

Updated: Jul 22

Weekly Media Update cover: child with helmet, light bulb on teal background. Text: Information Operations report, 7th-13th July 2025.

[Listen to the Podcast]

[Introduction]


During the 7th to the 13th of July, 2025, we observed, collected, and analyzed endpoints of information related to cyber-based hostile influence campaigns (including Cyfluence attacks). The following report provides a summary of the key events we consider most significant.  


Across Europe and beyond, the war for narrative control escalates. Russian influence efforts, from weaponized religious networks to disinformation about NATO, intensify alongside Iran’s targeting of dissident voices and Qatar’s courtship of U.S. media. This week's review reveals a trend among state actors to innovate within constrained environments, exploiting gray zones in law, information, and civil society. The strategic stakes are no longer limited to borders, but to belief systems and electoral legitimacy. 


[Highlights]

> TABLE OF CONTENTS


STATE ACTORS

  • [Russia]

  •   [Iran]

GENERAL REPORTS
STATE ACTORS

[Russia]

Coffins by the Eiffel Tower: Russia’s War of Influence Escalates

An operation leaving coffins draped in the French flag near the Eiffel Tower exemplifies the evolving nature of Russia's "war of influence," according to France's intelligence chief, Nicolas Lerner. In a report from The Record, Lerner warned that these are not amateur acts but calculated efforts to disrupt Europe's information space. His assessment places such incidents within a broader campaign of Russian-linked hybrid threats, including cyberattacks on NATO-related bodies and an arson attack in London directed by the Wagner Group. This synthesis of physical sabotage and digital disruption, Lerner asserts, constitutes a medium- and long-term "existential threat" to European security and democratic values.


Source:  

Russian Propaganda Finds New Life on Italian Streets

A billboard in Bologna proclaims, “They ban the truth, we show it,” signaling the quiet return of Russia’s state media RT to EU territory, despite an official ban. In defiance of a 2022 EU regulation, a wave of RT-aligned documentaries has begun screening across Italy, disseminated through public venues and promoted by pro-Kremlin figures operating from occupied Donetsk. Films such as Children of the Donbass and I Am Alive advance Moscow’s narrative on the Ukraine conflict, often under the guise of peace activism or alternative media. While organizers deny formal ties to RT, pro-democracy think tanks like ISD point to a coordinated effort amplified by social media and Telegram channels, such as Donbass Italia. As EU leaders call for investigations into the campaign’s funding, public protests have already derailed several screenings. Yet, with over 13 million online engagements this year, the campaign illustrates how disinformation actors adapt tactics to penetrate democratic societies, even under regulatory constraints.


Source:  

The Kolbasna Arsenal: A Flashpoint in Russia’s War on Moldova 

Russia is intensifying hybrid operations aimed at destabilizing Moldova ahead of its September 2025 parliamentary elections, according to multiple sources cited by the Jamestown Foundation. The Kremlin is deploying a range of non-military tactics, disinformation, propaganda, bribery, and influence operations to weaken Moldova’s pro-EU government and potentially install a pro-Russian regime. Officials fear Moscow may exploit separatist regions like Transnistria and Gagauzia to launch provocations or false-flag operations, especially given Moldova’s strategic location bordering Ukraine and Romania. Russian analysts have expressed concern over the vast Kolbasna ammunition depot in Transnistria potentially falling into Ukrainian hands, amplifying geopolitical tensions. Moldova has responded by restoring bomb shelters and strengthening internal defenses. While experts agree that large-scale Russian troop deployments are unlikely due to logistical constraints, they warn that Moscow could foment internal unrest to create a conflict similar to the one in Donbas. The Kremlin’s strategy appears modeled on past influence campaigns and may escalate if pro-Russian parties lose electoral ground.


Source:

The Kremlin's Holy Spies: Russia Weaponizes Its Orthodox Church

A Global Influence Operations Report (GIOR) analysis concludes that the Russian Orthodox Church (ROC) has been weaponized into a central instrument of Kremlin foreign policy. Operating beyond its religious mandate, the ROC disseminates pro-Kremlin propaganda, champions "traditional values" to build conservative networks abroad, and coordinates with Russian state agencies to undermine Western integration in nations like Estonia and Bulgaria. The report details how the Church's infrastructure is also used for intelligence operations, including recruiting agents, gathering blackmail material, and placing facilities near sensitive infrastructure. This fusion of spiritual authority and state power enables the Kremlin to conduct multifaceted, hybrid operations under the guise of religious activity.


Source:

Russia-Linked Network Spreads Biolab Hoax in Armenia 

A Kremlin-linked disinformation campaign has targeted Armenia with a false narrative alleging that U.S.-backed biolabs are conducting military experiments on Armenian civilians. According to DFRLab, the campaign, led by the Russian Foundation to Battle Injustice (R-FBI), disseminated content in multiple languages via a coordinated network of fringe websites and Telegram channels. Originating from an English-language article on [londontimes.live], the hoax accused Armenian officials of colluding with Western pharmaceutical companies. This was followed by further fabricated reports suggesting U.S. biolab operations were hidden behind international conferences. The campaign involved media laundering by a 56-website network linked to RT, with synchronized publishing patterns and reuse of RT-hosted assets. Amplification occurred across platforms in at least seven languages, reaching audiences in Europe, the U.S., Iran, and Azerbaijan. Researchers connect the operation to entities linked to Yevgeny Prigozhin’s influence apparatus, highlighting Russia’s continued use of biolab conspiracies as tools to erode public trust and undermine pro-Western governance in Armenia.


Source:

Russia’s Faux Peace Rhetoric Paints Europe as Aggressor  

The Kremlin is escalating its disinformation campaign by portraying Europe as an aggressor to justify Russia's war aims and undermine Western support for Ukraine, according to EUvsDisinfo. This narrative shift, following the NATO summit, reframes European defense initiatives as "militarization" and depicts France and Germany as primary threats. Despite claiming to seek peace, pro-Kremlin outlets saturate media with war rhetoric, suggesting NATO and EU states are preparing attacks on Russia. These efforts coincide with absurd claims about Russia’s humanitarianism, often invoking genocide narratives and alleged Western oppression. The Kremlin simultaneously fabricates reports of human rights abuses in Europe while suppressing civil society at home. Additionally, recurring falsehoods such as NATO’s alleged plans to occupy Odesa and the proliferation of Ukrainian arms on black markets continue to be recycled to erode public trust. These themes reflect a broader strategy: presenting Russia as a besieged moral power while deflecting attention from its aggression and repression.


Source:

[Iran]

Hacktivist Group Handala Threatens Journalists After Alleged Breach 

Cybernews highlights that on Tuesday, the pro-Iranian hacktivist group Handala declared “Operation Handala” a success, claiming it had infiltrated the entire communications infrastructure of Iran International, one of the few independent news outlets serving Iranians. From its dark web blog and short-lived Telegram channels, the group issued a barrage of threats, targeting journalists by name, including UK-based reporter Mojtaba Pourmohsen, and warning viewers that their identities were logged and under surveillance. While Handala offered no proof of the breach, it claimed to possess a vast trove of personal data and framed the attack as retaliation against what it called “media-based espionage.” Analysts trace the group’s roots to Iran’s expanding hacktivist ecosystem, now swelling in the wake of regional tensions. This marked shift, from targeting foreign entities to striking Iranian dissident media, signals an escalation in Tehran-linked cyber repression and a troubling willingness to weaponize doxxing and digital fear against perceived domestic adversaries abroad.


Source:

Assassination Plots on UK Soil Reveal Escalating Threat from Iran
 

A UK parliamentary report by the Intelligence and Security Committee (ISC) concludes that Iran poses a persistent, wide-ranging, and unpredictable threat to UK national security. Drawing on evidence from 2021–2023, the report outlines Iran’s use of asymmetric tactics, including espionage, cyber operations, interference, and support for militant proxies. Iran's intelligence services, shaped by internal factionalism and directed by the Supreme Leader, were found to be increasingly active in targeting dissidents in the UK, with at least 15 assassination or kidnapping attempts since 2022. Cyber threats remain a key concern, particularly given Iran’s aggressive posture and low-cost, high-impact capabilities. While the UK has strengthened its legislative tools and intelligence partnerships, the report criticizes the government’s crisis-driven Iran policy, its lack of long-term strategic vision, and inconsistent resourcing. It calls for reform of the Official Secrets Act, a stronger cyber deterrence posture, and urgent consideration of proscribing the IRGC. 


Source:

How a Carlson Interview Became a 'Propaganda Victory' for Tehran 

A report by NewsGuard analyzes how Iranian state media leveraged a high-profile interview between President Masoud Pezeshkian and U.S. commentator Tucker Carlson to advance disinformation. The analysis details several false claims made by Pezeshkian—and left unchallenged by Carlson, including a denial that Iran had issued a fatwa against Donald Trump, just weeks after two were publicly announced. Other falsehoods involved Iran's cooperation with the IAEA and the meaning of the "Death to America" slogan. Iranian, Russian, and Chinese state media subsequently amplified these claims. The interview is framed as a strategic "propaganda victory" for Tehran, successfully using a Western media platform to launder its narratives and bolster its legitimacy.


Source:

GENERAL REPORTS


UISD Report Details Coordinated Disinformation in German Election 

A new report by ISD and partners analyzes foreign information manipulation and interference (FIMI) during Germany’s 2025 federal election, revealing a high volume of coordinated disinformation campaigns, primarily orchestrated by Russia-aligned actors. These efforts exploited social fault lines around migration, the economy, and national identity, using AI-generated content, impersonation of institutions, and bot networks to manipulate public discourse. Notable operations included Storm-1516, Operation Overload, and Doppelgänger. Domestic actors, including the far-right AfD party, also adopted similar tactics, further blurring the boundary between legitimate and deceptive political communication. Despite platform efforts, enforcement gaps allowed sanctioned outlets, such as RT DE, to reach German audiences. The report advocates for a whole-of-society approach, encompassing regulatory reform and media literacy, to foster resilience against such threats. It also highlights deficiencies in policy enforcement, platform accountability, and long-term strategy across government and civil institutions.


Source:  

Qatar's Conservative Media Influence Operations

As the new U.S. Attorney General, a former lobbyist for Qatar, moves to limit the enforcement of foreign influence laws, Qatar is simultaneously ramping up its campaign to win over conservative American media. A Washington Examiner investigation found that since the 2024 election, the Gulf state's registered agents have dramatically increased their outreach to right-wing outlets, securing friendly interviews with figures like Tucker Carlson and successfully pitching pro-Qatar stories. This surge in overt influence, combined with a new Justice Department policy that critics say grants "greater license to engage in unregistered foreign lobbying," highlights a confluence of events that could significantly expand Qatar's influence in Washington.


Source:

TAKEAWAYS


This week's primary trend is the increasing integration of hybrid threats. Operations in France, Moldova, and Germany demonstrate that disinformation, cyber-attacks, and physical acts are not separate tactics but often components of a single, coordinated strategy. A key question for policymakers is whether current defences, often siloed by agency or threat type, are adequate to counter this combined attack. Illustrative of this hypothesis is the UK’s critique of its crisis-driven Iran policy, which suggested an urgent need for a more unified and long-term strategic vision. 

[Download Report]

 
 
bottom of page