⚠️ Known Bad Actors & Documented Operations

St. Petersburg-based "troll factory" funded by Yevgeny Prigozhin. Ran coordinated inauthentic social media campaigns targeting U.S. elections from 2014–2017, operating fake accounts across Facebook, Twitter, Instagram, and YouTube. 13 Russian nationals and 3 entities were indicted by a U.S. grand jury in February 2018. The IRA was formally shut down in 2023 after the Wagner Group rebellion, but successor operations have continued under new structures.

Run by Russian companies Struktura and the Social Design Agency (SDA), active from 2022 onward. Clones legitimate news websites — including The Guardian, Der Spiegel, Le Monde, and The Washington Post — to publish pro-Kremlin content. Has also spoofed government websites for NATO, Poland, Ukraine, France, and Germany. Sanctioned by the EU and UK in 2024; U.S. DOJ filed affidavits against it in September 2024.

Tracked by Mandiant since at least 2017. Linked to Belarusian military intelligence with alignment to Russian interests. Compromises journalist and publisher accounts to post fabricated articles as if written by real reporters, then amplifies them on social media. Has targeted Lithuania, Latvia, Poland, and Germany with anti-NATO narratives and fake quotes from military officials. The EU formally blamed Russia for Ghostwriter in September 2021.

Documented by the EU DisinfoLab and researchers at the Atlantic Council. Used over 300 websites and platforms to spread fabricated documents and Kremlin-aligned narratives across regional blogging sites, forums, and social networks in Europe. Active for years with a very high volume of content but relatively low engagement — suggesting an automated or semi-automated operation focused on quantity over quality.

Kremlin-linked Russian PR firm behind Operation Doppelganger and other campaigns. Leaked internal documents from 2024 showed the SDA produced nearly 40,000 content units — memes, images, and comments — over four months, targeting France, Poland, Germany, and Ukraine. Sanctioned by the EU.

RT, Russia's state media outlet, was charged by the U.S. DOJ in 2024 for secretly funding U.S.-based social media influencers to spread Kremlin narratives without disclosure. Rybar, a Russian military-focused Telegram channel, was flagged by the U.S. State Department — which offered up to $10 million for information on its operators — for conducting malign influence operations targeting U.S. elections.

Described by Meta as the largest covert influence operation it has ever disrupted, and linked to Chinese law enforcement. Operates across a vast range of social media platforms and internet forums pushing pro-China content and attacking critics of Beijing. Named "Spamouflage" for its characteristic of burying propaganda in spam-like posting patterns to avoid detection. OpenAI also disrupted this network in 2024.

The Office of the Director of National Intelligence assessed that Chinese actors focused influence efforts on U.S. down-ballot House and Senate races during the 2024 election cycle, amplifying conspiracy theories about specific candidates and undermining confidence in elections. Pro-PRC accounts also published falsified political documents ahead of Taiwan's 2024 elections, including fake DNA tests and fabricated military documents.

Iran's "Storm-2035" campaign built disinformation websites targeting both liberal and conservative U.S. political groups simultaneously — designed to sow division rather than favor one side. The Iranian International Union of Virtual Media (IUVM) was identified by OpenAI as using AI tools to generate and translate content for influence operations. In September 2024, the U.S. DOJ charged three Iranian nationals as employees of Iran's Islamic Revolutionary Guard Corps for hacking and influence operations targeting the 2024 U.S. election.

Group associated with cyber and influence activities linked to Iranian interests.

Documented by EU DisinfoLab as the largest influence network they had exposed at the time of publication. A 15-year operation run by the New Delhi-based Srivastava Group involving over 260 fake local news sites across 65 countries, resurrected defunct NGOs (including dead people's identities), and fake think tanks — all designed to discredit Pakistan at the UN Human Rights Council and European Parliament.

A growing category of private firms that sell coordinated inauthentic behavior to any paying client — government or private. Graphika and the Stanford Internet Observatory have documented multiple such operations. These firms operate troll farms, build fake follower networks, and run astroturfing campaigns for hire. The lines between state-sponsored and commercial operations are increasingly blurred.