Disinformation & Influence Ops

U.S. intelligence agencies concluded that foreign governments ran influence operations around the 2024 U.S. presidential election, but found no evidence they successfully interfered with the actual outcome or voting infrastructure. Sources told The Record that a classified post-election assessment found Russia mounted the most significant campaign, seeking to help Donald Trump and hurt Kamala Harris, while China targeted specific races and Iran also conducted influence activity; a declassified public version is expected. — This matters because it separates real foreign influence activity from unsupported claims that the vote itself was hacked or changed. Election officials, platforms, journalists, and the public should expect similar narrative-shaping campaigns ahead of future U.S. elections and focus defenses on detecting coordinated influence operations.

The UK government says it is creating a new national center to detect, attribute, and disrupt hostile state disinformation, with a stated focus on election-related influence activity and broader national resilience. Prime Minister Andy Burnham announced the planned National Centre for Information Defence at the U.N., saying the Cabinet Office is leading early work with intelligence agencies, law enforcement, other departments, and social media companies. He tied the move to Russian influence tactics including bots, fake websites, falsified news articles, and copied branding of British institutions. — This signals a more centralized UK response to foreign influence operations that can affect elections, social cohesion, and trust in institutions. The immediate takeaway for the public and defenders is to expect more government action around attribution, platform coordination, and counter-disinformation measures tied to Russian and other state-linked campaigns.

Hackers say they broke into systems tied to Russia’s parliamentary election just days before voting begins. The group calling itself CikLeak claims it accessed Russia’s Central Election Commission and companies involved in the Vybory 2.0 election platform, including Rostelecom, and stole internal documents, server configurations, passwords, and employee communications. Important Stories said it authenticated the leaked materials, but it remains unclear whether voting or vote-counting systems themselves were directly accessed. — A breach of election-administration systems can undermine trust in the vote even if ballots are not directly altered. Election officials, contractors, and observers should treat exposed credentials and configurations as potentially compromised immediately and watch for follow-on intrusion, manipulation, or disruption attempts.

Researchers say Israeli contractor BlackCore trained Angolan government officials to carry out covert online influence operations using fake social media personas and coordinated pro-government content. Citizen Lab says the 14-week program included Facebook, Instagram, and TikTok operations, creation of a fictitious media outlet called Agita News, paid advertising, and publication of dozens of influence posts designed to shape public opinion. — This is a real-world influence operation tied to a government and a commercial contractor, which matters to the public, platforms, and election and information-integrity defenders. It suggests coordinated deception infrastructure may have been operational in Angola and potentially reused elsewhere, so researchers and platforms should watch for linked personas, pages, and ad activity.

The U.S. Justice Department seized CFAKE.com and SOCFAKE.com, two sites accused of hosting nonconsensual AI-generated nude images and videos of identifiable women. U.S. authorities said the domains violated the TAKE IT DOWN Act, which criminalizes publication of intimate digital forgeries without consent and requires platforms to remove reported content within 48 hours. The operation involved Homeland Security Investigations and law-enforcement partners in Italy and France, and French authorities arrested a suspect in Nice and seized related cryptocurrency. — This shows the TAKE IT DOWN Act is now being used in real enforcement, which matters to victims, platforms that host user content, and anyone tracking abuse enabled by generative AI. Platforms should review takedown processes and compliance timelines, while users should report nonconsensual deepfake imagery quickly.

Anthropic says criminal and state-backed groups used its Claude models to help carry out real-world cyberattacks and other harmful operations between December 2025 and August 2026. The company’s misuse report says ShinyHunters-linked clusters used AI agents to scale data theft, including a supply-chain-style breach of a software-as-a-service provider affecting about 200 customer organizations and a dump of more than 2,100 Azure AD token sets across 40+ tenants, while Russia’s SVR-linked GTG-20006, also known as APT29 or Cozy Bear, used customized AI workflows to automate phishing, command-and-control, persistence, and exfiltration against more than 20 organizations. — This shows AI is no longer just assisting low-level scams but is being used to speed up serious intrusions by both extortion crews and state spies. Organizations should review cloud identity logs for suspicious token use, tighten phishing defenses, and treat AI-enabled attack automation as an active threat rather than a future risk.

Google says some threat actors are no longer just using chatbots for coding help but are deploying multi-agent AI frameworks to run parts of real intrusions and credential-theft campaigns. GTIG describes one financially motivated incident in which an attacker used AI agents to plan and launch a mass harvesting operation in under six hours, and another involving an exposed "Recon" command-and-control server that managed more than 23,800 stolen secrets such as API keys. The report also says China-linked espionage actors experimented with AI-assisted exploitation pipelines and that Russia-linked UNC5792 used AI to automate Telegram monitoring. — This matters because it shows attackers compressing the time from break-in to large-scale credential theft, giving defenders less time to detect and stop abuse. Organizations should harden cloud accounts, monitor for unusual credential access and API-key use, and treat exposed secrets and cloud identities as urgent incident-response priorities.

OpenAI says it shut down ChatGPT accounts tied to a Cambodia-based fraud operation that used the service to help run multiple scam types. The network used the model to create fake personas, translate messages, generate promotional images, and forge documents for investment, romance, gambling, and law-enforcement impersonation scams. — This shows how generative AI is being used to scale social engineering and fraud with more convincing messages and fake identities. Consumers should be extra cautious with unsolicited messages, investment pitches, and anyone claiming to be law enforcement online.

New Zealand has sanctioned Russian hackers, a technology supplier, and propaganda organizations over cyberattacks and influence activity tied to Russia’s war against Ukraine. The designations include alleged Cyber Army of Russia Reborn members Yuliya Pankratova and Denis Degtyarenko, GRU-linked officer Andrey Averyanov, Kremlin-backed propaganda funder IRI and its director Alexey Goreslavsky, and IT firm LANIT, citing roles in critical-infrastructure targeting, sanctions evasion support, and anti-Ukraine information operations. — This matters because it names specific cyber and propaganda actors tied to attacks on infrastructure and wartime influence campaigns, giving defenders and policymakers more concrete entities to watch, block, and assess for risk. For organizations, it is a signal to review exposure to sanctioned Russian-linked providers, infrastructure, and personas and to monitor threat activity tied to CARR and related groups.

Georgia says fake social media posts and coordinated amplification were used to falsely portray the country as dangerous for Russian tourists. The State Security Service alleges accounts operated from abroad, then boosted by a large foreign media outlet and Russian Telegram channel Mash, spread fabricated claims that Georgians were poisoning food or mistreating visitors; officials have opened a criminal investigation under Georgia's sabotage law but have not publicly named the foreign state or provided evidence tying the campaign to a government. — This is a state-level influence operation allegation aimed at shaping public perception, tourism, and regional politics ahead of a sensitive war anniversary. It matters to the public and platforms because it points to coordinated inauthentic behavior; readers should treat sensational cross-platform claims about targeted groups with extra caution until independently verified.

The European Union has created a new Brussels enforcement team to start policing AI companies under the AI Act, including over deepfakes, sexually explicit AI-generated content, and cyber threats to public infrastructure. The European Commission said the expanded AI Office will add 38 staff, require labeling or watermarking of AI-generated chatbots and imagery when the rules take effect, and use new whistleblower and compliance-reporting tools to investigate firms and potentially fine them or block access to the EU market. — This matters because the EU is moving from debate to enforcement on AI misuse, including deceptive synthetic media and AI systems that could facilitate cyber offense or threaten critical services. Companies building or deploying AI in Europe should review AI Act obligations now, especially disclosure, documentation, and risk-management requirements.

Europol says it flagged 4,340 URLs for removal during a June-July 2026 operation targeting online content linked to The Com, a decentralized extremist network that recruits and abuses young people online. The action was run by Europol's EU Internet Referral Unit and Spain's CITCO with investigators from nine countries, and focused on content tied to self-harm, child sexual abuse material, violent attacks, grooming, doxing, swatting, and attack manuals; Europol says The Com includes subgroups involved in cyber intrusions and ransomware. — This matters because The Com blends violent extremism with cyber-enabled abuse such as sextortion, doxing, swatting, and ransomware, often targeting minors through mainstream online platforms. Platforms, investigators, schools, and families should watch for coded recruitment content and coercion tactics, while defenders should note the group’s overlap with cybercrime activity.

Ukraine’s security agency says Russian hackers are increasingly targeting Ukrainian media organizations, including two previously undisclosed attacks on television broadcasters. The SBU said one incident this year was a large distributed denial-of-service, or DDoS, attack against a nationwide TV channel, while another last year combined phishing with attempts to access connected infrastructure to seize a major broadcaster’s platform and publish Russian propaganda as if it came from Ukrainian media. — This is a direct threat to news delivery and public trust during wartime, especially for broadcasters and media operations in Ukraine. Media organizations should urgently harden phishing defenses, review access to broadcast and publishing systems, and prepare for DDoS and account-takeover attempts.

Google says covert pro-Russia influence campaigns are broadening their targets and narratives beyond Ukraine, with activity now aimed at the United States, European Union countries, NATO, Russia’s neighbors, the Middle East, Africa, and domestic Russian audiences. The report describes a shift from war-focused messaging to broader pre-war geopolitical objectives, indicating a wider information operation rather than a single isolated propaganda push. — This is relevant because it signals an expanded disinformation threat that can affect elections, public debate, and crisis response across multiple regions. Governments, platforms, researchers, and news consumers should expect more coordinated influence activity and scrutinize suspicious cross-platform narratives and inauthentic amplification.

Fraudulent data-breach notices were submitted to Maine’s public breach portal and published as if they were real, falsely claiming incidents at VRChat and Discord. VRChat told BleepingComputer the filing was fake and used a nonexistent employee name, while Maine’s Attorney General office said notices can be posted without prior verification and that the VRChat entry would be removed. The incident appears to be abuse of a government disclosure system rather than a confirmed breach of the named companies. — This can mislead users, investors, journalists, and incident responders by making fake breaches look official. Organizations should monitor state breach portals for false filings in their name, and users should wait for confirmation from the affected company before reacting to reported breaches.

OpenAI says it removed accounts likely tied to China that used ChatGPT to generate posts and images for a covert influence campaign aimed at Americans. The operation focused on social-media content claiming AI datacenters drive up electricity demand and household power costs, then posted the material through likely fake X accounts alongside links to real news stories; OpenAI said the campaign showed limited authentic engagement. — This is a concrete example of AI tools being used to support state-linked influence operations, even when the campaign gains little traction. It matters for platforms, policymakers, and the public because real debates can be manipulated with synthetic content, so readers should scrutinize coordinated posts and image-driven narratives around contentious policy issues.

Researchers and Armenian authorities say a large Russia-linked influence operation targeted Armenia’s parliamentary election with fake stories, manipulated videos, bot amplification, and false bomb threats at polling stations. Antibot4Navalny and the Institute for Strategic Dialogue linked the activity to the Matryoshka campaign, described as part of Russia’s broader Doppelganger operation, which impersonates trusted media and government sources to spread propaganda and election-related falsehoods over an eight-month period. — This is the kind of coordinated deception campaign that can mislead voters, intimidate the public, and erode trust in elections even without hacking voting machines. Platforms, journalists, election officials, and civil society groups should watch for cloned media sites, impersonation, bot-driven amplification, and hybrid tactics such as hoax threats around major votes.

Security researchers say more than 5,000 election-themed internet domains were registered in recent weeks ahead of the 2026 U.S. midterms, raising the risk of fake voting sites, donation scams, and impersonation of election officials. Check Point said the registrations increased sharply between April and May and coincided with roughly 17,000 exposed credentials tied to ActBlue, WinRed, GOP, Democrats.org, and USA.gov accounts, creating infrastructure and account access that could support phishing, fraud, or influence operations. — This matters because voters, donors, campaigns, and election workers could be tricked by lookalike sites or targeted through reused or stolen passwords. People should verify election and donation websites carefully, avoid links in unsolicited messages, and reset passwords if they may have been exposed.

Dutch authorities say they seized 800 servers and arrested two men linked to a hosting operation that allegedly helped cyberattacks, disruption campaigns, and online disinformation. Investigators said the action targeted infrastructure connected to Stark Industries, an EU-sanctioned hosting provider, and two Dutch companies allegedly used to keep its services running after sanctions; reporting links the network to pro-Russian DDoS, or distributed denial-of-service, activity by NoName057(16). — This matters because the seizure hits infrastructure allegedly used to support both cyberattacks and influence operations in Europe. Defenders, hosting providers, and abuse teams should watch for fallout such as service migration, replacement infrastructure, and renewed DDoS activity from the same actors.

Russia has appointed a former cybersecurity executive reportedly tied to a military intelligence hacking unit to a senior Security Council role. The Record reports that Andrei Kozlov, formerly of Rostec's RT-Information Security and a Russian cybersecurity industry association, was named an aide to Security Council Secretary Sergei Shoigu; leaked data cited by The Insider allegedly links him to GRU Military Unit 26165, widely tracked as Fancy Bear or APT28, a group long accused of espionage, credential theft and influence operations. — This matters because it may show direct overlap between Russia's state security leadership and a unit publicly tied to past hacking and disinformation campaigns. Defenders and policymakers should treat it as contextual evidence when tracking future APT28 operations, influence activity and Russian state cyber posture.