I know several people who had some evidence linking REST to Rybar, but the DFR Lab provides definitive proof here. Really amazing domain analysis. dfrlab.org/2025/09/23/s...

The amount of Russian interference in Moldova is staggering.

“Google said in a statement […] “On YouTube, as part of our proactive coverage for the 2025 Moldova elections, we have terminated more than 1,000 channels since June 2024 for being part of coordinated influence operations targeting Moldova.””

Great reporting from the BBC. They uncovered a pro-Russia op paying Moldovans to post disinfo. The DFR Lab apparently did some digging and found a TikTok network linked to the op that's gained 55M views. www.bbc.com/news/article...

As someone from Georgia, it’s very cool to see my name in the AJC, even if they’re republishing an AP article. I’ll take it! www.ajc.com/news/2025/09...

Oh, come on, what an awesome find: "Frames from Dougan’s interview with French media show a Python script calling Ollama (via a function named restart_ollama()), an LLM inference framework used to run local or self-hosted LLMs." www.recordedfuture.com/research/cop...

Hard to think of a more on-the-nose encapsulation of how far the online speech wars have swung in the year of our lord 2025 than major U.S. corporations racing to fire people whose tweets offended Milo Yiannopoulos

The Utah governor's claim that Russian bots are exploiting Kirk's death seems true but overblown. I've seen limited activity from operations like Overload, Undercut, Doppelganger. Pravda published 100+ articles. A few dozen Copy Cop sites posing as local outlets published 90 articles. Nothing viral

Pretty interesting to see a 1516 video break out so long after it was seeded. Just spotted a Newsmax correspondent amplifying it.

There's a small, apparently coordinated network of X accounts attacking Rubio and defending Venezuela:

So we’re doing this now, huh? www.reuters.com/world/europe...

Even more emails from Russia's disinformation campaign, with continued targeting of Moldova, and lots of mimicking of Newsguard. I still suspect the volume of videos and images targeting Moldova is an attempt to get the election results called into question because of the interference.

Been out for a couple days and see Operation Overload migrated to YouTube. The videos I've seen have less than 50 views. The op keeps expanding and keeps being ignored.

A United States Senate investigation has identified more than 500 credible reports of human rights abuses in US immigration detention since January, including alarming allegations of mistreatment of pregnant women and children.

Corporate needs you to find the differences between Russia's Foreign Ministry and a Storm-1516 influencer

New on @indicator.media: I found 88 TikTok accounts using AI avatars of real journalists to spread clickbaity misinformation in Spanish. Together they had 1.7 million followers and many times that in video views.

Interesting to see leaked docs from a company that claims to be revolutionizing Chinese info ops with AI. Less interesting to see the NYT take those claims at face value. I've seen no evidence AI has meaningfully improved info ops. www.nytimes.com/2025/08/06/u...

Odd that this story doesn't mention Galloway's work for Russian and Iranian propaganda outlets. It also doesn't mention how often Bridgen promotes pro-Kremlin lines. Those two former MPs weren't duped. They spread this type of content intentionally.

Archiving sites have been giving me absolute hell. I wonder how much malicious content is going undocumented, at least in public repositories, because there's no easy, quick way to do so.

DNI Tulsi Gabbard retweets Roger Stone praising her on Alex Jones. (Read that sentence, IC ppl in Five Eyes) Roger Stone was in direct contact w/the GRU hackers who dropped the Clinton emails, just to be clear. He knows full well whose campaign Russia reached out to. These people are brazen liars.

Z-Alliance and NoName057(16) are now using an APT28 logo in videos purporting to show them hacking critical infrastructure. Very fancy.

Big IO takedown numbers from Google. But why even release this bulletin? There's no way for anyone to make sense of who controlled the channels, what narratives they promoted, or how impactful they were from something like this. blog.google/threat-analy...

Bragging about your Russia ties is a good way to unwind after a long day of fabricating quotes.

Interesting detail in here about how Afrique Media, which has ties to the Wagner Group and collaborates with RT, bought and repurposed a YouTube channel with 1.2M subscribers. indicator.media/p/buy-sell-y...

This lines up with Operation Overload's anti-LBGTQ+ content targeting Moldova. The lead up to their September election is going to be chaotic.

"Not good! This is a pit!" might be my favorite Spamouflage quote

Leaders of the African Initiative were also sanctioned here. That initiative is behind at least three sites targeting the UK: britishattitudes[.]com, britishtalks[.]com, and euronewstop[.]co[.]uk

I've seen hundreds of Overload posts over the past year, and I can count on one finger the number of times it went viral. Here's our report on Overload's Q2 activities. Takeaways: platforms stepped up, and unless something changes, we should be strategically silent www.isdglobal.org/digital_disp...

New from me: Chinese government-backed hackers have become even more aggressive in breaking into U.S. government networks and companies, powered by a private industry liberated to choose targets themselves. Free link with email etc. wapo.st/4kFltKM

Interesting find. There appear to be nine TrueFact subdomains so far. In a very Pravda-like move, the subdomains are named after specific countries or regions. They share TSL certificates with known Dougan sites like the Boston Times and Miami Chron, according to crt[.]sh.

The Iranian site that claims to have crowdfunded $40M for a bounty to assassinate Trump has only had 1,300 visitors. Weirdly, all that traffic is from Canada. 75% of bounced. So, we're looking at roughly 300 Canadians who love Iran enough to donate a collective $40M. Seems plausible.

Same energy

The 2025 German federal election is another example of a democratic process targeted by foreign actors seeking to influence domestic opinion. Last week, the FIMI ISAC (Foreign Information Manipulation & Interference Information Sharing & Analysis Center) consortium published its analysis on this👇

Our latest disinformation update is out. It includes a deep dive into the cases of stolen identities of the real journalists from France, Romania and Canada by the Storm-1516 operators. We also expand on Lucas Leiroz's role in the distribution of Storm-1516 and fondfbr materials

Fun fact about vtforeignpolicy: for whatever reason, pacificjointspacefacility[.]com redirects there. I found that out like 6 months ago and have been confused ever since.

A lot of Overload's bot network on X has been removed, and it now appears to be using a 2nd network to boost some posts. The old reposts simultaneously, while the new does no more than one repost a minute across a longer timeframe. No engagement before or after that timeframe, though.

I published "The Indicator guide to connecting websites together using OSINT tools and methods." It's the most comprehensive guide to linking sites together to uncover ownership, connections, and funding. We're offering discounted memberships if you want to join & read it: indicator.media/p/in...

Massive, massive report on Overload. Have to appreciate the amount of work that went into this, and the findings are super interesting. checkfirst.network/wp-content/u...

Cool cool

What a time to be alive. The president of the United States doing battle damage assessment via sketchy OSINT accounts. I had blocked this particular account some time ago.

Burning instead of stealing $90M is the biggest middle finger.

Euronews must be very annoyed with Operation Overload. I'm looking at a sample of 150ish X posts, and it tagged Euronews in 98 of them. Politico Europe and BBC Breaking were the second and third most mentioned accounts in the sample.

Good turnout in Chatt for No Kings Day

AI chatbots are increasingly being used by online users as fact-checking tools. But incorrect answers by ChatGPT and Grok are misleading users about the origin of photos showing National Guard troops, sent to Los Angeles during the recent unrest, sleeping on floors.

I grabbed a sample of a few hundred Russian, Chinese, and Iranian state media posts on X about the LA protests. Russian media is averaging 169 likes per post. Iranian media is averaging 19. Chinese media is averaging just 12. Those are rough numbers for Beijing.

Followed a lead in OpenAI's report from last week and found a small cluster of Iranian accounts posting about the LA protests. No impact, but interesting to watch.

Chinese propaganda surges as the US defunds Radio Free Asia – The Washington Post: ‘have allowed China to fill a programming void and expand the reach of its talking points’ ‘Beijing has added 26 new Tibetan language frequencies and 16 new Uyghur language frequencies since the end of March’

Here’s a take: AI has allowed some information operations to get even sloppier than they already were in pursuit of volume. The people behind this IO also used ChatGPT to write performance reviews, so they’re taking all the shortcuts. cdn.openai.com/threat-intel...

The Gnida Project does some of the best work on Storm 1516 and Copy Cop. If you're interested in what is arguably Russia's most sophisticated info op, you have to follow them.