We’re taking a special and belated look at my latest long-form publication, focusing on a probably Qatar-linked operation. The report is available here.

The report is quite exhaustive, and there’s much more there so give it a read. I’ll go over some highlights, tips and tricks from the report below.

The operation we’re looking at is named “Eekad”. Eekad, a play on the Arabic root for truth. Eekad has been active since 2020 and positions itself, quite succesfully, as the “Arab region’s first open-source intelligence platform”. They’re on Twitter, YouTube, Facebook, Instagram and a semi-active domain.

What makes them interesting is that they pose as an investigative outfit, and use OSINT in a few key verticals:

• Covering influence operations

• Debunking viral content

• Geolocating content

• Social media and other analysis

The genius of this operation is that not only is the Arab world is apparently thirsty for this type of content, it provides a visage of legitimacy and accuracy. The average person can’t really tell whether or not satellite imagery is misrepresented, or if the way that Eekad presents impressive Gephi graphs as proof of an influence operation is in fact accurate.

Eekad has been caught promoting unsupported, misleading, inaccurate or overtly false claims on a number of topics - promoting and defending Qatar, denigrating Israel, Saudi Arabia, the UAE and even the Druze, and promoting the current Syrian government. All of these align with Qatari geopolitical interests.

To get a taste for their type of content - check out below some content claiming to expose networks:

On many cases they visualize different networks than the one above with Gephi to make a point that is otherwise unsupported:

Their emphasis on OSINT is apparent also in their YouTube channel. Open source investigation is their number one videotag. To do this type of analysis yourself, just check out Matt W’s YouTube Metadata bulk here.

Their Facebook page’s transparency section also includes references to Qatar, as well as Turkey (some employees are based there). Most of their ads were paid for in riyals and taken down due to violating Facebook’s political advertising rules. This is a general investigation tip as well - the FB ad library is amazing.

They have an inactive domain at eekad[.]com. However, if you enumerate its subdomains (available with all types of tools), you’ll find a subdomain at facts.eekad[.]com which was inactive for quite a while but at least exposes the original website.

Searching for the domain on Censys exposes one host with Eekad appearing in its HTTP response. This domain belongs to a PR firm, which is hosting a subdomain for Eekad on their own website which hosts an old version of the Eekad domain, showing that they’re tied. So Eekad has some money to throw around for PR firms, which most journalistic outfits of this size don’t.

We’ll conclude with two noteworthy events as well. The first is that Handala set up a domain to solicit information securely from visitors but didn’t bother encrypting the traffic by setting up an SSL cert, which is very funny:

The final thing I’ll point out is Singapore’s takedown of 6 domains seemingly targeting Singapore during its previous election period.

We get some detail below:

The domains are tied to known operations:

See the domains below:

Interesting to see how Singapore handles foreign influence and interference, managing to take down domains without raising the ire of those seemingly responsible.

That’s it for now, thanks for reading.

We’ll start off with a fantastic report from Domaintools Investigations on MOIS cyber and IO operations, with one of the better threat actor names - Moist Grasshopper.

Domaintools Investigations (DTI) consistently puts out some of the best reporting out there. If you’re a reader of Memetic Warfare, you should be a reader of their stuff.

I’d also like to shoutout Domaintools separately from this as well. When I first got started in investigations, I learned a ton from Domaintools’ blog, which would publish detailed investigations and guides. Much of it was an inspiration for what I try to do here.

Back to the report - see below:

The report is way too long for me to cover here and do it justice, but it hits every main point. It gets the structure of the MOIS and their threat actors, and more importantly lays out how they think and work very articulately. Check it out.

From here, we’ll cover more Iran.

I’m not one to usually link to content from the Intercept, but they do occasionally leave me no choice. One of their reporters exposed two covert CENTCOM news domains targeting Iran and Iraq, Pishtaz News and al-Fassel:

The two domains of course promote pro-US and anti-regime narratives, but like previous CENTCOM/contractor IO, they exhibit basic operational security mistakes, like having the sole account they follow be CENTCOM:

Or, even worse, not using a proxy or VPN:

Or, in perhaps the most egregious error yet, hosting a CENTCOM emblem on their domain for some reason:

Weirdly enough, these domains - like previously exposed CENTCOM domains in “Unheard Voices” provide some type of odd disclaimer on the domain itself, which they don’t have on their social media accounts. I honestly can’t think of why CENTCOM feels the need to do this? I can’t imagine the type of regulation requiring them to somehow disclose this.

This is described later in depth, with CENTCOM having changed its disclosures. Time to just drop it guys!

The article notes that the YouTube channel has some overtly AI-generated content:

Despite the effort, the domains’ accounts have essentially no traction:

Moving on, we’ll stay on Iran and take a look at the latest joint US government advisory on Iranian actors targeting critical infrastructure in the US, available here.

They don’t attribute it to Shahid Kaveh/cyb3rav3ngers or the IRGC but do mention how funnily enough that same group was doing the same thing back in the before times of 2023, and we also learn that they apparently hit 75 different devices, an interesting update showing the scale of the activity:

We also see that some of the activity hit government services, water and energy stations and so on, with some experiencing “operational disruption and financial loss”. We also probably had some defacement based on the first paragraph.

The IoC section is more interesting:

What’s interesting about the IP range is it occurs mainly via one AS, and specifically in one CIDR range even. It’s always useful to check sequential IPs, as shown here.

Most of the IP addresses are run by Ultahost, with the one beginning with 135 belonging to M247, a hosting service that we’ve seen exploited by Iran many, many times.

Ultahost has also has been exploited in the past for cyber and influence operations, ranging from Doppelganger to MOIS fronts such as Handala.

Just goes to show you the importance of monitoring problematic ASes.

That’s enough Iran for this week, thanks for reading.

As always, Memetic Warfare guest posts are the sole opinion of their author.

ISNAD that Deep: Persistent Islamist Influence Campaign Targeting Israel Adapts to Iran War

My name is Max Lesser. I work with Ari at the Foundation for Defense of Democracies (FDD). I am sharing research that I conducted in collaboration with my colleague Emmerson Overell and my interns Kellie McSween and Ethan Sheinker.

On March 10, Emma and I published a high-level overview of our findings on over 100 accounts on X that we linked to ISNAD, a persistent Islamist influence campaign that impersonates Israelis with the express intention of destabilizing Israeli society. An Egyptian expat with historical ties to the Muslim brotherhood orchestrates the operation, which crowdsources its participants. The expat, alongside a central management team, reportedly coordinates the participants via Telegram.

We identified 118 accounts that appear to impersonate Israelis, post coordinated paraphrased content, and amplify divisive narratives, including the following: the Israeli Prime Minister is evil; the Israeli government is an undemocratic regime; Israel’s leaders use war to distract the public and preserve power; and internal ‘enemies’—including Haredim, settlers, and the Israeli government—pose a bigger threat to Israel than Hamas or Iran. These tactics, techniques, and procedures (TTPs) and narratives align with reporting on historical ISNAD activity by researchers at Active Info, the HarediLine, the Institute for National Security Studies (INSS), and Fake Reporter, among others.

After the U.S.-Israel war with Iran began on February 28, the network began increasingly incorporating Iran-related narratives, which increased from 3% of the network’s total content before the war to over 20% of its content afterwards.

Impersonating Israelis

Between March 2nd and 9th, all 118 accounts in the network appeared to impersonate Israelis by posting Hebrew-language content speaking from the perspective of Israelis, and sometimes also by explicitly listing their location as Israel. 2 of these accounts, however, were no longer active as of March 30, 2026, i.e., @raphael95yair and @Poorbaby0.

X’s transparency features show that 57 of the accounts had metadata indicating a location outside Israel in either X’s ‘Account Based In’ or ‘Connected Via’ fields. X states that the country or region displayed under ‘About this Account’ is inferred from aggregated IP addresses. X’s ‘Connected Via’ field shows how an account’s user connected to X, which is often via an app store in a specific country or region. Regional app stores associated with this network spanned West Asia, North Africa, Europe, and East Asia, while country-based app stores included Egypt, Morocco, Germany, Iraq, Cyprus, Algeria, Tunisia, Italy, the UAE, and Côte d’Ivoire. Additionally, 68 accounts were marked as based in Israel in the ‘Account Based In’ transparency field. However, X flagged all 68 of these accounts for possible VPN use.

The location metadata described here is based upon observations made between March 2nd and 9th, and may not reflect the current location metadata. Location metadata can change over time when accounts connect in different regions or via different regional proxies, and this metadata can also be spoofed.

Figure: Images of four accounts in the network presenting themselves as Israelis

Figure : X’s transparency feature showing the same four accounts connecting via Android apps associated with Iraq, Morocco, and North Africa.

Coordinated Posting

The incongruity between many of the accounts’ Israeli presentation and their location metadata is a strong indicator of inauthenticity. The network’s posting behavior demonstrates that it is not only inauthentic, but also coordinated. Specifically, the network engages in coordinated posting activity where its accounts consistently post identical or nearly-identical (e.g., slightly paraphrased or rearranged) content.

This analysis collected posts from accounts suspected to be in the network between November 1, 2025 and March 9, 2026. It considered accounts to be part of this network if they engaged in at least one cluster of coordinated content. And so, definitionally, all 116 active accounts participate in at least one coordinated content cluster. In addition, 94 accounts in the network participated in at least 10 clusters; 46 accounts participated in at least 50 clusters; 16 accounts participated in more than 100 clusters; and 5 accounts participated in more than 200 clusters.

Figure: Network visualization of accounts that participated in at least 50 coordinated posting clusters. Node size is proportional to the number of distinct clusters each account participated in. Edge thickness is proportional to the amount of co-participation between two accounts, measured by how often they posted within the same coordinated clusters.

Within the collection period, the network posted 2,274 coordinated content clusters (i.e., content that is either identical or paraphrased and posted by at least two accounts in the network). 1,855 of these clusters were posted by the network 2–4 times; 354 clusters were posted 5–9 times; 50 clusters were posted 10–14 times; 13 clusters were posted 15–19 times; and 2 clusters were posted 20+ times. 1,974 clusters were posted by 2–4 accounts; 260 clusters by 5–9 accounts; 34 clusters by 10–14 accounts; 6 clusters by 15–16 accounts. These numbers demonstrate a high degree of coordinated posting activity across the network.

The largest coordinated content cluster includes Hebrew-language variants of a message stating that Israel is in an existential political crisis, that this crisis is as dangerous as Iran, that the Israeli government is more dangerous than Iran’s regime, and that immediate revolutionary action is necessary to overthrow it. This content was posted 22 times by 16 accounts in the network. Across these posts, the differences are limited to subtle changes in wording, register, and punctuation, while the overall structure and political message remain the same.

Figure: A sample of four posts from the largest coordinated content cluster. @WYylwn41269 and @shatz_david post identical messages while @DanielG_efen and @shera26116 each post slightly paraphrased variants.

A little under half of the network’s posts are replies. Moreover, of 17,589 replies in the dataset, 17,584 (99.97%) target accounts outside the 118-account network, likely to reach external audiences rather than create the impression of engagement with content posted by the network.

In addition to the network’s coordinated posting behavior, the timeline of the accounts’ creation dates are also compressed within a two year timeline. The earliest account in the network was created in May 2024. Over 90% of the accounts were created during or after January 2025, which is the month when Israel and Hamas reached their initial ceasefire agreement. The 2-year compressed timeline provides an additional indicator of coordination, albeit a weaker one than the posting patterns: from a random sample of over 100 authentic accounts, one would expect a broader temporal distribution than two years.

Key Narratives

Multiple key narratives persist throughout the network’s content. The most prevalent narrative demonizes the Israeli Prime Minister, Benjamin Netanyahu, characterizing him as the most pressing threat to Israel. The network’s posts often use words like “Traitor” (בוגד), “Swindler” (נוכל), and “Destroyer” (מחריב) when describing Netanyahu. Posts claim that Netanyahu is responsible for various wars, political decay in Israel, manipulating the public, and the collapse of Israeli institutions. Content posted by the network even includes the claim that Netanyahu has caused more damage to the Jewish people than anyone since Hitler, and that Netanyahu is more dangerous than Iran or Hamas.

Figure: A sample of four posts from a coordinated content cluster that attacks Benjamin Netanyahu.

Another key narrative is that the Israeli government has become a regime or theocracy, with Israel depicted as undergoing either democratic backsliding or collapse. Content communicating this narrative sometimes argues that elections are not a solution, and Israel instead needs revolution or uprising.

Figure: A sample of four posts from a coordinated content cluster depicting the Israeli government as undemocratic and dictatorial.

Another one of the network’s key narratives is that Netanyahu wages wars to preserve his power. Various claims include that the Israeli government is using war to distract the public, suspend elections, or create a permanent state of emergency.

Figure: A sample of four posts from a coordinated content cluster claiming that Netanyahu is waging war against Iran in an attempt to delay elections

Another key narrative frames internal Israeli actors—especially coalition politicians, right-wing ministers, settlers, and Haredi political blocs—as threats from within and, often, as the greatest threat to Israel. Posts frequently claim that these actors pose a greater danger to Israel than Hamas or Iran, with a particular focus on Haredi draft exemptions and the influence of right-wing ministers. Some posts go further, explicitly comparing Israeli politicians to Iran’s rulers, claiming that “there is no difference between the Ayatollahs in Iran and those here.”

Figure: A sample of four posts from a coordinated content cluster framing Haredim and settlers as a threat to Israeli society.

Another recurring narrative portrays the Israeli media as helping manufacture public consent for Netanyahu and for various wars, often using language such as “brainwashing” and “consciousness engineering.”

Figure: A sample of four posts from a coordinated content cluster claiming that the Israeli media is manipulating Israeli public consciousness.

Between the start of Operation Epic Fury (February 28) and the end of the collection period (March 9), the network increasingly leveraged the U.S.-Israeli strikes against Iran in its divisive narratives. These included claims that Netanyahu was using the conflict to preserve power, that people and politicians within Israel posed a greater threat than Iran, and that Israeli coverage of the Iran war was manipulative and propagandistic. As mentioned earlier, Iran-related narratives increased from 3% of all its content before February 28 to over 20% of its content afterwards.

Figure: A sample of four posts from a coordinated content cluster claiming that Iran does not want to eliminate Israelis, but Trump and Netanyahu do.

Attribution

The network appears to be a wing of the persistent Islamist influence campaign known as ISNAD. ISNAD’s TTPs and narratives closely align with those seen in the network discussed in this analysis. Previous TTPs associated with ISNAD include the following: impersonating Israelis on X and other platforms; posting coordinated messages that are slightly paraphrased to avoid detection; and primarily posting replies to authentic Israeli accounts. ISNAD’s narratives exploit divisive political and social topics within Israel, often heavily criticizing the Israeli government. More specific narratives associated with ISNAD include attacking Netanyahu, accusing the Israeli government of failing to protect its citizens, criticizing Haredim and settlers, and occasional calls for uprisings or revolution.

ISNAD’s participants come from regions across the globe including West Asia, North Africa, and Europe, which aligns with the location data of most accounts in the network discussed in this analysis. Additionally, many of the accounts appear to attempt to mask their location with a VPN, which is also a TTP associated with ISNAD.

Given that many of the accounts have metadata on X showing their location is in “Western Asia,” it is possible that there is some Iranian participation in this network. Iranians also have impersonated Israelis in the past. However, nothing specifically indicates Iranian involvement, as this metadata could also be associated with one of over a dozen other West Asian countries. The most plausible attribution of this network is to ISNAD, rather than Iran.

The network’s activity demonstrates how ISNAD’s crowdsourced, “grassroots” influence operations can achieve persistence and rapidly adapt to emerging events to destabilize Israeli society.

Richard Hancock is a threat intelligence researcher at DarkOwl specializing in darknet intelligence, OSINT, and counterterrorism. His work examines how extremist and hybrid threat actors leverage distributed digital ecosystems to shape narratives, manufacture perceived power, and influence real-world outcomes.

As per Richard, rather than emerging as a clearly defined militant organization, Harakat Ashab al-Yamin appears to function as a distributed identity embedded within a broader ecosystem of Iranian-aligned channels. This piece examines how claims, media, and narratives move across platforms, revealing a model where influence is constructed through amplification, reuse, and strategic signaling rather than centralized control.

As always, guest posts on Memetic Warfare are the opinion of their author alone.

Let’s begin.

Harakat Ashab al-Yamin al-Islamia: A New Group or Part of a Broader Iranian-Aligned Network?

A previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (Ashab al-Yamin) has emerged, claiming responsibility for a series of attacks across Europe and quickly attracting attention from analysts and media outlets. Recent reporting by Long War Journal has documented the group’s increasing tempo of claimed attacks across Europe, noting at least 15 incidents since March. Reporting by CBS News, citing researchers from Tech Against Terrorism and others, has similarly highlighted the group’s sudden appearance and raised questions about whether it represents a genuine operational network or a rapidly assembled media construct linked to broader geopolitical dynamics.

The group’s activity appears largely confined to Telegram, where it publishes a mix of attack claims, propaganda, and geopolitical commentary. Its presence is fragmented, with limited persistent content and much of its activity preserved through secondary or supporter accounts.

Rather than evaluating Ashab al-Yamin as a standalone entity, a closer examination of its Telegram activity suggests a different framing. Patterns of shared content, cross-channel distribution, and overlapping narratives indicate that the group operates within a broader, loosely connected ecosystem of Iranian-aligned channels. This ecosystem overlaps with networks commonly associated with the “Islamic Resistance,” where claims, media, and messaging circulate across multiple accounts rather than originating from a single source.

This raises a central question: is Ashab al-Yamin a distinct organization, or a visible node within a broader networked ecosystem of influence and amplification?

Telegram Activity and Content Patterns

As of early April 2026, the group’s primary Telegram channel, Harakat Ashab al-Yamin al-Islamia, appears to have been removed or banned from the platform. The most recent identifiable content, dated April 4, included a video claiming responsibility for an attack targeting a building associated with Christians for Israel in Nijkerk, Netherlands. While a potential successor channel may exist, no clearly verified or consistently active replacement has been identified at the time of writing, reinforcing the group’s fragmented and unstable presence across Telegram, where continuity appears dependent on redistribution rather than sustained ownership of a single channel.

Since that time, additional content attributed to Ashab al-Yamin has continued to surface across secondary channels, particularly through Sabereen News. Multiple new videos published between April 15 and April 19 claim attacks across European cities, including Munich, London, and North Macedonia. These releases follow a consistent format and narrative framing, reinforcing the pattern of distributed dissemination observed throughout this analysis.

One such example includes a video depicting a purported attack targeting Israeli diplomatic infrastructure in London, featuring hazmat-style protective gear and a small drone bearing Ashab al-Yamin insignia. The use of printed insignia and staged visual elements appears intended to signal authorship and operational credibility, regardless of independently verifiable evidence.

[Screenshot 1& 2: Frames from Ashab al-Yamin video depicting a purported London-based attack, featuring a small drone and hazmat-style protective gear marked with printed insignia, illustrating visual signaling of authorship]

Open-source image hosting platforms have also been observed containing files associated with Ashab al-Yamin insignia, reinforcing the possibility that elements of the group’s visual identity are assembled and distributed through accessible online tools rather than a centralized media apparatus.

[Screenshot 3: Propaganda-style graphic associated with Ashab al-Yamin, combining group insignia with a stylized European cityscape, reinforcing the role of visual media in signaling authorship and amplifying perceived operational reach]

As a result, much of the group’s observable activity is derived from secondary or supporter channels, such as صفي الدين (Safee al-Deen), which continues to circulate attack claims, propaganda, and related content attributed to the group.

Initial review of these channels suggests they do not function solely as claim-of-responsibility outlets. Instead, they operate as hybrid media nodes, combining attack claims, geopolitical commentary, and propagandistic amplification of broader regional narratives.

For example, content includes battlefield or intelligence-style analysis, such as satellite imagery purportedly showing damage to U.S.-linked air facilities in Bahrain and Kuwait following Iranian strikes. The accompanying text describes specific targets such as hangars, fuel storage, and drone infrastructure.

[Screenshot 4: Satellite imagery / strike analysis post]

This style of posting is consistent with content observed across pro-Iranian Telegram channels, where content blends battlefield updates, geopolitical commentary, and narrative amplification alongside claims of responsibility for attacks in Europe.

[Screenshot 5: London ambulance attack claim video]

Another example includes a video documenting an arson attack in London targeting ambulances associated with a Jewish community organization. The accompanying Arabic-language caption frames the incident as an operation carried out by Ashab al-Yamin, referencing a synagogue in the British capital and linking the action to broader anti-Israel narratives.

More recent content attributed to the group includes claims related to an attack targeting a commercial center in Amsterdam. One such post states:

[Screenshot 6: Amsterdam attack video from Ashab al-Yamin]

حركة أصحاب اليمين الإسلامية تتبنى استهداف المركز التجاري العالمي في أمستردام، وتدعو شعوب أوروبا إلى الابتعاد عن المصالح الأمريكية والصهيونية فوراً

Translation:
“The Islamic Movement of Companions of the Right claims responsibility for targeting the World Trade Center in Amsterdam and calls on the peoples of Europe to immediately distance themselves from American and Zionist interests.”

The limited availability of such claims on the group’s official channel, combined with their continued circulation across secondary and affiliated channels, complicates efforts to identify a single point of origin. Instead, messaging is distributed across multiple accounts, where content persists through redistribution rather than consistent publication from a single source.

Content Origination and Cross-Channel Linkages

One particularly notable detail is the presence of Sabereen News branding within video content that was previously reposted by Ashab al-Yamin’s official Telegram channel.

[Screenshot 7: Ashab al-Yamin post showing Sabereen News watermark; London attack]

Sabereen News is a Telegram-based media outlet widely associated with Iranian-aligned networks, with multiple analyses pointing to links with Iran’s Islamic Revolutionary Guard Corps–Qods Force (IRGC-QF) and Iran-backed militia groups. Research by the Washington Institute for Near East Policy notes “strong indicators” of IRGC-QF connections and highlights that the channel first appeared on Telegram in January 2020. More recent reporting from Iran International similarly reflects its position within IRGC-linked messaging networks.

The visible Sabereen News watermark within the footage of the London ambulance attack suggests that the video was either sourced from, or circulated through, an Iranian-aligned media channel prior to being reposted by Ashab al-Yamin. Rather than serving as definitive proof of origin, this overlap indicates participation in a shared media pipeline where content is reused and redistributed across channels.

This interpretation is further supported by activity observed on the Sabereen News channel, which regularly publishes operational updates, threat messaging, and geopolitical narratives aligned with Iranian interests.

[Screenshot 8: Sabereen News missile / strike-related footage]

Additional Sabereen content illustrates this broader narrative environment.

[Screenshots 9 & 10: Sabereen News corporate targeting / company list]

In this example, Sabereen News publishes a list of Western companies, including technology firms, financial institutions, and defense-related entities, framing them as potential targets linked to broader geopolitical events. While this is not a direct claim of responsibility, it reflects a broader pattern of signaling and narrative shaping seen across affiliated channels.

Additional recent content from Sabereen News further illustrates its role as a central distribution node within this ecosystem. In some cases, this aggregation extends beyond Iranian-aligned actors.

For example, Sabereen News has been observed resharing content attributed to Sunni jihadist groups, including material linked to Ajnad Bayt al-Maqdis. The original post appears to have been published by a Telegram account operating under the name “hamid alqawsi,” before being redistributed through Sabereen. The group’s recent pledge of allegiance to al-Qaeda, dated February 2026, coincides with broader regional escalation, reinforcing patterns of opportunistic emergence tied to major geopolitical events. This further illustrates how content moves across distinct networks through centralized amplification channels.

[Screenshots 11 & 12: Original Telegram post from “hamid alqawsi” account and subsequent repost by Sabereen News]

In a separate example, the channel reposts video footage attributed to Hezbollah depicting a missile strike on the Israeli town of Kiryat Shmona. While not directly linked to Ashab al-Yamin, this type of cross-group content aggregation highlights how Sabereen functions as a broader amplification hub, circulating material from multiple actors and reinforcing shared narratives across the network. Channels such as Sabereen News therefore remain key points of observation for tracking how new identities emerge and reappear within this network.

[Screenshot 13: Sabereen News Telegram post reposting Hezbollah-attributed missile strike footage targeting Israel]

An earlier Telegram channel, Haraka Ashab Al Yamin, identified as one of the first to publish content associated with the Amsterdam attack, appears to have been removed or banned from the platform, further complicating efforts to trace content back to a single point of origin.

Across posts, several additional patterns emerge that reinforce this ambiguity. The language is primarily Arabic, with no observable use of Farsi despite speculation of Iranian association, and messaging consistently incorporates anti-Israel and anti-Western themes aligned with broader regional narratives. Taken together, these characteristics further complicate attribution and raise questions about the group’s structure, consistency, and underlying coordination, which become more apparent when examining its claims and media output more closely.

Indicators of Authenticity vs Narrative Construction

The available Telegram content presents a mixed picture of Ashab al-Yamin’s credibility as an operational group. While the channel attempts to project visibility through attack claims and messaging, it lacks several features typically associated with more established militant organizations.

Unlike known Iranian-aligned and PMF-affiliated groups, Ashab al-Yamin does not consistently produce formalized statements, leadership messaging, or a clearly defined media structure. Its presence appears limited in scale, with no clear evidence of sustained or centralized coordination.

At the same time, the quality and style of its media output vary noticeably, with some videos appearing more refined and others more rudimentary. This inconsistency likely reflects contributions from multiple actors rather than a single coordinated media wing.

This aligns with assessments from analysts cited in CBS News, who note that such output may be designed to generate psychological impact rather than demonstrate operational sophistication.

The group’s messaging also closely tracks ongoing geopolitical developments, suggesting a degree of responsiveness and an understanding of how to maximize visibility within a rapidly evolving information environment.

Taken together, these patterns support the interpretation put forward by the Foundation for Defense of Democracies: that Ashab al-Yamin may function less as a centralized organization and more as a front identity used to claim attacks carried out by loosely connected or externally recruited individuals. This ambiguity becomes more meaningful when placed alongside the wider ecosystem in which the group operates.

More broadly, this model reflects a pattern observed across comparable ecosystems, where decentralization, narrative amplification, and perceived reach are often prioritized over formal organizational structure. In such contexts, visibility and attribution can be strategically leveraged to amplify perceived impact without requiring sustained operational capability.

PMF and Iranian-Aligned Telegram Ecosystem

Rather than viewing Ashab al-Yamin in isolation, its activity is better understood within a broader cluster of Telegram channels linked to the “Islamic Resistance” ecosystem. This ecosystem aligns with what is often described as the “Axis of Resistance,” a network of Iranian-aligned state and non-state actors operating across the Middle East and beyond.

This ecosystem includes a mix of militia-linked channels, media outlets, and amplifier accounts. Channels such as:

• شباب الإسلام

• أصحاب الكهف

• جيش الغضب

• صفي الدين

• التعبئة الشعبية للمقاومة الإسلامية في العراق ( بسيج العراق)

• القدرات العسكرية الإيرانية

These channels regularly publish claims, updates, and propaganda tied to attacks against U.S. and allied targets, while also forwarding and resharing content from one another. These channels function as an interconnected network, regularly cross-posting and reinforcing shared narratives.

[Screenshot 14: Safee al-Deen / ecosystem connections post]

Posts such as the above highlight explicit relationships between multiple groups operating under the umbrella of the “Islamic Resistance,” including Ashab al-Kahf and Jaysh al-Ghadab.

Ashab al-Kahf is an Iraqi militia group aligned with the Islamic Resistance in Iraq, known for claiming attacks against U.S. military and allied targets in the region. Its Telegram presence reflects a structured communication style, including consistent branding, formalized statements, and clearly framed claims of responsibility

[Screenshot 15: Ashab al-Kahf Telegram profile / branding insignia]

Jaysh al-Ghadab similarly operates within this ecosystem, publishing claims and messaging tied to attacks and broader resistance narratives. Like Ashab al-Kahf, its content reflects a more established and consistent media presence, with recognizable visual identity and integration into a wider network of affiliated channels.

[Screenshot 16: Jaysh al-Ghadab Telegram profile / branding insignia]

While these groups exhibit more structured branding and communication styles, they operate within the same broader environment as Ashab al-Yamin. Screenshots 17 and 18 illustrate formalized statements published by Ashab al-Kahf and Jaysh al-Ghadab, both of which were subsequently forwarded by the Shabab al-Islam channel. This pattern highlights how official statements originating from more established actors are redistributed across affiliated channels, reinforcing shared narratives, and expanding reach.

[Screenshot 17 & 18: PMF formal statement example]

Both statements follow a consistent format typical of PMF-aligned media output, including religious framing, attribution of attacks against U.S. and Israeli interests, and references to specific operations. For example, one statement claims responsibility for a drone attack targeting Israeli-affiliated infrastructure in Jordan, while emphasizing civilian evacuation warnings and framing the operation within a broader resistance narrative. The second statement similarly adopts formalized language, invoking religious justification, and positioning the attack within the context of ongoing regional conflict. This contrast becomes more apparent when comparing how similar attack-related content appears across different channels within the network.

[Screenshot 19: London ambulance attack claim Ashab al-Yamin TG channel]

[Screenshot 20: London ambulance attack claim: Safee al-Deen TG channel]

Screenshots 19 and 20 show the same London ambulance attack being circulated through Ashab al-Yamin and Safee al-Deen channels, illustrating how identical content is redistributed across different nodes within the network, often with variations in framing and presentation.

These examples illustrate how similar content is circulated, reframed, and redistributed across different channels, reinforcing visibility and narrative consistency.

A Networked Playbook

The emergence of Ashab al-Yamin aligns with a broader pattern seen across similar ecosystems: the rapid creation of new identities designed to claim responsibility, amplify narratives, and generate strategic effects.

Recent analysis by Militant Wire similarly suggests that the group may function less as a traditional organization and more as an “astroturfed” identity embedded within existing Iranian-aligned networks, leveraging low-cost, high-visibility activity to maximize perceived impact.

Rather than representing the development of a traditional, hierarchical organization, this model prioritizes speed, flexibility, and visibility. New entities can quickly establish a presence, insert themselves into ongoing events, and reinforce narratives already circulating across interconnected channels.

As noted in reporting by CBS News, even relatively unsophisticated or ambiguous content can achieve outsized strategic effects. This aligns with analysis from the Foundation for Defense of Democracies, which notes that such models can rely on low-cost, deniable actors and coordinated messaging without requiring a formal organizational structure.

Recent research by the Global Network on Extremism and Technology similarly highlights how digital actors across different ideological and operational backgrounds can converge within shared wartime ecosystems, forming loose networks that amplify common narratives and targets.

These dynamics are not limited to militant media channels. Similar patterns can be observed among pro-Iranian hacktivist groups, which use Telegram to promote alleged data breaches and advertise them on darknet marketplaces. For example, “APT Iran” has claimed to possess stolen data from Lockheed Martin, promoting it through Telegram and advertising it on a Russian-language darknet marketplace known as “Threat Market.”

The listing advertises an estimated value of approximately $374 million, with an exclusive buyout price nearing $600 million, alongside tiered pricing for partial data access. While these figures remain unverified, their scale reflects a broader pattern of inflated valuation and narrative amplification, where the perceived significance of a breach is emphasized as much as the underlying data itself.

[Screenshot 21 & 22: APT Iran Telegram post referencing Lockheed; Lockheed leak posted on Threat Market]

More recent activity suggests increasing instability and responsiveness to external pressure. Following attention surrounding the alleged Lockheed Martin leak, the actor associated with “APT Iran” appears to have changed its Telegram identity to “Brona Blanco” and begun posting images of purported source code tied to the breach. Concurrent messaging in Farsi references potential law enforcement scrutiny, including warnings about FBI targeting of infrastructure linked to Threat Market and the implementation of contingency measures such as a “dead man’s switch.”

[Screenshot 23: APT Iran Telegram post referencing the FBI targeting Threat Market]

[Screenshot 24: APT Iran/Brona Blanco Telegram post referencing Lockheed Martin Source Code]

While these claims remain unverified, this shift in tone and behavior reinforces a consistent pattern observed across these actors: rapid escalation in claims, reactive messaging driven by perceived pressure, and an emphasis on perceived impact over independently verifiable outcomes.

This same dynamic is evident in recent claims by a group calling itself “Ababil of Minab,” which has claimed responsibility for a cyber incident targeting Los Angeles Metro infrastructure. As reported by Dark Web Informer, the group used Telegram to publicize the claim, asserting large-scale data exfiltration and system disruption while providing limited verifiable evidence. While attribution remains unclear, the group’s messaging style and distribution patterns reflect characteristics observed across other Iranian-aligned or Iran-affiliated cyber personas.

[Screenshot 25: “Ababil of Minab” Telegram posts claiming responsibility for a cyber intrusion targeting LA Metro]

As with other actors in this ecosystem, the framing of the operation emphasizes scale and impact, including claims of hundreds of terabytes of data being wiped and additional sensitive data extracted. This reflects a recurring dynamic in which perceived significance is amplified through messaging rather than confirmed technical outcomes.

This interpretation is consistent with emerging reporting on Iran-linked hybrid activity, where analysts have noted coordinated behavior across pro-Iranian digital ecosystems and raised questions about the authenticity of some groups operating within them.

Conclusion

Harakat Ashab al-Yamin al-Islamia has emerged rapidly, but its fragmented Telegram presence, recycled media, and overlap with Iranian-aligned channels complicate its assessment as a standalone organization.

Instead, it is best understood as part of a broader ecosystem in which content is circulated, repurposed, and reinforced across multiple actors. In this environment, attribution becomes less about identifying a single origin point and more about understanding how narratives move and gain traction across interconnected channels.

This model allows new entities to project visibility and claim relevance without demonstrating sustained operational capability, blurring the line between coordinated activity and opportunistic amplification.

As this environment evolves, tracking how new entities emerge, gain visibility, and integrate into existing ecosystems will remain critical to understanding how influence is constructed and projected.

It all began a bit over a week ago when LA’s metro authority confirmed that it was popped.

The intrusion only led to some noncritical systems being taken down, and service wasn’t disrupted meaningfully. An Iranian group took credit for the operation, and Dataminr was the first to report it.

The name itself is a reference to the Quran, with the ababil itself meaning a “flock”. This isn’t just any flock, but a specific one referred to in the Quran as having protected Mecca from an invading army. The reference to Minab is to the school bombed by the US in the Israel/US-Iran war, which has turned into a trope of Iranian propaganda.

Most of the overtly Islamic references I’ve seen in fronts have been related to ASA, but there have been others, as well as other bird-brained Iranian/Hizballah related operations.

You can see the logo and aesthetics clearly here:

They’ve had two main targets so far. The most recent is Vyncs, a GPS company, which they hit with a defacement on April 11th:

They include screenshots of the company’s SQL database and other internal systems:

Their first operation, as stated, was against Metro.net, LA county’s transit authority:

They managed to get in to their VMWare environment:

From there, they manually deleted clusters and uploaded some footage from street cameras:

They also gained access to some OT infrastructure, in this case managing a rail yard:

They even engage in real memery, which is something you don’t often see from the front groups themselves, and is more the type of thing I’d expect from Mr. Soul/cyberav3ngers and less from ASA or even the MOIS.

Jokes aside, their opsec isn’t perfect. They expose a TLS certificate for the host that points to the domain, which Validin picks up below, exposing the true host, despite it being behind Cloudflare.

We also see two identical domains registered on different TLDs on Cloudflare - just like the IRGC espionage operation from last week.

Despite being hosted on Cloudflare, the domain was registered on Ultahost - a registrar and hosting provider we’ve seen used by Iran multiple times in the past weeks:

The host just exposes a default Apache (one of the most common web server) homepages.

Trying to connect to the host on port 443 for HTTP (to see if the domain is hosted on the site still) gets a refusal as I lack a client certificate.

This means that they’ve locked down the ability to connect to the site hosted on the server directly, which is better operational security than we’re used to seeing, even though they messed up with the host TLS certificate.

This is especially odd considering that some of their links lead to open directories?

The domain is otherwise uninteresting, no favicon results, interesting SOA or DNS records or otherwise.

We also have some interesting post op activity. They operators seem to be running a burner, impersonating a customer responding to a tweet from Vyncs and referring to the domain:

This screams ASA to me, as it’s the type of thing they do and less for say cyberav3ngers/APT IRAN.

As stated earlier, they started off with a Telegram channel and Twitter account. The Telegram channel is already shadowbanned, and the Twitter account has been taken down.

Like past ASA operations, they do have backups ready to go on Twitter:

We also have an Arabic-language Twitter account which is still active. This is the type of thing that ASA does, they often run fronts in Arabic which we see less of from other groups:

This one is a fun one attribution-wise.

• Actual intrusion into critical infrastructure. Leans more towards IRGC (Cyberav3ngers or ASA), though could be MOIS

• Prepositioned backups ready to go on Twitter, something ASA has done, though other MOIS orgs have also (Handala in particular)

• Use of Cloudflare - past IRGC operations, higher value

• Islamic-language and aesthetics, similar to ASA

• Running the operation partially in Arabic, points to ASA

• Targeting US critical infrastructure, but seemingly for real (at least to some degree) similar to IRGC actors like APT Iran/CyberAv3ngers, ASA

• Running additional entities beyond the main accounts - most commonly seen with ASA and IRGC actors but also done occasionally by MOIS actors

• Registering two domains on Cloudflare simultaneously like last week’s IRGC spying operation. This means this is a higher-investment operation and I can’t recall many cases when the MOIS used Cloudflare, but I could be wrong.

• Tighter OpSec than most MOIS operations

I’m inclined to believe that this is IRGC-related and not MOIS due to the above points.

The question there is, ASA or Cyberav3ngers/APT-Iran?

This one is a bit less clear, but if I absolutely had to guess, I’d lean towards ASA due to the specific TTPs - creating a new, higher-investment front with Islamic branding, but it could just as easily be cyberav3ngers or any other IRGC-related group (memery, timeline etc) or even the MOIS.

That’s it for this week, thanks for reading.

To summarize, the individual, who said they edited the Israeli military newspaper “BaMachane” in 2016, received a message from an SMS sender named “IRGC”. The message says, in stilted Hebrew:

“In the name of the conquer of Khaybar, Niv, the commander of “BaMachane” in “Dotz” [shortened name of Israeli Military Spokesperson’s office]. We know that you [plural] taste the taste of death every day. This isn’t the future built for you. You must stand against the brutal and stupid acts of Netanyahu. The moment of the collapse of your corrupt government is very close. This is your last opportunity to live in peace with other honest people in the world. To save your lives, send a message [url]”.

This caught my eye for a few reasons.

Firstly, most Iranian SMSes sent like this don’t include a link or personal information, whereas this message refers to the target by name and includes information on his past unit, indicating that the sender has at least that personal data on the individual.

Secondly, the information available is accurate, as confirmed by the guy who tweeted it.

Iranian operators could have this from multiple sources, including scraping social media for past unit affiliation, breached data for name and phone numbers or other, bigger data breaches (say, LinkedIn). Regardless, highly targeted SMSes.

So, let’s take a look at the link. The short URL resolves to the below domain:

In short, the site is a “center for the recruitment and absorption [possible reference to similar phrasing in the Israeli “Bakum”, the base where all soldiers officially join the military] of personnel from various intelligence, defense, security, military and government organizations and institutions in Israel”.

Most notably, the site is overtly run by the IRGC. This is interesting as this is, to the best of my memory, the first IRGC-branded domain. Others have been organization-agnostic or tied to MOIS-related actors.

The site offers “special support services to people who send us secret and classified information from Israel”, including:

• Payment of “secure and untrackable” salary via crypto

• Payment via various foreign currencies

• Payment of a high salary immediately for those who carry out “special operations”

• Payment of a high salary those in active service and retirees as “an additional job”

• Provision of asylum or shelter to those recruited

The site also states that all communication is handled in a “completely secure” fashion, “far from any cyber or field surveillance”, and that the “interaction” for them is their top priority in terms of safety and anonymity.

The site then invites those that have “initiative”, or special “personality or group” skills to contact them via Telegram or via the site directly. Funnily enough, they ask also for a resume via Telegram, and run a Telegram bot to make communication easier.

They were kind enough to include a FAQ:

They’re apparently gunning for leaders of “organized groups”:

Marxists would be happy to see that the IRGC doesn’t buy into the concept of unskilled labor, saying that “in our opinion no one lacks expertise, everyone has skills”:

Let’s take a look at their entities. The Telegram channel was created on March 21st but only became active on April 2nd:

It already has 11,500+ subscribers, many of which I assume are fake to give it an air of legitimacy.

The posts themselves are obviously very much AI-generated and posted in English and Hebrew:

The domain infra isn’t super interesting.

They’re using the Russian DDoSGuard service, as Handala and other Iranian groups have many times in the past.

They have one past host on M247, which Iranian IRGC and MOIS actors have used many times in the past, but not much of interest is available there now. It’s now off of the M247 host, which only had HTTP/S ports open anyway, and fully on DDoSGuard.

Doing a quick search for similarly named domains finds one .com domain which previously was on CloudFlare, but was taken down presumably quickly.

Back to the domain itself. In contrast to past recruitment operations, which went as wide as possible in terms of targeting and had a strong IO component to them, this operation is focused and stealthy, comparatively at least.

This campaign clearly targets exclusively military/government personnel, which makes sense based on the person who first flagged it and the probable sourcing they’re using, not people off of the street.

We can also see this focus reflected in the source code for the domain. The robots.txt file is set as “noindex, nofollow” to prevent all indexing by search engines. They don’t want it to be found or exposed too early, but rather just seen by those sent links.

They’ve tightened up the exposed WordPress endpoints that are so often left exposed:

They’ve even obfuscated the admin login panel, though not in a way that would impact anyone really interested in popping the site from finding it:

By diving into the source code we can find the line where they call WordPress APIs and the obfuscated URL to find it:

They’re using the forms tool SureForms to receive incoming messages with a webhook integration:

Overall, a very interesting development here. To summarize, we have an IRGC espionage recruitment operation specifically targeting military/government personnel, and presumably using breached data and/or other open source data to target people individually.

In contrast to MOIS or other recruitment operations, this operation tries to keep a low profile and has minimal to no IO components to it. The operation is also less exposed than other MOIS operations, which casually throw OpSec to the wind.

Quite interesting IMO and definitely a space to keep watching.

That’s it for this week, thanks for reading.

What caught my eye was an article from the Wall Street Journal covering claims that Iran has wiped at least 60 companies. I hadn’t heard much about a new large-scale wiper campaign, so I decided to take a look.

After checking the usual suspects, I noticed that Anonymous for Justice, known for having popped an email server of the Israeli MOJ in one of Iran’s more successful intrusion ops, was responsible for the lion’s share of these intrusions.

As a side note, I’ve always wanted to publish more on Anonymous for Justice but there’s an Israeli gag order on it, so I’ve held off. Perhaps one day I’ll be able to get something out on them.

I was ready to be impressed with perhaps some new malware or tooling, or some impressive targets. Instead, they’ve been hitting quite literally whatever they can, including Israel’s most reputable and well-known food powder companies:

The best part though is seeing them delete the data. In the few dozen videos they’ve uploaded, you can see videos at 2-3x speed of them manually deleting files. They were in such a hurry to do this that they couldn’t automate it or use previous wiper toolkits, which is interesting in of itself.

I hate to discuss Handala ad nauseum as well, but they’ve also been engaging in similar shenanigans. They also recently targeted St Joseph county in the US in a similar fashion to past breaches, which is getting them up there with past IRGC intrusions into US infrastructure.

They seem to have nothing of actual value, despite having taken the “most sensitive and classified information” of the good people of St. Joseph’s county, sharing photos of misdemeanor complaints, medical test results, and some lines in a database. The final sentence got me, claiming that the information “has the potential to permanently alter the administrative and social order and security of this region”.

Not to rehash endlessly everything that they do, but Handala has been targeting and deleting data from a number of Israeli companies. Similarly to Anonymous for Justice, they’re also manually deleting files:

As mentioned on MW in the past, they’re also very interested in continuing to recruit Israelis and show no signs of stopping. I’ve seen them use TOX in the past but this may be one of the first times they’ve used Session:

The last thing we’ll discuss is APT Iran’s claim to have exftiltrated 308108 petabytes of data from Lockheed Martin. In reality they only claimed to have stolen a few hundred terabytes, which is equally as unlikely.

I’ve seen some coverage of people saying this is financially motivated, and I am begging you: it is absolutely not. Charging some exorbitant price is all about making it a more appealing news item.

Those of you interested in APT Iran, a fascinating front tied to the IRGC and cyb3rav3ngers, see below:

The interesting part here is the creation of ThreatMarket. ThreatMarket is a Russian language channel and Onion site:

They post in English as well, and claim that APT Iran asked them to sell the data from Lockheed Martin:

They offer the data for sale at a very reasonable 600 million USD ish:

This is absolutely ANOTHER case of Iran impersonating Russian actors for their hacktivist fronts. The MOIS did a very similar thing back in the day with Hunt3r Kill3rs in the IDF Leaks operation:

In fact, it isn’t even the first time that they’ve offered data for sale as part of their IO efforts - see below:

Speaking of Cyber Isnaad Front, some of their previously hacked material is also making headlines now, with some of their old hacked material being now used by Iranian IO efforts apparently (or perhaps grassroots Iranian activity) to allege that an Israeli woman was somehow involved with the US operation in Iran. Funny how these things work out.

That’ll be it for this week, thanks for reading.

We have a few things to look at this week.

Firstly, we’ll start off with Domaintools Threat Intelligence’s latest look at the accidental exposure of a TLS certificate private key in Qihoo 360’s latest security automation product. Very interesting to get a look at how China’s premier information security company operates.

In addition to always being highly detailed and high quality, DTI also often puts out useful visuals and explains in-depth what’s going on. As someone whose learning journey has relied very much on blogs and technical writeups, I’m always appreciative of companies that take the time to do this:

From there, we’ll check out the FBI’s latest advisory on Iran, specifically the use of Telegram as C2 infra from the MOIS for cyber-enabled IO.

On a separate note, we’re really living in the golden age of MOIS activity, the IRGC used to be the only player in town worth mentioning, not so much anymore.

We get some detail here. Nothing super advanced - relies on social engineering to get the malware onto the device by making it appear to be Telegram or some other app (after having presumably messaged the target a malicious link to download it), and then interestingly connected to Telegram bots to exfiltrate the data. We see this confirmed in the “initial access” section:

Based on past Iranian operations, it seems that they could only effectively export data from installed apps such as Telegram or perhaps WhatsApp, as most of what I recall we saw came from there, but I could be wrong. This is in fact confirmed in the file names of the malware, showing Telegram, WhatsApp and even KeePass being impersonated:

There’s a specific reference to Handala:

And a broader explanation of how Iranian actors just love doing cyber-enabled IO:

We’ll conclude with what I assume is an AI-generated visual describing the flow:

From here, we’ll take a look at a great look from Max Bernhard on a phishing campaign hosted by Aeza targeting European officials over Signal and other applications:

I’ll put the summary below:

Defisher is a commercial tool, and it may be used by other actors beyond whoever was using it before. This is also a stellar example showingthe value of fingerprinting and searches on Censys.

It starts with the Defisher login panel, which may seem mundane. However, like anything unique (ish, in this case), we can find a way to write a unique query for it on Censys to find HTTP responses that match the page content.

The simplest way is to just look up Defisher as it’s the unique component of the panel on Censys, but if this panel were more unique, we could try to write an even more specific query to find exact pages that this panel appear on.

We can easily check that out by trying to fingerprint the panel, in this case just looking up “defisher” in Censys, giving us a domain running HTTP, in this case even having the title be “Defisher”:

We can easily check this bad boy out and see that it’s another instance of the same panel:

The host server it’s on hosts this site and one other which glaringly imitates WhatsApp authentication:

Now, there’s more that one could do with this, but the point here is that by just doing this quick pivoting we found additional instances of defisher being run.

It appears that they’re part of the same campaign,based exclusively on the similarity here of the WhatsApp auth domain and the aforementioned article, but we would have to find other points to line up first before confirming.

That’s it for this week, thanks for reading.

I’m opening this week’s post with a sad development: the time of death of Meta’s now semiannual threat report, available here.

See the executive summary below and you’ll begin to see why. Firstly, there’s a huge focus on things that are important, sure, like fraud and scams and so on, but these come at the expense of cyber and influence operations, which get short shrift. One could argue that fraud and scams and nudify apps and so on are on the whole worse for society, and that may be true, but it’s still disappointing to see what was once the core of the threat report be relegated to a few pages at the end.

I’m also going to take a moment here to digress. I’ve often been pro-Meta in the industry as they were one of the few companies to actually publish, as well as provide account and page transparency as well as an accessible ad library.

One thing they haven’t been good at is sharing credit or cooperating with the community. I’ve shared impactful things with Meta multiple times, only to never hear anything back or see any action take place. I’ve seen Meta report on things covered on my blog or others months before only to see no reference to them. If you aren’t Open AI, Microsoft or one or two other companies, then you aren’t really an industry peer or part of the “research community” as far as Meta goes.

Now that that’s over, let’s move on to what we do have: an Iranian influence operation with some success across Facebook and Instagram. This operation targeted the US with a smaller component targeting Iraq.

We get some information on the background use of infrastructure, for example “clean devices” and “proxy IP usage” - not that that’s so technically-sophisticated per se, though perhaps I’m just biased here and think that’s par for the course. Despite the use of proxy infra, Meta still found “signals” that tied it together, so they clearly weren’t so professional about it.

The information on the identities is interesting - we get political American figures, sure, but also an Albanian satirist, despite Albania not being mentioned in the rest of the report. I assume that the Albanian persona was meant to swing public opinion in Albania (a known thing that Iran focuses on due to the MeK being based there), so odd that Meta didn’t further expand on that.

We see the actual accounts below:

And another, pretty clearly using a GAN image background:

And a last one named “Millar Levy”, a very odd name that I truly can’t pin on any one ethnic group, and certainly not a Jew as Levy would imply.

The final interesting note is that once caught, the network “pivoted to a strategy focused on speed and volume”, throwing content quality and abandon to the wind.

We also get some interesting insight into Pakistani domestic activity using AI. The use of AI meme cracks me up, as if it’s at all difficult to use AI nowadays.

Can only imagine which “industry peer” tipped them off to this, and no, I am not hinting that it was me.

We also get some content samples, which is nice because we don’t always get those from Meta:

The AI used is as follows: essentially, at every stage, which makes sense.

We of course have the requisite Russian operations also, showing some success:

The reliance on proxy IP providers is something that, while it’s great that it’s stated by Meta, should be taken for granted at this point.

We also have a Chinese operation with nothing particularly interesting about it.

We also have one final Iranian operation targeting Azerbaijan. This one is interesting in that Meta found that it was run by two Azeris based in both Iran an Germany, as well as the long-running span of the operation and the “high-quality persona building” there.

So, that’s it I guess. The Meta threat report went quarterly, now semiannual, and each time includes significantly less information. That’s life I guess.

Thanks for reading.

We’ll take a look this week at the DOJ’s seizure of four domains related to MOIS operations such as Handala and Homeland Justice, available here.

Let’s take a look at the affidavit. We’ll skip the boring introduction. Getting past the background, at section 8 we see a reference to a “hack targeting REDACTED” in March 2026. Wow, wonder who it could be! I’m fine with most redactions, but if it’s an international headline, you probably don’t need to redact the name.

The redaction here gets to be kind of ludicrous. For example, footnotes 3, 4 and 5 are redacted (for some reason unclear to me, but whatever). The weirdest part is that the example referred to that identified the three as being run by the same actors is redacted, but clearly shows who posted it in the footnote. What is the point here?

Have to give the FBI credit here for coming up with a new term no one has ever used, “faketivist”:

We get a bit of insight into the Handala operation targeting what I presume is Iran International, showing that they were probably phished via Telegram:

For those curious, if you google “runtimessh.exe”, you’ll find results from AnyRun (similar to VirusTotal):

The first one is kind of boring, but the second hit for a past submission shows that the executable appeared in a zip file called “Telegram Authenticator”:

We can then jump to the very cool analysis feature on AnyRun and see them run the file, showing us that it is indeed a Telegram phishing app, masquerading as the “Telegram Technical TEAM” and having people input their activation code:

Shows just how simple a lot of this work can be, even when done to journalists who are constantly targeted.

The next interesting point is the use of crypto to purchase the domain.

I don’t particularly care which exchange it is, but it’s a great usecase for ChatGPT as it provides its own thesis. Interestingly we do see here how they were able to trace it back to an Iranian exchange.

We also get a look at how the FBI runs its own virtual HUMINT operations:

The absolute funniest part of this IMO appears in the message chain:

Just look at how the FBI agent writes. Full sentences, no contractions, absolutely glows in the dark IMO.

S/he did in fact successfully purchase the data, not hard considering that the goal of this operation is to amplify the hack and leak and get the data out to as many people as possible:

The “Heavygram-Keepass” Malware section seems super interesting but is mostly redacted:

We get a bit in the next page, showing a US victim and again use of the RunTime file as well as an executable called winappx. AnyRun also has this and it too is a stealer, using Telegram to exfiltrate data:

We also get some insight into how the Stryker hack impacted medical services:

We even get an intimidation email sent by Handala referring to their “partners”, the Mexican Cartel Jalisco Nueve Generacion (CJNG) to indimiate Americans.

We’ll conclude with a final look at a new Iranian recruitment operation, in this case running ads on Israeli news websites:

The post here, titled “Top Secret” and “encrypted”, says that the Islamic Republic of Iran is looking for an “intelligence partner” in Israel, offering 3,500 USD in crypto, which it claims “cannot be discovered”, and also offering “life and location of your choice”, presumably after clicking the ad.

Interesting that they can somehow consistently run these ads on Israeli sites via whichever ad partners they exploit, and it’s an interesting development to see them go right to a news site and not say just on Twitter as in the past.

That’s it for this week, thanks for reading.

I haven’t had the personal time to dedicate to a truly killer post like you’re all used to by now due to the ongoing regional war, and for that, you have my sincerest apologies. We should be back to normal soon hopefully.

I rarely do this, but this week I have no choice. Instead of a short, somewhat timely, often practical and most importantly, edgy, blog post, you’ll get a curated reading list of multiple things that I personally have on my to-read list in their entirety which I am now dubbing the Memetic Warfare Reading Corner.

The first is a report from Georgetown’s CSET from a month or two ago on Chinese military use of AI and their “wishlist”, available here.

While interesting, this isn’t the type of thing we’d normally discuss at Memetic Warfare, but there are a few cool things about it.

The first is that it relies heavily on RFP (request for proposal) documents - thousands of them - publicly available in China. These are the few types of public documents one can actually work with in China (alongside some customs documents) as well as patents, tenders and so on. Other corporate data is often unavailable via most methods, if at all, to obscure ownership.

There also is a short “cognitive warfare” section, focusing on requests for t hings like “deepfake” systems, which I find to be a bit overplayed. The request for a library is an interesting one:

Detection also came up:

They also had requests for broader, “LLM-powered” intelligence platforms for cognitive targeting:

Lastly, we get some information on social engineering:

Overall, a super interesting paper with a lot of utility, one of the better usecases for OSINT available.

The next Memetic Warfare Reading Corner recommendation is an academic article from Antonia-Laura Pup on the Romanian elections, foreign interference and the role of intelligence agencies:

Check out the abstract here. This one is more for those interested in policy and governance and so on, but still interesting IMO to see academic treatment of IO and intelligence in a specific event, especially one so recent.

The next piece we’ll look at is Graphika’s latest look at Iranian hacktivist fronts, a topic near and dear to my heart, available here. This is a follow up to their previous report on the topic, link available in the report. Key findings below:

There’s a lot of great stuff so give it a read if you’re interested in the space, but we’ll skip right to the Cyber Isnaad Front section:

If you were wondering, the “industry peer” is an article quoting the FDD and Memetic Warfare on this, though we disagree on attribution - I’d use higher confidence.

One of the great things about the report is the focus we get on lesser-discussed groups, such as Gaza Children Hackers:

We’ll conclude with one report from a great team to follow, Domaintools Threat Intelligence, available here on RRN/Doppelganger.

I’ll share the summary and breakdown below, focusing of course heavily on domain registration:

It’s very cool to see Domaintools really dive in to what they’re best at: domains.

Check it out, it’s fascinating and super high quality. Great stuff.

That’s it for this week, thanks for reading.

What a week, huh?

Let’s get started with some non-Iran related content, as it’s pretty early on and I’ll have more to say I’m sure going forward.

We’ll start off with Open AI’s latest threat report, available here.

We’ll skip the romance scams section and get right to the Silver Lining Playbook section:

Those of you who read MW regularly may be able to guess what I’m referring to here. I, of course, am referring to the fact that Memetic Warfare is the number one place to read about cool online operations before they get referred to in threat reports. Case in point here.

This operation, originating in China (probably, but let’s be real), focuses on actors using ChatGPT to look up people, forums and federal buildings, generate emails, look into face-swapping software and so on - all to serve a front company named “Nimbus Hub Consulting”.

Those of you with a sharp memory may recall this post:

In this guest post by Max Lesser, Nimbus Hub (alongside dozens of other domains) are exposed to be Chinese espionage domains. Give it a read.

Back to Open AI’s section. They add relevant information from LinkedIn activity (useful as well because they have access to telemetry by virtue of all being under Microsoft)

We also get insight into what they were querying - mainly using ChatGPT to write emails for recruitment, but also carrying out reconaissance on federal employees, their locations, job seekers and more. The face-swapping part is also interesting and presumably to be used in any face to face interaction.

That becomes clearer as we see the type of emails they’d write:

While great from Open AI, this is only a very small part of the puzzle, and it would’ve been nice of them to include a reference to MW or the FDD piece on it for further context as well as credit.

We’ll skip the other influence operations which are pretty par for the course, if still interesting geographically,and go to the most unique section - China’s “Cyber Special Operations”.

Because the Chinese simply do not care about exposure or OpSec, a Chinese official affiliated with a law enforcement body (probably the MPS) used ChatGPT to plan an influence operation targeting Japan:

We see that the user used ChatGPT to generate periodic reports on “cyber special operations” against global targets, showing that apparently Chinese operators use Chinese open-source models and have hundreds of operators (no surprise there). We also see that it’s probably tied to Spamouflage, so further strengthening ties to the MPS:

The operators use Qwen and Deepseek apparently, and began planning an operation against Japan’s Iron Lady following her statements re inner Mongolia, the best-named Chinese province. We also get insight into the operation itself, which focused not just on mean tweets but also setting up inauthentic email addresses to email Japanese politicians, “coopting local internet users” and running counter-operations online:

We also get exposure of used hashtags:

I especially like the use of anime to run IO:

We get even more information re TTPs towards the end, showing how the operator is probably tied to the MPS Working Group 912.

Really interesting information showing domestic and foreign activity:

We get great insight into how China actually runs these operations: hundreds of operators, active on over 300 social media platforms, using AI for monitoring, translation, content generation and more.

That’s it for this week, thanks for reading.

Maria is a former intern and now research assistant at the FDD alongside yours truly and Max Lesser. I’m beyond pleased to share her first guest post here at Memetic Warfare. Check it out below.

Bots Across Borders: How a Chinese Influence Operation is Targeting the United States, East Asia, and Latin America

By Maria Riofrio

Introduction

A coordinated cross-platform network of social media accounts and other entities posts content that aligns with the political interests of the People’s Republic of China (PRC) while targeting Beijing’s critics across X and other online platforms. The operation defends Chinese government policies, discredits human rights advocacy organizations and other dissident groups, and amplifies narratives aligned with Beijing’s positions on Xinjiang, Taiwan, and the South China Sea. It also seeks to influence political discourse in the United States, Japan, the Philippines, and Latin America.

The network includes at least 327 accounts on X that post identical or near-identical content, frequently within minutes of one another, providing a strong indicator of coordinated inauthentic activity. Identical content is defined as exact string matches, excluding retweets. Accounts also frequently interact with one another, replying to, reposting, and amplifying content within the network. This analysis focuses on these 327 accounts that engage in high-signal coordinated behavior, as well as affiliated accounts on Tumblr, Blogspot, Quora, YouTube, and other platforms publish identical narratives, suggesting a broader, cross-platform campaign.

The network divides into six primary clusters based on distinct content narratives, though accounts frequently overlap across clusters. Cluster One focuses on defending Beijing’s human rights record and attacking institutions through identical posting and coordinated hashtag use. Cluster Two targets Uyghur advocacy figures and injects anti-immigrant narratives into debates in Canada and Japan. Cluster Three focuses on Japan’s domestic politics, particularly attacks on Sanae Takaichi ahead of national elections. Cluster Four targets the Philippines, amplifying protest hashtags and narratives that delegitimize President Ferdinand Marcos Jr. while promoting pro-China positions in the South China Sea. The fifth and largest cluster targets the United States, amplifying coordinated messaging about the fentanyl crisis that targets President Trump, redirects blame away from China, and exploits partisan divides. The final cluster accuses the United States of intervening in Honduras’s recent presidential election and portrays U.S. involvement in Latin America as a form of hegemonic coercion.

Based on amplification of pro-China narratives, coordinated inauthentic behavior, cross-platform distribution of identical content, account location indicators, China Standard Time–aligned posting windows, and occasional Chinese-language content, we assess that this network operates as a Chinese state-aligned influence operation and closely resembles – if not forms part of – the Spamouflage, also known as DRAGONBRIDGE, campaign.

Cluster One

The first cluster in the network includes at least 59 accounts on X that post identical or near-identical content alongside a coordinated set of hashtags. At least 21 of those accounts repeatedly post identical text across multiple accounts, providing a strong indicator of coordination. Identical content was defined as exact string matches, excluding retweets. This analysis focuses on posts that multiple users shared verbatim and asynchronously.

Overall, 67 percent of all collected posts were identical to content published by other accounts. At least 70 distinct messages circulated repeatedly across multiple users, suggesting reliance on a shared content library.

For example, between January 19 and February 3, 2026, seven accounts repeatedly posted an identical tweet claiming that the National Endowment for Democracy (NED) “shelled out $150,000 in ‘confidential funds’ to bring Pompeo to Taiwan” and that “CEO Lai Yizhong personally arranged this ‘Taiwan-US collusion’ farce, undermining cross-strait peace and stability.”

The posts used the same three hashtags — #PuppetOfNED, #FakeHumanRights, and #AntiChinaFarce — and users reposted it verbatim over a two-week period.

Figure 1: Four accounts in the network posting identical content about NED and Taiwan using coordinated hashtags. (Link to posts: 1, 2, 3, 4)

Although most activity occurs asynchronously, the network also shows instances of synchronous posting and posting bursts within minutes of each other across different accounts. Approximately 26 percent of posts appeared within one minute of at least one other post from a different account. Synchronous posting was defined as two or more distinct accounts posting within one minute of each other, regardless of content.

Figure 2: Six accounts within the network engage in coordinated posting bursts, publishing identical or near-identical messages accusing U.S.- and Taiwan-linked organizations of foreign interference while recycling the same hashtag sets and narratives. (Link to posts: 1, 2, 3, 4, 5, 6)

A broader analysis of all content posted by accounts in this cluster reveals a consistent set of narratives that defend the Chinese government, discredit foreign critics, and reframe human rights concerns as foreign interference.

Much of the activity focuses on delegitimizing criticism of China’s human rights record, particularly with respect to Xinjiang, Tibet, Hong Kong, and religious freedom. Posts portray international advocacy organizations, foreign governments, and exiled activists as fabricators of false claims designed to undermine China’s stability. The most frequent target is the National Endowment for Democracy, alongside the Prospect Foundation and the Taiwan Foundation for Democracy. The network also targets Uyghur advocacy organizations, including the Campaign for Uyghurs and the World Uyghur Congress, as well as major international human rights organizations such as Human Rights Watch and Amnesty International. Additional targets include ChinaAid, China Labor Watch, Chinese Human Rights Defenders, the Tibet Action Institute, and the International Republican Institute.

For instance, from January 19 to February 3, 2026, nine accounts posted identical tweets claiming that “The Prospect Foundation held the ‘Taiwan-US-Japan Trilateral Indo-Pacific Security Dialogue,’ hosting Abe and O’Brien — who advocated bombing TSMC — to openly serve the ‘resist reunification by force’ separatist plot.” The tweets appeared with a coordinated set of hashtags: #PuppetOfNED, #FakeHumanRights, #PhonyDemocracy, and #SubversionTool. Another group of accounts posted identical messages alleging that the Prospect Foundation is “a peripheral of Taiwan’s intelligence agencies” that “collects intelligence under the guise of academic exchanges.”

The language and framing used across the network closely mirrors official Chinese government rhetoric regarding foreign democracy promotion and human rights advocacy. In August 2024, China’s Ministry of Foreign Affairs published an English-language report portraying the National Endowment for Democracy as a U.S. government proxy engaged in “subversion,” “ideological infiltration,” and “foreign interference.” The report also argues that NED “has long been colluding with those who attempt to destabilize Hong Kong,” strongly mirroring rhetoric used by accounts in the network.

All accounts in this cluster draw from the same rotating pool of 15 hashtags, switching between English and Chinese variants. These include #PuppetOfNED, #FakeHumanRights, #SubversionTool, #AntiChinaFarce, #InterferenceInChinaAffairs, #PhonyDemocracy, #NED鹰犬, #伪人权自由, #NED, #FalseHumanRights, #HumanRightsReality, #ChinaFacts, #ForeignInterferenceTools, #NEDhenchmen, and #Falsehumanrightsandfreedoms. Overall, 71 percent of posts appear in English, while 28 percent include Chinese-language text.

X’s location transparency feature shows that the location of accounts in the network varies widely and does not point to a single geographic base. While a small number of accounts do list Hong Kong as their location, many others either report no location, appear connected via the web without a country listed, or show locations flagged by X as likely VPN use. Reported countries span the United States, Ukraine, Sweden, Finland, Argentina, Turkey, Kazakhstan, and Thailand.

Location data does not reliably identify the location of an account’s operator, nor does it identify who directs, funds, or coordinates an account. Adversaries routinely outsource operations to third countries and rely on proxies. Malign actors can also spoof their location on X. Furthermore, several accounts show creation dates that stretch back years, indicating that operators may have acquired or purchased preexisting accounts rather than creating new ones.

Cluster Two

The second cluster of accounts includes at least 35 accounts on X that primarily target Uyghur advocacy figures and organizations. Most content in this cluster does not consist of exact text matches and appears asynchronously. Accounts push nearly identical narratives using slight variations in wording and sentence structure.

Despite this variation, the cluster displays clear signs of coordinated inauthentic behavior. For example, between January 23 and January 25, 2026, 18 accounts posted identical tweets tagging @AHakimIdris and @RushanAbbas, with many posts appearing within one minute of each other. Several accounts also engage in coordinated reply bursts, responding to the same posts and retweeting the same content. For instance, various accounts in this cluster repost or reply to content from @LisaGray291208, another account in the network.

Figure 3: Four accounts in the network post identical images tagging @AHakimIdris and @RushanAbbas within minutes of one another. (Link to posts: 1, 2, 3, 4)

A broader analysis of content posted between December 1, 2025 and February 4, 2026 shows a tightly clustered set of narratives that target Uyghur advocacy, deny or minimize abuses in Xinjiang, and inject anti-immigrant and anti-Muslim rhetoric into debates in Canada and Japan.

Much of the activity attacks Uyghur advocates by portraying them as scammers, adulterers, or tools of the United States. Posts repeatedly accuse Rushan Abbas, Dolkun Isa, and others of fabricating stories for money, “colluding” with overseas politicians, or operating fundraising schemes. The network also targets the World Uyghur Congress, claiming it launches crowdfunding campaigns to defraud Uyghurs and enrich its leadership. Several posts allege an “illicit relationship” between Rushan Abbas and Dolkun Isa and include claims of sexual misconduct.

In response to a January 19 post by the Campaign for Uyghurs highlighting the U.S. government’s 2021 genocide determination and calling for enforcement of the Uyghur Forced Labor Prevention Act, multiple accounts in the network flooded the replies with critical content. These replies redirected attention to Iran, accusing Uyghur advocates of hypocrisy and selective concern for Muslim suffering. Accounts criticized Rushan Abbas and other activists of “remain[ing] silent” on Iranian women allegedly beaten or killed for violating hijab rules, with at least one account claiming to be a U.S. citizen.

Figure 4: Four accounts within the network replying to a Campaign for Uyghurs post accusing them of hypocrisy. One account claims to be an American. (Link to posts: 1, 2, 3, 4, 5)

A second core narrative denies or minimizes repression in Xinjiang and attacks the credibility of researchers, journalists, and institutions documenting abuses, aligning closely with narratives pushed by the first cluster. Posts explicitly reject claims of genocide and portray Xinjiang as prosperous and stable. The network repeatedly targets specific researchers, particularly Adrian Zenz, labeling him a con artist. It also attacks outlets such as Radio Free Asia’s Uyghur service and frames Western reporting as propaganda. The National Endowment for Democracy remains a primary target.

A third narrative focuses on immigration politics and securitized anti-Muslim rhetoric, especially in Canada and Japan. Many posts argue that Canada’s Motion M-62 enabled extremist infiltration by portraying Uyghur refugees as members of the East Turkestan Islamic Movement. Posts call for repeal of resettlement policies, mass deportations, and claim that Islam has no place in Canada. Canada has historically been a target of PRC-linked Spamouflage campaigns, including deepfake and doxxing operations targeting Canadian officials.

Figure 5: Six accounts within the network opposing Islam in Canada. (Link to posts: 1, 2, 3, 4, 5, 6)

The network also targets Japan using a mix of English- and Japanese-language content. Several posts claim that Muslim immigrants from Xinjiang “rely on welfare without contributing” and worsen Japan and Canada’s demographic challenges. Other posts share identical protest videos that accuse the Japan First Party of xenophobia for opposing Muslim immigration, while separate posts accuse the party of corruption. The network weaponizes contradictory narratives to attack the party and Uyghurs from multiple angles.

Figure 6: Four accounts within the network criticizing the Japan First Party. (Link to posts: 1, 2, 3, 4)

Most content posted by the network is in English, with occasional content in Simplified Chinese, Japanese, and Uyghur written in Arabic script.

A smaller sub-cluster of seven accounts focuses almost exclusively on targeting Rushan Abbas and Dolkun Isa. Most tweets from this sub-cluster have at least one identical counterpart posted by another account. All posts push the same narrative with minor textual variations and repeatedly tag the same accounts, including @CUyghurs and @AHakimIdris.

Posting activity in this cluster concentrates heavily between 1:00 and 3:00 AM UTC, corresponding to 9:00–11:00 AM China Standard Time, which aligns with standard working hours in mainland China.

All accounts pair posts with cartoon-style images that reinforce the narratives being promoted, including depictions alleging affairs, betrayal, and U.S. manipulation. The same set of cartoons appears repeatedly across accounts, strengthening the assessment that this is a coordinated network.

Figure 7: Four accounts within the network targeting Rushan Abbas and Dolkun Isa. (Link to posts: 1, 2, 3, 4)

Content in this sub-cluster advances a consistent narrative: it attempts to discredit Uyghur advocacy figures by alleging a personal “cheating scandal” and then using that allegation to argue that they lack legitimacy to represent the Uyghur community. Posts repeatedly argue that personal conduct disqualifies public leadership. Many explicitly call for resignation or removal.

We identified the same “cheating scandal” narrative published on September 18, 2025, in an article on bostonjournal[.]net that links to a YouTube video using a synthetic voiceover. Bostonjournal[.]net is associated with the GLASSBRIDGE operation exposed by Google’s Threat Intelligence Group, which consists of inauthentic news sites operated by PRC-linked public relations firms, including Shenzhen Bowen Media.

Cluster Three

An additional cluster of accounts focuses on Sanae Takaichi, the Liberal Democratic Party, and the Japan First Party, pushing narratives consistent with those seen elsewhere in the network. This cluster likely sought to influence Japan’s recent lower house election, which took place on February 8, 2026, as most accounts posted aggressively in the days immediately before the vote.

Most posting occurs asynchronously, with accounts recycling identical narratives using slight variations in wording. A small subset of accounts engages in synchronous identical posting.

For example, @bower75626 and @hayes_nikk71569 post identical tweets within one minute of each other on multiple occasions. Another pair, @BellJana216868 and @ODniren59929, exhibit the same behavior. In other cases, accounts post different content synchronously but recycle identical messages over time, indicating coordinated content distribution rather than organic engagement.

Figure 8: Four accounts within the network engaging in identical synchronous posting targeting Sanae Takaichi. (Link to posts: 1, 2, 3, 4)

Like other accounts in the broader network, several users post a series of political cartoons that push identical narratives targeting Takaichi and the Japan First Party.

Figure 9: Four accounts within the network using political cartoons to target Takaichi and the Japan First Party. (Link to posts: 1, 2, 3, 4)

Much of this activity attacks the legitimacy of Japan’s political leadership. Posts portray Takaichi as corrupt, morally unfit to govern, and politically disqualified. Posts accuse her of shielding “slush funds,” accepting illegal donations, and refusing accountability. The network frames the Liberal Democratic Party as structurally corrupt.

The network also depicts Takaichi as a militarist who threatens Japan’s postwar identity and regional stability. Posts criticize increased defense spending, pursuit of enemy-base strike capabilities, and expanded Self-Defense Force operations, arguing that these policies abandon Japan’s defensive posture. Some posts contrast military spending with alleged cuts to childcare, healthcare, education, and social welfare.

Reverse image searches of the political cartoons posted by various accounts in the cluster reveal nine Tumblr accounts and a personal blog posting the same imagery and narratives. These accounts publish long-form articles accompanied by the same cartoons and push identical claims of corruption, illegitimacy, foreign manipulation, and militarism. Seven of the Tumblr blogs began posting on the same day or within one day of each other on January 18, 2026, and post at nearly identical times, indicating scheduled posting and coordination. Several articles appear verbatim across multiple accounts.

Figure 10: Multiple Tumblr accounts within the network post identical political cartoons alongside near-identical “articles,” pushing the same narratives of corruption, illegitimacy, foreign manipulation, and militarism. (Link to accounts: 1, 2, 3, 4)

Additional research revealed an account on OK.ru – a popular Russian social networking platform – posting the same identical content. Historical posts from this user show years-long engagement with narratives commonly associated with Chinese influence operations, including attacks on Guo Wengui. Recent posts by this user led to the identification of additional clusters of accounts on X, YouTube, Tumblr, and other platforms targeting the Philippines and the United States.

Cluster Four

Another cluster of 32 accounts on X, alongside seven Tumblr blogs and five Blogspot profiles, appears to target the Philippines. The cluster demonstrates multiple instances of identical asynchronous posting across different accounts, meaning separate accounts post identical strings of text at different times. While most activity occurs asynchronously, accounts in the cluster also engage in synchronous identical posting. For example, on January 8, 2026, four accounts posted an identical tweet within the same minute.

Figure 11: Four accounts within the network posting identical content synchronously. (Link to posts: 1, 2, 3, 4)

Accounts in the cluster also frequently interact with one another and reply to the same posts. In one instance, an account in the network published a post on January 23, 2026, that received more than 300 replies from other accounts in the cluster. Different accounts repeatedly spam replies to the same post, pushing similar narratives. Multiple accounts use this tactic across different posts, which creates the appearance of organic engagement and can boost content visibility.

Figure 12: Four accounts within the network replying repeatedly to a post to drive inauthentic engagement. (Link to posts: 1, 2, 3, 4)

Most content posted by accounts in this cluster appears alongside a coordinated set of hashtags and political cartoons, a tactic observed across nearly all clusters in the broader network. Accounts repeatedly post the same political cartoons and rotate them across different posts. The same cartoons appear across the Tumblr and Blogspot accounts, which publish longer-form posts that push identical narratives. In several cases, X accounts post verbatim text that also appears in the longer articles published on Tumblr and Blogspot.

Figure 13: Two accounts posting identical imagery on X and Tumblr accounts. (Link to posts: 1, 2, 3, 4)

A review of the cluster’s content reveals a coordinated set of narratives centered on political unrest in the Philippines, with a particular focus on delegitimizing President Ferdinand Marcos Jr., framing the government as systemically corrupt, and amplifying protest activity tied to the #TrillionPesoMarch movement.

The most frequently posted content consists of standalone protest hashtags or short, slogan-style messages. The hashtag #TrillionPesoMarch appears in more than 500 posts as a single-post message and in combination with other hashtags like #PhilippinesProtest, #BahasaLuneta, and #MarcosGovernmentCorruption. Dozens of accounts post these hashtags verbatim, often multiple times, indicating coordinated amplification.

Several posts accuse the Marcos family of corruption and dynastic theft. Some accounts claim that corruption extends from Ferdinand Marcos Sr. to Ferdinand Marcos Jr., arguing that “the shadow of dynastic politics always hides the stolen money for people’s livelihoods.” Other posts explicitly call for the impeachment of Marcos, citing alleged corruption and unconstitutionality.

Another recurring narrative targets the Philippine military. Several identical posts claim that military silence or loyalty to the Marcos government makes soldiers “accomplices” to corruption. Other posts frame disaster-response cooperation between Canada, Japan, Australia, and the Philippines as a pretext for countering China’s influence in the South China Sea and the broader Indo-Pacific. These posts argue that the Philippines threatens stability in the South China Sea and assert that the region belongs to China.

Figure 14: Five accounts within the network post identical messages and reuse the same political cartoon accusing President Ferdinand Marcos Jr. of corruption and calling on the Philippine military to oppose the government. (Link to posts: 1, 2, 3, 4, 5)

Two accounts in the cluster also share links to YouTube videos and YouTube Shorts that promote similar narratives and other pro-China, anti-U.S. content in video format.

Figure 15: YouTube channel posting AI-narrated videos that promote anti-Western narratives and pro-China messaging

A smaller subset of posts uses the same Philippine protest hashtags to inject seemingly unrelated discourse aligned with pro-China narratives. Some posts accuse the United States of deliberately smearing Chinese vaccines and label the U.S. an “Empire of Lies,” a characterization frequently used in Chinese state media and official diplomatic rhetoric. They frame vaccine criticism as a geopolitical attack tied to the Belt and Road Initiative and portray U.S. actions as an effort to weaken China’s global influence.

Most posts in this cluster appear in English, with some content in Filipino. Hashtag usage remains highly consistent across accounts regardless of language, reinforcing the assessment of coordination. X’s location transparency feature shows varied reported locations across accounts and often indicates that users are likely spoofing their location. However, many accounts do indicate that they connected via the China Android app.

Figure 16: Three accounts connected via the China Android App.

Cluster Five

Several accounts in the cluster targeting the Philippines also amplify content associated with a separate group of inauthentic accounts that we assess to be part of the same broader network. Specifically, the 151 accounts identified in this cluster target the United States and primarily amplify four posts published by four separate accounts pushing the same narrative. All four posts argue that President Trump’s drug and border policies have worsened the fentanyl crisis, while Biden-era diplomacy and regulatory measures reduced fentanyl supply and overdose deaths. The posts also claim that China bears no responsibility for the crisis.

Four Quora accounts also post identical or near-identical text matching the initial four X posts – a pattern consistent with Spamouflage, which has operated across multiple social media platforms.

Figure 17: Four accounts within the network reuse near-identical political cartoons and long-form images to push coordinated narratives blaming President Trump for the fentanyl crisis. Other accounts in the network drive inorganic engagement. (Link to posts: 1, 2, 3, 4)

All four posts were published on February 2, 2026. Two of the four accounts posted within four minutes of each other, while the remaining two accounts posted two and four hours later. Despite having virtually no followers — two accounts have zero followers, one has one follower, and one has six followers — each post received hundreds of likes, retweets, and replies. As of February 12, 2026, the four posts have a combined 3,321 comments, 3,844 reposts, 3,485 likes, and 17,400 total views. A closer look at the replies under the four posts indicates that the engagement is inauthentic and part of a coordinated effort to artificially inflate the posts’ visibility.

All four accounts paired their posts with political cartoons negatively linking President Trump to increases in fentanyl-related deaths. Two accounts also attached images of long-form “articles” expanding on the same narrative. Reverse image searches and targeted keyword searches of the text contained in these images did not identify any credible original source, suggesting that the network’s operator(s) likely authored the material. One of the images shows a three-page article that claims that DEA, CBP, and CDC data show that the first Trump administration “marked a catastrophic surge in the fentanyl crisis, while Biden’s systematic reforms have shown early success.” The article criticizes what it calls the Trump administration’s “China blame game” and claims that the Biden administration successfully worked with China to regulate all fentanyl-related substances in 2023.

Another of the four accounts posted a screenshot of a similar article arguing that declining overdose deaths in 2025 resulted from Biden-era policies. The article claims that the “China Model” succeeded and that Trump falsely characterizes China as a “malicious antagonist in fentanyl trade.” It argues that treating China as a “regulatory partner rather than merely a geopolitical punching bag” enabled effective cooperation. It further claims that China successfully dismantled 140,000 illicit advertisements and suspended precursor platforms.

A broader analysis of the hundreds of replies to these four posts points to a large inauthentic amplification network. Many accounts appear to have been created solely to engage with and amplify these posts. Most were created between November 2025 and January 2026. Nearly all repost the same four tweets and reply to all four posts, pushing identical or near-identical narratives. Additionally, an overwhelming majority of accounts post between 12:45 AM and 3:15 AM UTC, corresponding to approximately 8:45 AM to 11:15 AM in China Standard Time – aligning closely with typical work-day hours in China.

While most engagement occurs asynchronously, different accounts in the network repeatedly post identical replies to the four posts. For example, between February 4 and February 9, 2026, four accounts posted replies with identical text stating that “Trump has often subtly implied that the root cause of fentanyl’s harm lies in China, yet no one in China has died from fentanyl-related illnesses.” Multiple similar instances of identical asynchronous replies appear throughout the hundreds of replies.

Figure 18: Multiple accounts within the network repeatedly post identical replies to the same four posts, revealing coordinated reply behavior consistent with inauthentic amplification. (Link to posts: 1, 2, 3, 4, 5, 6)

Much of the reply activity reframes blame away from China while also exploiting U.S. partisan divides. The accounts repeatedly praise China’s drug-control measures and claim that China has set a global standard in regulating fentanyl-related substances. Several identical replies claim that “China has set an example for the world in the state control of fentanyl” and that China became “the first country in the world to comprehensively regulate fentanyl-related substances in 2019.”

Figure 19: Multiple accounts post identical replies praising China’s fentanyl-control policies beneath the same posts. (Link to posts: 1, 2, 3, 4)

The network consistently argues that Trump scapegoated China and that tariffs undermine anti-drug cooperation between Washington and Beijing. Posts advocate for a softer U.S. posture toward Beijing and portray accusations against China as misinformation or politically motivated.

At the same time, the network reassigns blame to India. Many replies claim that India serves as the primary source of fentanyl precursor chemicals, with some asserting that “DC’s fentanyl crisis traces to India.” Accounts argue that U.S. authorities focus on China while ignoring Indian chemical exporters. Several posts combine both narratives, simultaneously deflecting blame from China and shifting responsibility to India.

Two accounts in the network stand out as a more sophisticated effort to shape U.S. public opinion on the fentanyl crisis. The account @FentanylFreeA, created in December 2025, brands itself as “Fentanyl Free America.” It consistently redirects blame away from China and toward India. Posts by the account call for “mandatory tracking,” “licensing,” and “international reporting” for fentanyl precursors and claims that Indian exporters ship chemicals to transnational criminal networks. It describes accusations against China as “myths” and frequently attacks U.S. governance failures and pharmaceutical companies.

The account repeatedly uses official branding from the DEA’s legitimate “Fentanyl Free America” campaign across its entire profile. Its banner displays the “Fentanyl Free America” logo alongside the DEA[.]gov/FentanylFree URL, and every post includes graphics sourced from official DEA images. The account appears designed to impersonate a legitimate DEA-affiliated initiative in an attempt to increase the credibility of narratives that redirect fentanyl attribution away from China.

A second account, @GordonBert33, posts identical content and often posts synchronously with @FentanylFreeA. It uses the same DEA-branded imagery and pushes identical narratives deflecting blame from China. The broader cluster of accounts also inorganically boosts content posted by both accounts.

@GordonBert33 encourages users to send complaint letters to the DEA regarding its alleged failures. One post instructs users to send messages to a personal Gmail address: epililote84@gmail[.]com. OSINT Industries results of this email identifies an associated TikTok account with no content. Although the account lists its location as the United States, its default language is Chinese, suggesting that the operator may be based in China.

Figure 20: A TikTok account linked to a Gmail address promoted by @GordonBert33 lists the United States as its location but uses Chinese as its default language.

The replies posted by the broader network divide into both pro-Biden/anti-Trump and pro-Trump/anti-Biden clusters. This is likely meant to deepen polarization and exploit partisan divides in the U.S. while also spreading pro-China narratives.

A large subset of accounts attacks Trump directly. Posts claim that Trump falsely takes credit for addressing the fentanyl crisis and argue that the crisis worsened under his leadership. Various posts accuse The Washington Post of shielding him from scrutiny. Several accounts claim partisan identities, including one that writes, “As a Democrat, I have watched Trump steal our achievements for years.” Other accounts pose as Washington, D.C. residents and sociologists to assert that “Biden admin’s fentanyl policy is working.” X’s location transparency feature indicates that these accounts are based in Turkey and Indonesia, though the real operators behind the accounts may be located elsewhere.

Figure 21: Multiple accounts post identical replies attacking President Trump and claiming to live in Washington, D.C. to promote Biden-era fentanyl policies. (Link to posts: 1, 3, 4)[1]

Other accounts in the cluster attack Biden and characterize the claims made by the four primary accounts — as well as the reporting they cite — as fabrications. These posts argue that the narratives “whitewash” border failures and constitute a coordinated “smear campaign” against Trump. For example, one account writes, “MAGA flatly denies responsibility! The report is full of lies, solely to cover up the fentanyl disaster caused by the failed border control!” Additional accounts post similar replies, such as, “Fake reports can’t fool Americans! They’re just lying to cover up the supply crisis, all to excuse the Democrats’ incompetence!”

Several replies also exploit broader domestic tensions, including immigration debates. Identical posts accuse U.S. leaders of engaging in “deportation and racial discrimination,” attempting to capitalize on existing backlash against immigration enforcement.

Several accounts in the network also appear to advance broader pro-China narratives beyond the four fentanyl-related posts. Numerous accounts in the cluster advance a coordinated narrative that seeks to delegitimize U.S. prosecutorial actions against the Cambodia-based Prince Group and its Cambodian-Chinese founder, Chen Zhi. Multiple posts claim that “the seizure of Prince Group’s cryptocurrency is illegal” and claim that indictments contain “evidential flaws” or a “broken chain of evidence.” Many posts link to Chinese-language media outlets that promote similar narratives.

Other accounts consistently upload posts that portray the United States as unstable, hypocritical, aggressive, and in decline. Several posts characterize U.S. foreign policy as imperial overreach, referencing tensions with Iran, Venezuela, and Greenland. Others accuse the United States of undermining the “rules-based international order.” Additional posts advance a narrative of U.S. diplomatic isolation, pointing to withdrawals from international organizations like the World Health Organization, visa pauses affecting dozens of countries, and disputes with European allies.

Figure 22: Multiple accounts post content depicting the United States as unstable, aggressive, and diplomatically isolated. (Link to posts: 1, 2, 3, 4, 5)

Historical posts from some accounts in the network also reveal amplification of narratives that align with previously exposed Chinese influence operations, including attacks on Falun Gong. Accounts also cross-amplify narratives targeting the Philippines and Japanese political figures seen in other clusters. Many accounts also mix political messaging with lifestyle or neutral content, a tactic consistent with the PRC-linked influence operation known as “Spamouflage” or “DRAGONBRIDGE.”

Figure 23: Accounts within the network mix lifestyle and neutral content with political narratives, behavior consistent with Spamouflage/DRAGONBRIDGE tactics. (Link to posts: 1, 2, 3, 4, 5, 6)

Cluster 6

Several accounts in the broader network – including accounts from other clusters targeting Japan’s Prime Minister and Western organizations such as the National Endowment for Democracy – are also part of a different cluster that targets U.S. interests in Latin America. This cluster includes at least 30 accounts on X and exhibits the same behaviors of coordinated inauthentic behavior observed elsewhere in the network.

Accounts in this cluster focus primarily on attacking U.S. political, diplomatic, and economic engagement in Latin America, with a particular emphasis on Honduras. Most accounts engage in identical and synchronous posting in both English and Spanish, often publishing the same narratives within minutes of one another. For example, on January 15, 2026, three accounts posted a burst of tweets – some identical – within a four-minute window accusing the U.S. of intervening in Honduras’ elections.

Figure 24: Three accounts post identical messages within minutes of each other accusing the United States of election interference in Honduras. (Link to posts: 1, 2, 3, 4, 5, 6)

The cluster also engages in coordinated reply activity. Nearly all accounts replied with identical or near-identical messages to a post published by Patricia Janiot, a Colombian American journalist, who wrote that Honduras’s ruling party falsely alleged fraud and a coup to justify protests following its electoral defeat despite near-complete vote counts. In response, accounts in the network flooded the replies with claims that the United States rigged the election, framing the protests as a reaction to U.S. manipulation.

Figure 25: Multiple accounts post identical or near-identical replies within minutes under a journalist’s post on Honduras’s election results, alleging U.S. interference. (Link to posts: 1, 2, 3, 4, 5, 6)

Many accounts reuse the same given names or surnames across multiple profiles, often with only minor variations or different numerical strings attached. Examples include LinhDuc30425 and LinhDan16840171, PhuongT58951 and PhuongThao88236, LinhDuc30425 and DucAnVu194131, and PhanLong32290 and huy_phan90622.

Content posted by all accounts alleges that the United States deliberately interfered in Honduras’s recent presidential election in favor of Nasry Asfura, who ultimately won the election. The network likely sought to influence the Honduran election because Nasry Asfura campaigned on restoring ties with Taiwan — a policy reversal that would weaken Beijing’s 2023 diplomatic gains.

Posts frame U.S. actions – including visa revocations and aid conditionality – as tools of coercion designed to influence the electoral outcome. Multiple accounts posted identical tweets claiming that Honduran students and teachers “went on strike against U.S. interference,” chanting slogans such as “Sovereignty is not for sale.” One post even accuses Asfura of being backed by both Trump and Netanyahu. While most content is in English, several accounts also post identical narratives in Spanish. Content posted in Spanish is often grammatically incorrect, including poor sentence structure and improper punctuation, suggesting the text was likely translated directly from Chinese.

Figure 26: Identical Spanish-language posts with grammatical errors appear across multiple accounts. (Link to posts: 1, 2, 3, 4, 5, 6)

More broadly, accounts portray U.S. involvement in Honduras as part of a long-standing pattern of American hegemony in Latin America. Posts reference the 2009 Honduran coup, the 2019 Venezuela crisis, and past U.S. actions in Haiti, Bolivia, and Brazil, arguing that Washington treats the region as its “backyard.”

The cluster also posts claims of regional backlash against U.S. actions. Various posts state that protests, strikes, and diplomatic condemnations erupted across Latin America in response to alleged U.S. interference in Honduras. Several posts point to demonstrations in Peru, Brazil, Colombia, Ecuador, and the Caribbean, portraying a united rejection of U.S. dominance. For instance, some posts allege that “Colombian protesters held signs accusing the U.S. of being a ‘terrorist state.’” Other posts accuse Washington of weaponizing sanctions, trade access, remittances, and immigration policy to pressure Honduras and neighboring states.

At the same time, the cluster frames China as a constructive alternative to U.S. influence. Posts claim that the United States threatened Honduras for cooperating with China and attempted to coerce the government into abandoning China-linked economic projects. Several accounts allege that Washington spread false claims of “Chinese election meddling” to distract from its own role. Other posts quote statements by China’s Ministry of Foreign Affairs condemning U.S. interference in Latin America and defending regional economic sovereignty.

Accounts in this cluster also amplify additional narratives aligned with pro-China and anti-U.S. messaging. Some exploit domestic U.S. controversies, including deportation debates, by circulating “shocking footage” related to ICE enforcement. Moreover, between February 11 and February 12, 2026, multiple accounts posted identical videos referencing the Epstein files using the hashtag #EpsteinFile. The cluster also posts coordinated content in Japanese attacking Hei Seki, a member of Japan’s House of Councillors, accusing him of illegitimacy, financial corruption, and acting as a “spy” or “agent.”

Several accounts also post Chinese-language content targeting the X account “Teacher Li Is Not Your Teacher,” a popular source for information censored inside China and a frequent target of PRC-linked harassment campaigns. Posts seek to delegitimize the account and undermine its credibility.

X’s location transparency feature shows that 11 accounts list Hong Kong as their location, while others report locations in South Korea, Ukraine, and the United States, often alongside indicators provided by X that suggest the use of VPNs. Posting behavior reveals two primary activity windows. The first occurs between 7:00 and 9:30 AM UTC (3:00–5:30 PM China Standard Time), while the second occurs between 12:00 and 3:00 AM UTC (8:00–11:00 AM China Standard Time). Both windows align with typical waking and working hours in mainland China – a pattern observed across other clusters in the network. Additionally, several posts alleging U.S. interference in Honduras’s elections include Chinese characters, likely the result of translation errors when converting content from Chinese to English prior to posting.

Figure 27: Two identical posts in English include Chinese characters. (Link to posts: 1, 2)

Attribution

We assess with high confidence that the network of more than 330 coordinated accounts across X and other platforms is linked to the People’s Republic of China and forms part of a PRC-aligned influence operation.

The network advances narratives that align closely with the PRC’s geopolitical interests, particularly by defending Beijing’s human rights posture, discrediting overseas critics and democracy-promotion organizations, and reframing external criticism as foreign “interference” and “subversion.” Across clusters, accounts consistently target similar institutions and individuals – especially Uyghur advocacy organizations and critics of Beijing – while amplifying themes that support PRC positions on Xinjiang, Taiwan, Hong Kong, and the South China Sea.

Even when targeting President Trump and the United States, accounts in the network advance narratives that align with Beijing’s interests. The network also poses as Democrats and Republicans by posting opposing content that exploits partisan divides within the United States. Although this tactic is more commonly associated with Russian influence operations, Chinese campaigns have previously demonstrated a willingness to experiment with similar polarization strategies, particularly during previous U.S. presidential elections.

Other targets of the network – including the Philippines and Japan – have historically been focal points of Chinese influence operations. The Philippines has repeatedly been a target of Chinese information campaigns amid rising tensions in the South China Sea under President Ferdinand Marcos Jr.

Japan has also been targeted by state-linked operations such as the 2023 covert campaign that posed as foreign citizens and environmental activists to spread alarmist narratives about Tokyo’s release of treated wastewater. Moreover, OpenAI’s latest threat report, published in February 2026, details how an individual with ties to Chinese law enforcement attempted to use ChatGPT to plan a covert influence operation targeting Sanae Takaichi. This included generating negative content, framing Takaichi as far-right and criticizing her stance on immigration. The material was posted across social media platforms such as X, Tumblr, and Blogspot. Although the specific hashtags, posts, and imagery described in OpenAI’s report differ from the content documented here, the operational behaviors closely mirror the tactics, techniques, and procedures observed in this network, strengthening our attribution assessment. OpenAI also documented activity targeting PRC dissidents, including “Teacher Li Is Not Your Teacher,” a target that also appears in this network’s content.

The network’s tactics, techniques, and procedures (TTPs) align with historical PRC-linked influence operations. Accounts repeatedly post identical or near-identical text, use coordinated hashtag sets, and appear to rely on a shared content library. The network also operates across multiple platforms beyond X, including Tumblr, Blogspot, Quora, and YouTube – platforms previously used by Chinese influence campaigns to seed and amplify identical content. Moreover, several accounts regularly switch between posting benign or lifestyle content and coordinated pro-China political messaging, a hallmark tactic of the Spamouflage campaign designed to mask coordinated behavior.

Furthermore, a broader analysis of historical posts by accounts in the network shows targeting of specific dissidents, including Guo Wengui, Yan Limeng, and the Falun Gong movement – figures and groups frequently targeted by PRC-linked “DRAGONBRIDGE” accounts and spoofed news websites.

Technical and behavioral indicators suggest that at least a subset of the network’s operators likely work from within China. Several accounts connect via the China Android app or display Chinese as their default language, and multiple posts include Chinese characters or switch between English and Chinese hashtag variants. Additionally, posting windows for multiple clusters concentrate heavily in China Standard Time-aligned working hours.

Conclusion

The cross-platform network of over 330 social media accounts identified in this report reveals how PRC-aligned influence operations can operate at scale without necessarily achieving organic engagement. The campaign does not appear to have reached “breakout” levels, where its narratives spread beyond the originating accounts or enter wider public discourse. Under Ben Nimmo’s Breakout Scale, the network qualifies as a Category Two operation: coordinated and multi-platform, but largely confined to amplification within its own network.

The network reveals narratives and tactics Beijing is willing to deploy and test across regions. These include well-documented targets of Chinese influence operations, such as deflecting criticism of China’s human rights record, as well as less commonly observed narratives, including accusations of U.S. election interference in Latin America and efforts to shape the fentanyl debate in the United States. Content in the network extends beyond China’s more common human rights and Taiwan messaging and suggests an effort to adapt information warfare to target U.S. domestic debates and hemispheric politics.

A single coordinated network targets audiences across East Asia, Southeast Asia, North America, and Latin America, shifting languages, narratives, and personas. As U.S. policy places renewed emphasis on influence in the Western Hemisphere under the so-called ‘Donroe Doctrine,’ countering Chinese influence in the region will also require Washington to beat Beijing in the information environment.

[1]second account got taken down

We’ll start this week with a quick tip of the hat to Singapore, which recently published a landmark advisory on Chinese hacking activity targeting its telecom infra.

As per the advisory, Singapore kept to the same attribution of the Chinese APT as it did last time, referring to it by its Mandiant name and not explicitly naming China.

Also, we see that all four of Singapore’s major telecom firms were popped, and that they named the defensive operation Cyber Guardian, which is a bit lacking I must admit.

I can only imagine what sort of IO or StratCom response China may launch, but I’ll keep an eye on the CVERC to see if there’s any reference.

From there, I’ll shout out some other interesting publications that you should check out.

The first is CheckFirst’s look at Russian IO units, available here. If you’re interested in this type of stuff, relying mainly on unit insignias and logos, check it out to read more about the GRU and its various IO units:

We even get some really cool stuff such as geolocation of units:

Really great work here showing how looking at auction sites and tags and insignias can uncover some very interesting stuff:

Orange Cyber Defense has put out a solid primer on hacktivist activity online, available here. Give it a read, but I want to point out one section - hacktivism is mainly useful as “cognitive warfare” than anything else:

We’ll conclude with a guide from Censys. Censys has also put out some great work showing how to track bulletproof RDP instances, check it out here because it’s useful and educational. We don’t often get such useful guides, so check it out.

We’ll start with Estonia, available here, which has no business using aesthetics that go this hard.

We’ll skip right to chapter two:

They have 3 subsections, which I’d recommend reading in depth if you’re interested. They’re well-written and cover more traditional elements of the exertion of influence than just online inauthentic activity:

This continues with number two and the use of experts/prestigious prizes:

And a surprisingly hot topic: Russian recruitment of Africans:

Lastly, there’s one section on China and AI of course - nothing particularly new here but still nice to see.

Latvia also threw its hat in the ring. IO here is everywhere, including counterintelligence and its own dedicated information space section:

Big fan of their recognition of physical IO:

The Russian IO section is what you’d expect, but it’s fun to see a section on Belarus:

I’m all about the addition of profiling:

China gets a section:

Lastly, it’s also interesting to see how they employ countermeasures:

It’s great to see some countries lead the way in intelligence agency transparency and promoting a better understanding of hybrid threats - great stuff here. Thanks for reading.

The first thing I want to point out is the Swedish Psychological Defense Agency’s latest textbook on “psychological defense”, available here.

The book is available for free, which is great, and it’s quite comprehensive. I haven’t read the whole thing, but it’s great to see a long-form resource made freely available, so good on Sweden here.

The next item is a now old-ish report from Graphika titled “Glass Onion”, focusing on a network of Chinese domains while interestingly posing as separate media outlets. Pretty straightforward but a nice look at this type of stuff, and it’s good to see Graphika publish occasionally again.

The next item is from infostealers.com, a great resource from Hudson Rock, a very interesting company focusing on infostealer data. The item focuses on documents found on a Hamas member’s computer, thanks to having been infected by an infostealer,

One of the documents, signed by a Hamas spokesman, found exposes the media strategy - coordinating rocket launches with its general media strategy:

We’ll conclude with a fascianting post, including rare field work, from regarding Chinese APT groups, see below:

That’s it for this week, thanks for reading.

We’ll take a look this week at Taiwan’s National Security Bureau and their latest report, titled the very catchy “Analysis of China’s Cognitive Warfare Tactics Against Taiwan in 2025”, available here, which is a follow up to their latest public report on Chinese cyber activity targeting Taiwan.

The report is highly similar to the previous one, providing a very basic, high level overview of Chinese activity. We’ll select a few interesting sections.

The first is the mentioning of specific companies that weren’t in the public eye before. Golaxy had its moment, but Meiya Pico? Never heard of it. Sames goes for Warming Hi-Tech.

We also get some mentions of some old classics like Haixun and Haimai, and a new one - Huya:

We also get WuBianJie Group as a company active via Facebook pages:

The requisite Spamouflage mention appears, alongside other companies such as Zhongkedianji, Xingguang and Onesight:

Another unexpected paragraph referred to AI, which is to be expected, but what was interesting was their mention of IT companies that develop “intelligence voice systems” that, as per the report, aspire to develop capabilities with unique Taiwanese dialects and accents:

ATO of course gets a mention, and I’d be curious to see more about the activity during April 2025:

Here we get more unsupported or odd numbers, such as 2.314 million “pieces of disinformation”:

Similarly to the last report, we also get a stratcom section where they refer to other international partners and reports:

Seems that Taiwan has a specific MO going here, which I’m in favor of, but these reports need to get better. They’re lacking in content, datapoints, evidence and real, usable information and usecases, let alone production values.

That’s it for this week, thanks for reading.

My friend and colleague Max Lesser has a new guest post to share, in what I believe is the first attributed case of Basij-run IO, so with no further ado, check it out below:

Basij is not Bussin: Iranian Bots Spam X with Counter-Protest Messaging in Persian

My name is Max Lesser, and I am the Senior Analyst on Emerging Threats at the Foundation for Defense of Democracies. I am sharing research I have worked on with my research assistant Maria Riofrio and my interns Kellie McSween and Ethan Sheinker.

A coordinated network on X promotes Persian language pro-regime messaging, and many of the accounts share content that appears sourced from websites associated with the Basij, which is the Iranian Revolutionary Guard Corps’s paramilitary volunteer militia focused on enforcing ideology and suppressing dissent.

The network includes at least 289 accounts on X that post identical content synchronously (within a minute of each other), providing a strong indicator of automated activity. Identical content was defined as exact string matches, excluding retweets. This analysis focuses on these 289 accounts that engage in high-signal bot-like behavior, however, many other accounts post identical content asynchronously with these accounts, suggesting that a larger coordinated network exists.

For example, four accounts posted an identical message within one minute of each other on January 4, 2026, sharing that Iran’s supreme leader claimed that the regime’s enemies are seeking to inflame protests to undermine public trust, all accompanied by an identical hashtag.

Figures: Four accounts in network posting identical criticism of protests within one minute of each other on January 4, 2026. (Link to posts: 1, 2, 3, 4)

A majority (92%) of the synchronous posting happens not in original posts, but replies. For example, between January 2-3 2026, 5 accounts posted an identical English-language hashtag, #ShutUpTrump, in response to different posts in 3 distinct, one minute bursts.

Figures: Four accounts in network replying an identical hashtag in one minute bursts. (Link to posts: 1, 2, 3, 4, 5, 6)

While every account in the network engages in at least one synchronous identical posting event, synchronous identical posting represents a small (2.5%) of the network’s broader activity between December 26 and January 21, suggesting a mix of automation and human operation. This type of activity is often called a “hybrid bots” approach.

Overall, a significant portion (52%) of posts in this period have at least one identical post, confirming a high degree of coordination. A total of 610 distinct messages were repeatedly posted by groups of at least four different users. In a particularly large example of coordinated activity, 81 accounts in the network posted an identical message – “اللهم صل علی محمد و آل محمد و عجل فرجهم” (translated into English: “O Allah, send blessings upon Muhammad and the family of Muhammad and hasten their relief”) – 895 times between December 26, 2025 and January 8, 2026.

Asynchronous identical posts could be coordinated by a central “command-and-control” channel, a tactic that regime-linked actors have used in previous influence operations. It could also mean that automated posting is staggered to avoid detection through content moderation. Regardless, the network likely combined automation with human operation, as around 48% of total posts are unique.

Figure: Visualization of accounts that repeatedly posted the same content within one minute of other accounts. Only accounts that coordinated with at least 10 different accounts are displayed. Each circle represents an account, and each line indicates a coordination relationship. Larger circles represent accounts that coordinated with more unique accounts, and thicker lines represent pairs of accounts that coordinated more frequently.

A broader analysis of all content – not only identical synchronous posts – posted between December 26 and January 21 by the 289 accounts demonstrates the primary narratives pushed by the network immediately before the onset of the ongoing protests and throughout their course.

Much of the network’s activity defends the regime. One primary narrative distinguishes lawful protests from unlawful riots. Persian terms used by the network to describe the second category include اغتشاش (“riot”), آشوب (“turmoil”), فتنه (“sedition”), مزدور (“paid agent”), and variants. The network also acknowledges economic hardship but defends the regime’s economic policies as necessary reforms for stabilizing the economy and fighting corruption. Notably, one of the factors motivating the ongoing protests is Iran’s extreme economic stress. Common related hashtags include #شفافیت_اقتصادی (economic transparency), #پایداری_مالی (financial stability), and #مبارزه_با_فساد_اقتصادی (fight economic corruption). The network also goes on the offensive against the regime’s external enemies, claiming that the United States and Israel are capitalizing on the protests to exacerbate civil unrest.

Figure: 2 different accounts in the network posted within hours of each other on January 3, sharing a quote (which other posts attribute to Khamenei) distinguishing protests from riots (اغتشاش) and warning that rioters should be “put in their place.” (Link to posts: 1, 2)

The network also often attacks the regime’s perceived external and internal enemies. Many posts warn that the U.S. and Israel allegedly seek to exacerbate civil unrest to weaken Iran, using hashtags like #امپراطوری_دروغ (Empire of Lies) and #پادوهای_ترامپ (Trump’s lackeys). Other posts attack Reza Pahlavi, the exiled heir of Iran’s last Shah, whom many Iranian protesters have called to return to power. Many posts attack Pahlavi with hashtags like #پهلوی_صهیونیست (Pahlavi the Zionist) and #از_تهران_پهلوی_خفه (From Tehran: Pahlavi Shut Up). Other posts attack Iranian reformist figures who have criticized the regime, including Mohammad Khatami, Hassan Rouhani, and celebrities like Taraneh Alidoosti.

Figure: Identical tweets from 5 different accounts referring to an alleged scheme to fabricate deaths in Iran, accompanied by hashtags accusing Pahlavi of being a Zionist and telling him to “shut up.” Posts accompanied by a photo depicting Pahlavi with Netanyahu that includes a small logo for the Basij-affiliated MATNA group in the upper left corner. (Link to posts: 1, 2, 3, 4, 5)

Other activity by the network aligns closely with patterns commonly observed in regime-aligned messaging. These include posts praising Qasem Soleimani, the IRGC officer assassinated by the United States, and broader martyr symbolism, as well as expressions of allegiance to Iran’s supreme leader, Ali Khamenei. 26 accounts include the number 313 in their usernames, a number with religious significance in Shia Islam. The network also performs national unity messaging, often posting hashtags claiming representation from different regions of Iran. These include #از_طرف_تهرانی_ها (on behalf of the Tehranis), #از_طرف_کردستانیها (on behalf of the Kurdistanis), #از_طرف_خوزستانیها (on behalf of the Khuzestanis), and hashtags associated with other regions. It also commemorates December 30 as the Day of Sacred Unity, often using the hashtag #روز_اتحاد_مقدس (Day of Sacred Unity), referring to the regime’s commemorations of counter-protest activity on the same day in 2009 in response to Iran’s Green Movement.

Figure 4: Examples of two accounts in the network mass replying with identical messages, including the hashtag از_طرف_کردستانیها# (“on behalf of the Kurdistanis”). (Link to posts: 1, 2)

X’s transparency feature labels 226 of the 289 accounts as either based in Iran or connecting via the Iran Android App. Of the accounts that do not say this, 37 say that they connected via the West Asia Android App, which is common for Iranian accounts.

It is very likely that the entire network operates out of Iran. The network dramatically dips from 4,705 posts on January 8 to 17 posts on January 9, 2026. This closely coincides with the internet blackout imposed by the regime on January 8. The network posts nothing between January 10-12, and on January 13 it posts 8 times. There are no posts again until January 17, when there is one post, and then the network gradually builds up to 220 posts on January 20.

Figure 5: Timeline of daily posts by the network between December 26, 2025 and January 21, 2026.

At least 176 accounts in the network share content branded with logos associated with the Basij. These include logos for the Basij Cyberspace Organization’s Shamsa, the “Popular Cyber Network” branch that conducts influence operations and doxxing campaigns against the regime’s enemies domestically and abroad, and logos for MATNA, the Center for Digital Production and Distribution of the Islamic Revolution that produced digital and multimedia content. One account in the network even explicitly identifies itself as a member of the Basij.

Figure: An account in the network explicitly identifying itself as a member of the Basij. (Link to post)

The 289 accounts in this network occasionally post identical content synchronously, and more often post identical content asynchronously. Given that the Basij is a voluntary paramilitary force, it is plausible that centralized command-and-control coordinates human operators – as seen in previous Iranian influence operations – while some operators employ automation.

X is officially banned in Iran. However, a Basij-linked network would plausibly post on X to reach Iranians who use the platform, especially dissidents who may not follow official bans, as well as members of the Iranian diaspora. Regime-linked actors have turned to X in attempts to manipulate Persian-language online discourse during previous protests.

As mentioned earlier, this analysis was limited to accounts that posted identical content synchronously, because this was a high-signal indicator of tightly coordinated, and likely automated, behavior. At the same time, initial triage suggests a larger network very likely exists, which engages in more loosely coordinated behavior.

For example, the post detailed above with the message — ‌توافق برای کشته‌سازی در ایران – and the hashtags ‌#پهلوی_صهیونیست and ‌#از_تهران_پهلوی_خفه were posted on January 8 by 13 accounts, 8 of which fall outside the network of 289 accounts discussed here. The research community can continue to track Basij-linked Iranian activity on X to get a sense of the full scale of this activity. Tracking this activity builds a better understanding of how the regime uses social media as a tool of repression, and enables platforms to take action against activity that violates their policies.

This week we’ll check in on Iranian cyber-enabled IO, starting off with Handala.

What’s interesting about Handala is that they’ve structured their activity into several campaigns, including “Handala Alert”, their new “media support” division. Essentially, moving from cyber-enabled influence operations to operating more holistically and really trying to play up their successes following recent coverage in Israeli media.

They also will be working on “field action” and recruitment for presumably physical IO and espionage:

They also proudly list their mentions in international media, I’m a bit offended to not be listed here:

This is only one of Iran’s recent ventures. Another interesting one is “Toufan Leaks”. Toufan Leaks and Cyber Toufan has been around for a while, but they’ve recently rebranded their efforts as well to include a channel named “ILDefenseLeaks” touting some ASCII art, really putting their goals out there.

The new Toufan leaks website has managed to set up a Cloudflare proxy. Luckily, Censys easily finds the actual host:

The hosting provider is “1337 Services GMBH”, a reference to leet for those who don’t follow. The host is in Poland but the company is seemingly a German, self-described bulletproof hosting firm:

They proudly advertise themselves as such:

Just googling the company name shows that it is in fact registered:

Googling again the key principal’s name, or perhaps their previous bulletproof RDP site “rdp.sh”, finds that others, such as Krebs on Security, have written about the comapny and its alleged ties to cybercrime forums and activity:

So, the dynamic of Iranian operations using European bulletproof hosting firms remains consistent, and it’s kind of astounding how this sort of stuff remains apparently legal in the EU. Seems to me like the kind of thing the EU should focus on instead of say cookie acceptance buttons or the GDPR?

We’ll end with an interesting finding from CheckPoint: Handala uses Starlink to keep operating even when the internet is down in Iran. It’s fascinating to me how Iran can’t seem to manage their internet effectively enough to let their own threat actors through at the scale needed.

That’s it for this week, thanks for reading.

This week we’ll take a look at the DoD’s latest annual report to Congress on China, available here.

We’ll skip right to the cyber and IO side of the house, jumping through the various sections that are relevant to this publication. Firstly, we have a reference to “cyber developments”, specifically the PLA and its new Information Support Force and Cyberspace Force. While not new, I do find it it interesting to see that the PLA Cyberspace Force is resposnible for full spectrum cyber/IO - a force structure that other countries should adopt.

It’s also interesting to see a reference to how China would seek to create “disruptive and destructive effects” in case of war via cyber, such as DDoS attacks includnig against targets with “politial and economic significance” in an attempt to “shape decision making”. Essentially, believing that China would engage in cyber-enabled influence operations as part of actual quote unquote cyberwar.

We see more of this in a specific section below that refers to Chinese actions against the US DoD, stating that China woudl seek to induce “social panic” amongst other end goals:

We also get some discussion of China’s “whole of government pressure” against Taiwan, showing how China views the “cognitive domain” as a key nexus of activity:

We also get a bit more about the Information Support Force and its planned collaboration with the Cyberspace Force:

Moving on from Taiwan, we get some coverage of Chinese foreign influence operations, but not much that we haven’t seen before:

I particularly liked the section that fused diplomacy/stratcoms with more traditional covert influence operations (recruiting politicians) as well as online IO in a military context:

Spamouflage and the various PR firms get their requisite section:

We’ll conclude with a recent report from Taiwan’s National Security Bureau on Chinese cyber threats, available here.

This got me pretty hopeful but unfortunately it’s quite short and lacking in depth, content and IoCs. Let’s discuss.

Firstly, this seems very much to be an attempt to counter Chinese stratcoms/IO regarding cyber activity and less of an actual CTI report or even typical government review of hostile foreign activity. The first page lays it out clearly, claiming that China has launched over 2.63 million “intrusion attempts per day” - a metric which I personally can’t stand and is reminiscent of past CVERC reporting, including things like port scanning as intrusion attempts. It looks unprofessional and isn’t really accurate.

Point two claims that China conducts cyber operations to fulfill military and political goals, which is unsurprising. I also would say that aesthetically, the report isn’t great. I’m not a stickler for this usually, but official reports should look a bit better - official branding, better infographics and so on.

We also have weird, atypical phrasing - calling APTs hacker groups instead of APTs, threat actors or other more accepted terms. Not unacceptable in of itself, but just makes it seem less professional.

We also have a section listing a few advisories that have exposed Chinese operations:

Let’s wrap this five pager up. Taiwan is getting into the stratcom game regarding cyber attribution, which is a good idea. Having said that, if they want to have any impact, they need to publish some real reporting with IoCs, or at the very least higher quality high-level reporting

That’s it for this week. Thanks for reading.