How attribution of influence operations works

Origin and entity are different findings

A report can say where a network was run from without saying who ran it. In its first quarter 2025 report Meta said a Romania network was found through an internal investigation, and the report names no actor behind it ². In the same report it tied a China network to two earlier China-based operations it had removed in September 2022 and February 2024 ².

Some reports go further and name an entity. Meta's Q2 and Q3 2025 report attributed the Endless Mayfly operation to Iran's International Union of Virtual Media, which it described as a US-sanctioned propaganda group ³. It said a Cameroon-based freelancer in another case was likely working on behalf of employees of RT, which it described as a Russian state-controlled media entity ³.

Wording to read closely

• Likely: OpenAI's June 2025 report uses phrases such as likely China-origin activity and likely Iran-linked threat actor ⁸.
• Consistent with: the same report said one scheme showed behaviours consistent with activity publicly attributed to IT worker schemes connected to North Korea ⁸.
• Linked to: Google's Q4 2025 bulletin describes some Russia entries as linked to the Internet Research Agency or to a Russian consulting firm ⁹.
• Based actors: Google uses phrases such as United Kingdom-based actors and Nigeria-based actors where it names a location ⁹.
• Ongoing investigation: Google lists PRC entries as part of an ongoing investigation and consistent with previous reports ⁹.

Evidence thresholds

Meta's 2021 report gave an example. For one 2020 network run from Mexico it did not see sufficient evidence to conclusively attribute the activity beyond the individuals directly involved. The FBI later attributed it to the Internet Research Agency ¹. The same report said influence operations for hire run by commercial firms can make attribution harder ¹.

Meta's May 2025 report cautioned that sharing a campaign's links or interacting with it is not enough to attribute accounts to the campaign without corroborating evidence ². The EUvsDisinfo description of the EEAS FIMI Exposure Matrix lists technical indicators such as public affiliation, financial records and shared IT infrastructure, and behavioural indicators such as amplification patterns and coordinated messaging ⁶.

Commercial actors and governments

Meta's Q1 2023 report attributed half of its six networks to private entities. These included an IT company in China, a marketing firm in the United States and a political marketing consultancy in the Central African Republic ⁴. In December 2022 Meta said it attributed its 200th takedown to two companies in Russia ¹⁰. OpenAI's June 2025 report linked a Philippines-origin operation to a commercial marketing company ⁸.

The EEAS approach sorts channels into four groups. Three can be attributed to a threat actor: official state channels, state-controlled outlets and state-linked channels. A fourth group cannot necessarily be attributed to a state but shows systematic alignment and similar behaviour ⁶.

Names differ between reporting bodies

Each company uses its own names. Microsoft uses family names such as Typhoon for China, Blizzard for Russia and Sandstorm for Iran, and Flood for influence operations ⁵. Meta's May 2025 report linked an Iran network to the STORM-2035 activity reported by OpenAI and Microsoft in August 2024 ². Twitter said on 22 September 2022 that it would keep sharing presumed country of origin but would no longer share its own attribution for datasets ⁷.