Influence operation tactics documented in official reports

Fake accounts and personas

Fake identities are the base of most networks in these reports. In Meta's first quarter 2025 report, a China network posed as locals in three country clusters and used profile photos likely generated using AI. Its operators ran a separate farm to create more fake accounts ¹. An Iran network in the same report posed as female journalists and pro-Palestine activists ¹.

Personas are often built across several services. The Romania network in that report had matching presences on YouTube, X and TikTok, and its operators used proxy IP infrastructure to hide their origin ¹. In Meta's Q2 and Q3 2025 report, a network with links to individuals based in Russia and aimed at Moldova used fictional reporters with backstories ². OpenAI's June 2025 report described a China-origin operation that created profile images for fake US veteran personas ⁷.

Fake media brands and websites

Many networks present themselves as news outlets. Meta's 2021 report said some networks built websites posing as news outlets ³. In Q2 and Q3 2025 Meta reported that the Iran-linked Endless Mayfly operation used misleading news domains, including typosquatted sites ². Freelancers that Meta said were likely working on behalf of individuals in Russia ran Pages posing as local media in several sub-Saharan African countries ².

Meta said on 3 December 2024 that it had exposed more than 6,000 Doppelganger domains since 2022 so that researchers and others could act on them ⁸. Google lists blocked domains in its bulletins. One December 2025 entry records 85 domains blocked from Google News and Discover, attributed to Russia and critical of Ukraine ⁴.

Amplification and paid reach

• Hashtags and self-commenting: the Iran network in Meta's Q1 2025 report used trending hashtags such as #gaza and commented on its own content ¹.
• Ads: the same report gives ad spend of about US$70 for the Iran network and about US$177,000 for the Romania network ¹.
• Undeclared political ads: Meta reported that Pages in that sub-Saharan Africa network ran undeclared political ads and used text obfuscation ².
• Fake replies: OpenAI reported in May 2024 that some networks generated replies to their own posts to create an appearance of activity ⁶.
• Inauthentic engagement: Google said in January 2023 that where DRAGONBRIDGE content drew engagement, it was almost entirely inauthentic ⁵.

AI-generated content

OpenAI reported in May 2024 that five covert operations it disrupted used its models to generate more text with fewer language errors. AI content was one format among several, next to manually written text and copied memes. Some operators posted model refusal messages in public by mistake ⁶.

In Q2 and Q3 2025 Meta reported a domestic India network that used generative AI for profile pictures, biographies, images, captions and comments ². Meta said in December 2024 that covert networks made only incremental productivity and content-generation gains using generative AI ⁸. Google reported in 2023 that DRAGONBRIDGE tested human voice narration, a talk show format and animated political cartoons ⁵.

Impersonation, hack-and-leak and perception hacking

Meta reported a Belarus network with links to Russia that used fake accounts impersonating Poland's governing Civic Coalition and amplified hack-and-leak material ². Meta's 2021 report described perception hacking, in which actors try to create the perception that they are everywhere ³. The same report named influence operations for hire run by commercial firms as a trend ³.

The EEAS reported on 19 March 2025 that over 500 FIMI incidents took place across 2024. They used at least 25 different platforms and at least 38,000 different accounts ⁹.