Cyfluence Research Center

During the last week, we observed, collected, and analyzed key developments related to cyber-based hostile influence campaigns (including Cyfluence attacks).

Highlighted Developments:
🔍 A three-part investigation by Sekoia reconstructed the cyberespionage group Gamaredon's 2026 infection chain and clarified its malware ecosystem through a unified taxonomy.
🏙️ Research by CIR, assisted by other research, found a growing volume of online content portraying London as unsafe, lawless, and in decline.
📊 A survey of campaign professionals found that AI has become a routine part of political operations, with 87% using it daily or several times a week.
🎥 A NewsGuard assessment found that Google's text-to-video model, Gemini Omni, was able to generate realistic videos illustrating several false claims that have circulated online.
📌 The CRC Weekly Report is a summary of what we regard as the main events in the information environment.
Read full article here: https://www.cyfluence-research.org/post/cyber-based-influence-campaigns-01st-07th-june-2026-report

Intelligence services can recruit various assets, including the lonely and the excluded.

Our latest research argues that unresolved integration trauma constitutes a structurally distinct vulnerability vector in espionage recruitment and influence operations, one that current analytical frameworks fail to capture.

Drawing on the FOI's landmark 2026 "Spies Among Us" report and case evidence spanning Russian and Iranian operations across Europe and the Middle East, we trace how adversarial intelligence services exploit the psychological gap between the country immigrants expected and the reality they encounter. The integration-traumatised migrant is, from an intelligence perspective, an already-placed asset waiting to be activated.

We examine how this mechanism operates at two levels: at the individual level, through offers of belonging that bypass ideological screening entirely; and at the population level, through "weaponized nostalgia". The implication is as much about policy as it is about counterintelligence, as integration quality becomes a national security variable.

Read the full research: https://www.cyfluence-research.org/post/the-missing-variable-immigrant-identity-and-integration-trauma-in-espionage-recruitment-and-influen

During the last week, we observed, collected, and analyzed key developments related to cyber-based hostile influence campaigns (including Cyfluence attacks).

Highlighted Developments:
🔓 Research by TechXplore uncovered a Russian disinformation campaign that hacked hundreds of Bluesky accounts to spread pro-Kremlin propaganda.
🌍 Findings by First Monday examined Russian disinformation campaigns targeting Ukrainian refugees in Europe and argued that these campaigns are effective not only because they imitate credible media sources, but because they activate existing cultural prejudices and social anxieties.
📹 YouTube announced it is introducing new updates to improve transparency around AI-generated content.
🏛️ The Council of Europe developed the RESIST framework to help countries understand and strengthen their resilience to disinformation while respecting democratic principles, human rights, and freedom of expression.

📌 The CRC Weekly Report is a summary of what we regard as the main events in the information environment.
Read full article here: https://www.cyfluence-research.org/post/cyber-based-influence-campaigns-25th-31st-may-2026-report

🔎 New CRC Research | The Deployment of Hybrid Threats and Cyfluence Operations in the Iran War

Over the past several months, the Cyfluence Research Center has been tracking, documenting, and analysing how cyber-enabled influence operations have been employed across the US–Israel–Iran conflict. Today, we're publishing our findings.

📌 Research Scope

We conducted an operational review of cyfluence incidents from the onset of hostilities (28 February 2026), mapping attack chains onto the DISARM framework.

📌 Key Findings

Cyfluence is no longer episodic but is a constant layer of modern warfare. Key incidents we document include:
- The BadeSaba hack: a widely-used Islamic calendar app compromised to deliver surrender messaging to Iranian military personnel, timed precisely with the onset of airstrikes
- The IRIB broadcast hijack: Iranian state television interrupted to broadcast messages from foreign leaders, simultaneous with kinetic strikes on communications infrastructure.
- Iranian coordinated inauthentic activity impersonating Chinese, Russian, and North Korean media giving the appearance of allied support.
- Handala's hack-and-leak operations including the confirmed breach of the FBI director's personal email.
- Russia and China operating as key amplification nodes for Iranian synthetic propaganda.

📌 Implications

These conflicts mark a qualitative shift. Hostile influence campaigns and coordinated information disorder are now functioning as primary offensive efforts, not merely supporting activities. The cognitive domain is thus no longer a secondary front. Controlling how events are perceived, interpreted, and acted upon has become one of the operational logics of modern warfare.

Read the full research: https://www.cyfluence-research.org/post/the-deployment-of-hybrid-threats-and-cyfluence-operations-in-the-iran-war

🔎 In our recent blog, we examine newly leaked documents connected to the Social Design Agency (SDA), a Russian firm linked to hostile influence campaigns targeting Western societies.
⚔️ The leaked material highlights how modern influence operations increasingly function across multiple dimensions simultaneously, combining physical provocations, online amplification, media manipulation, and political polarization into a single operational structure.
📡 Rather than relying only on digital content alone, these operations seek to leverage incidents to deepen existing societal tensions.
📑 The blog explores how these hybrid operations reflect the growing intersection between physical, digital, and cognitive domains, and what this means for defensive cyfluence and cognitive security efforts.

Read the full research: https://www.cyfluence-research.org/post/behind-the-curtain-leaked-dsa-files-russian-influence-operations-and-defensive-cyfluence

During the last week, we observed, collected, and analyzed key developments related to cyber-based hostile influence campaigns (including Cyfluence attacks).
Highlighted Developments:
🌐A piece by EU vs. Disinfo revealed that Russia's effort to control its digital environment has evolved from simply restricting foreign platforms to building a state-managed communication ecosystem.
📄Leaked documents examined by Le Monde reveal a coordinated Russian disinformation campaign in France that combines traditional online propaganda with "hybrid" operations in public spaces to provoke outrage and social division.
⚠️An article by DisinfoWatch flagged a false narrative promoted by Glenn Diesen claiming that Russia has the right to attack NATO following a large Ukrainian drone strike on targets near Moscow.
🌏 The MIGS report argues that Chinese state-linked influence networks systematically exploit political, economic, and local governance vulnerabilities across G7 countries through elite cultivation, economic pressure, and coordinated interference operations designed to shape policy and public discourse.
📌 The CRC Weekly Report is a summary of what we regard as the main events in the information environment.

Read full article here: https://www.cyfluence-research.org/post/cyber-based-influence-campaigns-18th-24th-may-2026-report

Loneliness has become an attack surface.

Our latest research explores how hostile actors are exploiting the emotional bonds people form with AI companions to run influence operations at scale. The results are alarming — in recent elections, AI chatbots shifted voters' attitudes by up to 10 percentage points. The more persuasive the model, the less accurate the information it delivered.

This is no longer about bots flooding your feed. It is about AI earning your trust — one conversation at a time.

📖 Read the full research: https://www.cyfluence-research.org/post/turning-loneliness-into-coordinated-campaigns-how-ai-parasociality-scales-influence-operations

During the last week, we observed, collected, and analyzed key developments related to cyber-based hostile influence campaigns (including Cyfluence attacks).

Highlighted Developments:
🎯Research by The Jamestown Foundation noted that Ukraine's recent decision to expand outreach to non-Russian national minorities within the Russian Federation has become a new target for manipulation.
🤖 An audit by NewsGuard found that Anthropic's AI chatbot Claude has become more vulnerable to disinformation campaigns, showing a significant increase in repeating false claims sourced from Russian and Iranian state-affiliated media.
🗳️ A two-year study by ISD Jordan found that misinformation and online hate speech are deeply interconnected within Jordan's digital environment.
📱Findings by ISD showed that algorithm-driven disinformation and harmful recommendation systems on TikTok and Rumble are exposing UK minors to antisemitic content, often without users actively searching for it.

📌 The CRC Weekly Report is a summary of what we regard as the main events in the information environment.
Read full article here: https://l1nq.com/dt4fuqt

PRC-aligned influence networks in the South China Sea consistently leverage entities designed to look like independent research institutes.

Our latest research maps an emerging coordinated influence network targeting English-language discourse on the South China Sea, combining Chinese state-affiliated institutions, credentialed researchers, and inauthentic amplification assets operating in concert.

We traced a narrative support infrastructure from think tanks and academic voices providing legal and policy legitimacy to pseudonymous social media accounts designed to simulate organic reach.

Key findings include an analysis of the Chinese-attributed network's activity patterns, and the identification of activity surges following geopolitical developments.

Lastly, we cover the artificial amplification infrastructure, comprising approx. 35% of the network‘s followers that were flagged as bot-like or low-credibility amplifier accounts (LCAAs), inflating the apparent footprint of what presents itself as objective academic expertise.

Read the full research: https://lnkd.in/gwJbtWi4

During the last week, we observed, collected, and analyzed key developments related to cyber-based hostile influence campaigns (including Cyfluence attacks).

Highlighted Developments:
⚖️ The European Union announced it has imposed sanctions on two entities: Euromore and Pravfond, for their role in spreading disinformation as part of Russia’s hybrid strategy.
🌐 As published by DFR Lab, a China-linked influence network known as Spamouflage has been spreading disinformation ahead of the April 26 elections for the Central Tibetan Administration.
🗳️ Based on an analysis by Tech Policy Press, Hungary’s April 2026 parliamentary election offered a clear reminder that disinformation is not a decisive political force on its own.
📱 As published by NewsGuard's Reality Check, Tensions between Donald Trump and Pope Leo XIV have fueled a wave of viral misinformation on social media, with multiple false claims gaining significant traction online.

📌 The CRC Weekly Report is a summary of what we regard as the main events in the information environment.
Read full article here: https://l1nq.com/03mlvc8