Influence operations, as the platforms and governments that took them down report them.
Each row is a network or operation that Meta, Google, OpenAI, TikTok or the EEAS has publicly disrupted or named. The origin is the publisher's judgment of where the operators worked. It is never read as who directed them. Undertow keeps operations only: no account handles, links, domains or names of individuals.
Loading…
Disclosures over time
One mark per disclosure (a report, bulletin or announcement), sized by how many networks it lists. Google's bulletins are monthly within each quarter.
Origin by target
Networks counted by the origin the publisher states (rows) and the target countries it names (columns). Google and OpenAI name no targets, so they count under "none named". Regions such as "Sub-Saharan Africa" are in the table below.
Named operations
Operations a publisher names (Doppelganger, Storm-1516, Spamouflage...). Our confidence is about origin only and counts independent publishers that name the operation with the same origin: one is Low, two is Moderate. Origin is easy to fake, so nothing here is High.
All disclosed networks
Method and licences
Three questions, kept apart
- Did the takedown happen? The publisher reports its own action. Source grade A2: reliable on its own enforcement, not confirmable from outside.
- Where were the operators? The publisher's judgment, quoted as written, with the publisher's own level (high, moderate, none).
- Who directed it? Recorded only where a publisher names an operator. "Aligned with Russia", which the EEAS writes of operations it calls non-attributed, is shown as alignment, never as origin.
Our confidence follows the suite's rubric (tic-confidence-1.0): confidence mapping, method.
What is never kept
Indicator values, account handles, URLs and domains, and the names of individuals. Meta's indicator tables are read only to count their rows. Every sentence kept from a publisher is scrubbed: links become "[link withheld]" and likely personal names "[name withheld]". The rule leans towards withholding.
DISARM techniques
DISARM Framework v (DISARM Foundation, CC BY-SA 4.0). A technique is attached only when a rule below matches the publisher's own words. It is Undertow's reading ("mapped"), not the publisher's claim.
Sources and their terms
| Publisher | Read how | Terms |
|---|---|---|
| Meta | Threat-research repository on GitHub: README table and network files | MIT. Network summaries quoted with the notice: Copyright (c) Meta Platforms, Inc. and affiliates |
| Influence Operations Bulletin pages, found from blog.google's security feed | Facts and counts only; no bulletin text republished | |
| OpenAI | News RSS feed only. Report pages are not read: OpenAI's terms bar programmatic extraction | Title and one-line summary quoted with credit |
| TikTok | TikTok's reports to the EU Code of Conduct on Disinformation, from the Code's Transparency Centre. Never tiktok.com: TikTok's terms bar automated extraction | No terms of use stated by the Centre |
| EEAS | 4th report on FIMI threats (March 2026), named operations entered once with page numbers | Reuse authorised with acknowledgement. Source: European External Action Service |
Collection
Expected next disclosures (dates only, on each publisher's past pattern; none is a published date):