{
"type": "bundle",
"id": "bundle--6fe4bfe7-116a-52bd-aacc-166d5c82af80",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.161705Z",
"modified": "2024-11-22T16:43:58.161705Z",
"name": "Post across Platform",
"description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.002.md",
"external_id": "T0119.002"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0cc5110d-f7a1-49f7-8667-ae454698f11d",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.132663Z",
"modified": "2024-11-22T16:43:58.132663Z",
"name": "Journalist Persona",
"description": "A person with a journalist persona presents themselves as a reporter or journalist delivering news, conducting interviews, investigations etc.
While presenting as a journalist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as journalists. Threat actors can fabricate journalists to give the appearance of legitimacy, justifying the actor’s requests for interviews, etc (T0143.002: Fabricated Persona, T0097.102: Journalist Persona).
People who have legitimately developed a persona as a journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a trusted journalist to provide legitimacy to a false narrative or be tricked into doing so without the journalist’s knowledge.
Associated Techniques and Sub-techniques
T0097.202: News Organisation Persona: People with a journalist persona may present as being part of a news organisation.
T0097.101: Local Persona: People with a journalist persona may present themselves as local reporters.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-legitimacy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.102.md",
"external_id": "T0097.102"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.10375Z",
"modified": "2024-11-22T16:43:58.10375Z",
"name": "Develop AI-Generated Text",
"description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.
Associated Techniques and Sub-techniques:
T0085.008: Machine Translated Text: Use this sub-technique when AI has been used to generate a translation of a piece of text.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "develop-content"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.001.md",
"external_id": "T0085.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2295615a-89ad-4f5b-b8ed-e70245a6d209",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.220405Z",
"modified": "2024-11-22T16:43:58.220405Z",
"name": "Impersonated Persona",
"description": "Threat actors may impersonate existing individuals or institutions to conceal their network identity, add legitimacy to content, or harm the impersonated target’s reputation. This Technique covers situations where an actor presents themselves as another existing individual or institution.
This Technique was previously called Prepare Assets Impersonating Legitimate Entities and used the ID T0099.
Associated Techniques and Sub-techniques
T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of impersonation. For example, a document developed by a threat actor which falsely presented as a letter from a government department could be documented using T0085.004: Develop Document, T0143.003: Impersonated Persona, and T0097.206: Government Institution Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts’ profile pictures as part of their impersonation efforts.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-legitimacy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.003.md",
"external_id": "T0143.003"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.158299Z",
"modified": "2024-11-22T16:43:58.158299Z",
"name": "Post Inauthentic Social Media Comment",
"description": "Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "deliver-content"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0116.001.md",
"external_id": "T0116.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.139245Z",
"modified": "2024-11-22T16:43:58.139245Z",
"name": "News Outlet Persona",
"description": "An institution with a news outlet persona presents itself as an organisation which delivers new information to its target audience.
While presenting as a news outlet is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by news organisations. Threat actors can fabricate news organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing news outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).
Legitimate news organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).
Associated Techniques and Sub-techniques T0097.102: Journalist Persona: Institutions presenting as news outlets may also present journalists working within the organisation.
T0097.201: Local Institution Persona: Institutions presenting as news outlets may present as being a local news outlet.
T0097.203: Fact Checking Organisation Persona: Institutions presenting as news outlets may also deliver a fact checking service (e.g. The UK’s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-legitimacy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.202.md",
"external_id": "T0097.202"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--696cbb0b-74f4-4937-9758-3fe56e4b9535",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.239774Z",
"modified": "2024-11-22T16:43:58.239774Z",
"name": "Compromised Asset",
"description": "A Compromised Asset is an asset which was originally created or belonged to another person or organisation, but which an actor has gained access to without their consent.
See also MITRE ATT&CK T1708: Valid Accounts.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-assets"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0150.005.md",
"external_id": "T0150.005"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--758f2786-68fa-4c9e-bce3-0b09ea00978f",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.140139Z",
"modified": "2024-11-22T16:43:58.140139Z",
"name": "Think Tank Persona",
"description": "An institution with a think tank persona presents itself as a think tank; an organisation that aims to conduct original research and propose new policies or solutions, especially for social and scientific problems.
While presenting as a think tank is not an indication of inauthentic behaviour, think tank personas are commonly used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.204: Think Tank Persona). They may be created to give legitimacy to narratives and allow them to suggest politically beneficial solutions to societal issues.
Legitimate think tanks could have a political bias that they may not be transparent about, they could use their persona for malicious purposes, or they could be exploited by threat actors (T0143.001: Authentic Persona, T0097.204: Think Tank Persona). For example, a think tank could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.
Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: Institutions presenting as think tanks may also present researchers working within the organisation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-legitimacy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.204.md",
"external_id": "T0097.204"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.220194Z",
"modified": "2024-11-22T16:43:58.220194Z",
"name": "Fabricated Persona",
"description": "An individual or institution pretending to have a persona without any legitimate claim to that persona is presenting a fabricated persona, such as a person who presents themselves as a member of a country’s military without having worked in any capacity with the military (T0143.002: Fabricated Persona, T0097.105: Military Personnel).
Sometimes real people can present entirely fabricated personas; they can use real names and photos on social media while also pretending to have credentials or traits they don’t have in real life.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-legitimacy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.002.md",
"external_id": "T0143.002"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.10809Z",
"modified": "2024-11-22T16:43:58.10809Z",
"name": "Develop AI-Generated Images (Deepfakes)",
"description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.
Associated Techniques and Sub-techniques:
T0145.002: AI-Generated Account Imagery: Analysts should use this sub-technique to document use of AI generated imagery in accounts’ profile pictures or other account imagery.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "develop-content"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0086.002.md",
"external_id": "T0086.002"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.145462Z",
"modified": "2024-11-22T16:43:58.145462Z",
"name": "Co-Opt Influencers",
"description": "Co-opt Influencers",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-legitimacy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0100.003.md",
"external_id": "T0100.003"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.110605Z",
"modified": "2024-11-22T16:43:58.110605Z",
"name": "Develop AI-Generated Videos (Deepfakes)",
"description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "develop-content"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0087.001.md",
"external_id": "T0087.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--d6be7b47-6d49-4859-b741-e1547538c079",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.223208Z",
"modified": "2024-11-22T16:43:58.223208Z",
"name": "Stock Image Account Imagery",
"description": "Stock images used in account imagery.
Stock image websites produce photos of people in various situations. Threat Actors can purchase or appropriate these images for use in their account imagery, increasing perceived legitimacy while avoiding the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).
Stock images tend to include physically attractive people, and this can benefit threat actors by increasing attention given to their posts.
This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-assets"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.007.md",
"external_id": "T0145.007"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.143152Z",
"modified": "2024-11-22T16:43:58.143152Z",
"name": "Create Inauthentic News Sites",
"description": "Create Inauthentic News Sites",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-legitimacy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0098.001.md",
"external_id": "T0098.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--e6a5397a-9515-4ba6-80e5-8f1fe273b7a5",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.221781Z",
"modified": "2024-11-22T16:43:58.221781Z",
"name": "Copy Account Imagery",
"description": "Account imagery copied from an existing account.
Analysts may use reverse image search tools to try to identify previous uses of account imagery (e.g. a profile picture) by other accounts.
Threat Actors have been known to copy existing accounts’ imagery to impersonate said accounts, or to provide imagery for unrelated accounts which aren’t intended to impersonate the original assets’ owner.
Associated Techniques and Sub-techniques
T0143.003: Impersonated Persona: Actors may copy existing accounts’ imagery in an attempt to impersonate them.
T0143.004: Parody Persona: Actors may copy existing accounts’ imagery as part of a parody of that account.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-assets"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.001.md",
"external_id": "T0145.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.222087Z",
"modified": "2024-11-22T16:43:58.222087Z",
"name": "AI-Generated Account Imagery",
"description": "AI Generated images used in account imagery.
An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived legitimacy. By using an AI-generated picture for this purpose, they are able to present themselves as a real person without compromising their own identity, or risking detection by taking a real person’s existing profile picture.
Associated Techniques and Sub-techniques
T0086.002: Develop AI-Generated Images (Deepfakes): Analysts should use this sub-technique to document use of AI generated imagery used to support narratives.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "establish-assets"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.002.md",
"external_id": "T0145.002"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--00bd91a0-5823-55b8-8962-bc7f6b3f00cc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 31 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 31 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5d57d5cd94",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5d57d5cd94"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 31
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--00fb3f51-679a-510d-9d0b-fa84ff2a805b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 30 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Belarus. Counts: 30 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-59960224a4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-59960224a4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 30
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--01aa5693-526c-54e8-8c3c-52e18a6de416",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 71 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 71 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-13cb8b9286",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-13cb8b9286"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 71
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0239b746-2dc5-5e07-a4c3-d6908d4cece9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 domain blocked from Google News and Discover, linked to Russia (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: United States of America. Counts: 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c97f511a46",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c97f511a46"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--031c32ef-bc4d-5f3c-a280-3701e3d5623d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 33 YouTube channels terminated, linked to India (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: India (\"linked to India\"). Counts: 33 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-9c97ae4787",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-9c97ae4787"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 33
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--035f0dbf-da94-5da6-b8a1-3076cef6bc94",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 123 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 123 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ccd169afc9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ccd169afc9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 123
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--03d28809-93cd-5b8f-b894-e24758af1f36",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 Blogger blogs terminated, linked to China (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: China (\"linked to China\"). Counts: 2 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3ed8b773d5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3ed8b773d5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"blogger_blogs": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--040b8407-b7de-504a-a6e1-540fa213821b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Iran, United States of America, Israel. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4937b572f4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4937b572f4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--04eebc45-ca0a-5123-a4e9-6d6c1e8fb747",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 63 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 63 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a2a5997e11",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a2a5997e11"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 63
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0547ac36-a0a9-57d8-b175-73776edf474d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 20 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Russia, Venezuela. Counts: 20 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c85bc1038d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c85bc1038d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 20
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--054b8550-ca46-5176-b1ca-5c1f30a97b34",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 2 YouTube channels and 1 domain blocked from Google News and Discover terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 2 YouTube channels, 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b8ecac49b2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b8ecac49b2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 2,
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--067e3e1e-c34f-562f-a68e-13134eb4627f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 30 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 30 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4d92816945",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4d92816945"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 30
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--06a7f974-ecb4-57f6-b854-87252f5b57be",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 39 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 39 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-41f369bd5d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-41f369bd5d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 39
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"name": "Ukraine and Bulgaria-Based Influence Operation Targeting United States, Germany, Italy, the United Kingdom, the Netherlands, France, Belgium, Latvia, Ukraine, and Moldova",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Ukraine, Bulgaria (\"originating in Ukraine and Bulgaria\"). Targets as stated: United States of America, Germany, Italy, United Kingdom, Netherlands, France, Belgium, Latvia, Ukraine, Moldova. Counts: 72 Facebook accounts, 16 Instagram accounts, 500 followers. Meta lists 22 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/h2-2026-ukraine-and-bulgaria-cib-based-network.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-9ff9f29d4f",
"url": "https://undertow.theintelligence.company/#UT-META-9ff9f29d4f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Ukraine and Bulgaria",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 72,
"instagram_accounts": 16,
"followers": 500,
"indicators": 22
},
"x_tic_disarm_basis": {
"T0119.002": "mapped",
"T0097.202": "mapped",
"T0098.001": "mapped",
"T0085.001": "mapped",
"T0097.102": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--07b9cbf7-a224-5652-a193-7e89a472eaa6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 127 YouTube channels terminated, linked to Pakistan (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Countries named in the publisher's description: India. Counts: 127 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5e55236856",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5e55236856"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 127
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0801eaa6-b154-5493-9d46-41819163d992",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 36 domains blocked from Google News and Discover, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Counts: 36 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6632bc8fbb",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6632bc8fbb"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"news_discover_domains": 36
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--084094f2-cc4d-5205-a8b2-79dc3be9789e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-25T00:00:00.000Z",
"modified": "2026-08-25T00:00:00.000Z",
"name": "OpenAI: Disrupting a new covert influence campaign from Russia",
"description": "OpenAI reports disrupting this network (2026-08). Origin as OpenAI states it: Russia (\"Russia-origin\"). Targets as stated: the West. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-influence-campaign-russia",
"description": "OpenAI threat reporting, 2026-08-25"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-683ac0b657",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-683ac0b657"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Russia-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_disarm_basis": {
"T0097.204": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--08ad801c-84c1-5176-835b-7b2ee2660018",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"name": "Stop News",
"description": "OpenAI reports disrupting this network (2025-10). Origin as OpenAI states it: Russia (\"Russia-origin\"). Targets as stated: Africa. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-stop-news-2025",
"description": "OpenAI threat reporting, 2025-10-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-8033473034",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-8033473034"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Russia-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-10",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--09f7526b-9f9d-531a-8834-01aa44a17239",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 4 Ads accounts terminated, no country named (2026-03)",
"description": "Google reports terminating this campaign (2026-03). No origin stated. Countries named in the publisher's description: Qatar. Counts: 4 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e73d2a1788",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e73d2a1788"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-03",
"x_tic_counts": {
"ads_accounts": 4
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--09fc0a98-1edc-5571-af76-df6ff3e7e877",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 13 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Counts: 13 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c99ef36a02",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c99ef36a02"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 13
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0b533052-2db0-5af8-bf83-ace5356d83cb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 106 YouTube channels terminated, linked to India (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: India (\"linked to India\"). Counts: 106 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-95d8d96cc7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-95d8d96cc7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 106
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0be13aac-14dd-5cde-8e6e-cd608ac25d09",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 35 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Russia, Ukraine. Counts: 35 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3bb1ebcf39",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3bb1ebcf39"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 35
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0c1a648a-dca0-5d97-83d3-951d51e71a0f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"name": "Helgoland Bite",
"description": "OpenAI reports disrupting this network (2025-06). No origin stated. Countries named in the publisher's description: Germany, Russia, Ukraine. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-helgoland-bite",
"description": "OpenAI threat reporting, 2025-06-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-013ef69a4a",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-013ef69a4a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2025-06",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0c2280f5-30fa-5a9d-9854-76d39854ee32",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 183 YouTube channels terminated, linked to Pakistan (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Counts: 183 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-58aa2eb6d9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-58aa2eb6d9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 183
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0d154eb2-3ed6-53fb-b3ad-d9faa3e04b3d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 62 accounts operated from Hungary that targeted a Hungarian audience",
"description": "TikTok reports disrupting this network (2026-03). Origin as TikTok states it: Hungary (\"We assess that this network operated from Hungary\"). Targets as stated: Hungary. Counts: 62 accounts, 1,452 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-8399e2beb4",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-8399e2beb4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Hungary",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"accounts": 62,
"followers": 1452
},
"x_tic_disarm_basis": {
"T0145.002": "mapped",
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0d4346db-c168-5f4f-9c41-716f68b3f23c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 6 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia. Counts: 6 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4bb673e45e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4bb673e45e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 6
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0dcb50ec-7cb3-5e83-9d1b-2f7c8bb12c79",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"name": "Doppelganger",
"description": "OpenAI reports disrupting this network (2024-05). Origin as OpenAI states it: Russia (\"Russia-origin\"). Countries named in the publisher's description: Ukraine. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-doppelganger",
"description": "OpenAI threat reporting, 2024-05-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-2a1527a0e8",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-2a1527a0e8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Russia-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2024-05",
"x_tic_disarm_basis": {
"T0116.001": "mapped",
"T0085.001": "mapped"
},
"confidence": 50
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0dd5dbf1-6d0d-50dd-8c37-ba4abd26e156",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 2 domains blocked from Google News and Discover, linked to Poland (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Poland (\"linked to Poland\"). Countries named in the publisher's description: Ukraine. Counts: 2 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d04d0bb6ef",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d04d0bb6ef"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Poland",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"news_discover_domains": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0e228e95-3f42-519b-bc19-58bfd09fa17f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 26 YouTube channels terminated, linked to Pakistan (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Counts: 26 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6ef779d14a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6ef779d14a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 26
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0ea6193c-1bb0-5ea5-857d-11bd71fc8161",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 18 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Bangladesh. Counts: 18 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f9b3a72cb2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f9b3a72cb2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 18
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0f0c4a29-e46b-526f-89f2-a7b005506d09",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:22.000Z",
"modified": "2026-08-27T09:09:22.000Z",
"name": "Russia-Based Influence Operation Targeting Western Audiences",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Russia (\"originating in Russia\"). Targets as stated: Western Audiences. Counts: 7 Facebook accounts, 9 Pages, 8 Instagram accounts, 200 followers. Meta lists 20 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-russia-cib-based-network-2.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-8100d9f43d",
"url": "https://undertow.theintelligence.company/#UT-META-8100d9f43d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 7,
"pages": 9,
"instagram_accounts": 8,
"followers": 200,
"indicators": 20
},
"x_tic_disarm_basis": {
"T0119.002": "mapped",
"T0145.002": "mapped",
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--0f88c402-60d2-58da-a0fd-a0b712b8de93",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 89 accounts operated from Russia that targeted a Russian audience",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Russia (\"We assessed that this network operated from Russia\"). Targets as stated: Russia. Counts: 89 accounts, 577 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-b0ecb31813",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-b0ecb31813"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assessed that this network operated from Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 89,
"followers": 577
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--10e47f6a-418c-530f-95a0-5eef3a26dd67",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 43 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 43 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b7ee269967",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b7ee269967"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 43
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--11961338-04ec-5eb6-b0b4-4fdd2327284a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 47 YouTube channels terminated, linked to Brazil (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Brazil (\"linked to Brazil\"). Counts: 47 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b704104c60",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b704104c60"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Brazil",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 47
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--11992697-6ac8-5825-9489-f77c8614c3ca",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 53 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 53 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b4a4500072",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b4a4500072"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 53
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--11d5faf4-aa35-565e-b3d0-8aaac8a41b97",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 275 YouTube channels terminated, no country named (2026-01)",
"description": "Google reports terminating this campaign (2026-01). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 275 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4e267c8cb2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4e267c8cb2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 275
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--13411a27-b176-5c9e-9cee-1075626c93e0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:41.000Z",
"modified": "2026-05-19T11:52:41.000Z",
"name": "Belarus, Russia-Based Influence Operation Network Targeting Poland",
"description": "Meta reports disrupting this network (H2 2025). Origin as Meta states it: Belarus, Russia (\"originating in Belarus\"). Targets as stated: Poland. Counts: 4 Facebook accounts, 12 Pages, 21 Instagram accounts, 200 followers. Meta lists 6 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2025-belarus-based-cib-network.md",
"description": "Meta Adversarial Threat Report H2 2025"
},
{
"source_name": "undertow",
"external_id": "UT-META-bba9f6c05e",
"url": "https://undertow.theintelligence.company/#UT-META-bba9f6c05e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Belarus",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2025",
"x_tic_counts": {
"facebook_accounts": 4,
"pages": 12,
"instagram_accounts": 21,
"followers": 200,
"indicators": 6
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--14215421-a93b-5a78-a2a4-33a91604b5b7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 16 YouTube channels terminated, no country named (2026-01)",
"description": "Google reports terminating this campaign (2026-01). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 16 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-fc0320e387",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-fc0320e387"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 16
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1493f118-83fb-58a1-a37a-9213f5bba9ab",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 17 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 17 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d43a2cf6aa",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d43a2cf6aa"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 17
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1501538f-adab-5068-b351-aee5f514be9b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 12 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 12 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0fa0f1032b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0fa0f1032b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 12
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1539d6ee-fa29-567d-b06b-6c4e63908925",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 89 YouTube channels and 1 Blogger blog terminated, linked to China (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America. Counts: 89 YouTube channels, 1 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3b34321d10",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3b34321d10"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 89,
"blogger_blogs": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--156cd610-6794-51ee-9ee3-96f18dc1cb74",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 5 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 5 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1d3980bdb2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1d3980bdb2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 5
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1573e75d-f6ba-5a05-9b6c-a17790fe171c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 310 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 310 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-271dbe365f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-271dbe365f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 310
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--159cf81f-72ae-585e-8bae-f3cc7a3ddf82",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: United States of America. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a16676820a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a16676820a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--17afe927-1209-5278-8a85-db38a8148a58",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 267 YouTube channels terminated, linked to India (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: India (\"linked to India\"). Counts: 267 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ea348b5f5f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ea348b5f5f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 267
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--17be4d6a-fd71-56d8-8336-6075460a425b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:04.000Z",
"modified": "2026-05-18T14:40:04.000Z",
"name": "Deep Dive: Domestic Pakistani Activity Displaying Wide Use of AI",
"description": "Meta reports disrupting this network (H1 2026). Origin as Meta states it: Pakistan. Targets as stated: Pakistan. Meta lists 7 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h1-2026-pakistan-based-cib-network.md",
"description": "Meta Adversarial Threat Report H1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-280d1c57e3",
"url": "https://undertow.theintelligence.company/#UT-META-280d1c57e3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H1 2026",
"x_tic_counts": {
"indicators": 7
},
"x_tic_disarm_basis": {
"T0145.001": "mapped",
"T0116.001": "mapped",
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--17e1ef75-4c27-58e3-803c-306137743fe0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 15 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Uzbekistan. Counts: 15 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-890bf0373f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-890bf0373f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 15
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--17ebe0c0-97f2-5b1e-9f36-a38d642cac12",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "Falsos Amigos",
"description": "The EEAS names Falsos Amigos among the Information Manipulation Sets active in 2025 (report p. 34). Origin as European External Action Service (EEAS) states it: China (\"a network of about twelve seemingly independent websites is in fact linked to Chinese state-controlled media\"). Counts: 12 websites. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-615b9a8099",
"url": "https://undertow.theintelligence.company/#UT-EEAS-615b9a8099"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "a network of about twelve seemingly independent websites is in fact linked to Chinese state-controlled media",
"x_tic_origin_level_stated": "high",
"x_tic_alignment": [
"CN"
],
"x_tic_period": "2025",
"x_tic_counts": {
"websites": 12
},
"x_tic_disarm_basis": {
"T0145.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--181905e4-aa74-5f43-93cc-6e45ebae3f53",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 41 YouTube channels terminated, linked to Ghana (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Ghana (\"linked to Ghana\"). Counts: 41 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-9bb44574c8",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-9bb44574c8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Ghana",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 41
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--18374284-1854-5a2e-9f65-1ff492a6972e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Bangladesh. Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-17a9ac8782",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-17a9ac8782"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 21
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1837ea67-aa42-58f4-8702-2681eeaae445",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 15 YouTube channels terminated, linked to Hungary (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Hungary (\"linked to Hungary\"). Counts: 15 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0c3d72bc14",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0c3d72bc14"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Hungary",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 15
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--183b73eb-d2b8-5896-ab9f-976a1a100d89",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 899 YouTube channels terminated, linked to Russia (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 899 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-404121600c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-404121600c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 899
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1856c372-4204-56a4-8281-4c59387c1875",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 3 Ads accounts terminated, no country named (2026-01)",
"description": "Google reports terminating this campaign (2026-01). No origin stated. Countries named in the publisher's description: Qatar. Counts: 3 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6513fc8e8d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6513fc8e8d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-01",
"x_tic_counts": {
"ads_accounts": 3
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1978f732-7ee7-5466-89b4-3990ab6b483a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Venezuela, Armenia. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-33805c994c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-33805c994c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--198affbe-4d43-5c55-8d4d-c176cf99e976",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 12 YouTube channels terminated, linked to China (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America. Counts: 12 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-535d6ea0f4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-535d6ea0f4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 12
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--19b9a6c6-dedd-5b57-9134-244bfd79b192",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 32 YouTube channels terminated, linked to Colombia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Colombia (\"linked to Colombia\"). Countries named in the publisher's description: United States of America, Venezuela. Counts: 32 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-eef45fad2d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-eef45fad2d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Colombia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 32
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1a226633-8622-565d-b196-52fddc5f0b22",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 49 YouTube channels terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Counts: 49 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5493763983",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5493763983"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 49
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1a53fcfe-246d-5a68-ae52-de65565cd614",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 80 YouTube channels terminated, linked to India (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: India (\"linked to India\"). Counts: 80 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-54f2a89e9e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-54f2a89e9e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 80
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1aca2a4c-69e4-5815-a81d-a26477ba5aba",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 5 YouTube channels terminated, linked to Iran (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 5 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c1acea5403",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c1acea5403"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 5
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1adb7954-d113-58a6-a992-4fe2d5ecfcbf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 23 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Italy. Counts: 23 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-15c73ffed8",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-15c73ffed8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 23
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1affdc3c-3fd2-5db5-a3ce-3d2a162055e7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 11 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Belarus, Ukraine, United States of America. Counts: 11 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-06d12dadf5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-06d12dadf5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 11
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1b823e58-f436-52ae-b6c5-f48a28223e45",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"name": "Stop News",
"description": "OpenAI reports disrupting this network (2024-10). Origin as OpenAI states it: Russia (\"Russia-origin\"). Targets as stated: the West. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-stop-news-2024",
"description": "OpenAI threat reporting, 2024-10-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-735e3320af",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-735e3320af"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Russia-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2024-10",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1b8a39b5-e575-5b41-b5fd-ff546f6e0be4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 26 accounts operated from Iran that targeted Francophone Africa",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). Origin as TikTok states it: Iran (\"We assess that this network operated from Iran and primarily targeted Francophone Africa\"). Targets as stated: Africa. Counts: 26 accounts, 10,994 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-72bcb10fe7",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-72bcb10fe7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Iran and primarily targeted Francophone Africa",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 26,
"followers": 10994
},
"x_tic_disarm_basis": {
"T0097.202": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1ba23e28-f78b-588f-8ff8-c0dda94ac064",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 13 accounts operated from Iran that targeted Arabic-speaking audiences",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). Origin as TikTok states it: Iran (\"We assess that this network operated from Iran\"). Counts: 13 accounts, 39 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-c62ee085a6",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-c62ee085a6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 13,
"followers": 39
},
"x_tic_disarm_basis": {
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1baca941-e4b0-56a1-afe1-62950205edbb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 15 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Japan, Ukraine. Counts: 15 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0757b98932",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0757b98932"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 15
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "RRN/Media Brands",
"description": "The EEAS names RRN/Media Brands among the Information Manipulation Sets active in 2025 (report p. 28). Origin as European External Action Service (EEAS) states it: Russia (\"Another SDA-run IMS\"). Targets as stated: Germany, France, Italy, Poland, Turkey, United States of America, the Middle East, Africa. Counts: 5 websites. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-71fc909be8",
"url": "https://undertow.theintelligence.company/#UT-EEAS-71fc909be8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Another SDA-run IMS",
"x_tic_origin_level_stated": "high",
"x_tic_period": "2025",
"x_tic_counts": {
"websites": 5,
"articles_per_week": 15
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1d617535-bb3c-5be1-a1d1-726e286ab67e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 206 YouTube channels terminated, linked to United States of America (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: United States of America (\"linked to United States\"). Counts: 206 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-bd3b0f5db4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-bd3b0f5db4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 206
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1dd6916f-dcc0-5c90-8587-682257dc94d2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 31 YouTube channels terminated, linked to India (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: India (\"linked to India\"). Counts: 31 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-39572880ca",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-39572880ca"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 31
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1de08901-c78d-5692-be20-3c7c026f5f5d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 27 accounts operated from Iran that targeted American audiences",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Iran (\"We assess that this network operated from Iran\"). Targets as stated: United States of America. Counts: 27 accounts, 110,346 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-6db34236b7",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-6db34236b7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 27,
"followers": 110346
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1e336b64-511c-5b28-bc23-d53bb5fe5564",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 domains blocked from Google News and Discover, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Hungary. Counts: 2 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-23e514e320",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-23e514e320"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"news_discover_domains": 2
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1e676f6e-7685-5b9b-8052-b494ca643419",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 domain blocked from Google News and Discover, linked to Czech Republic (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Counts: 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-43d7dd0d0c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-43d7dd0d0c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Czech Republic",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"news_discover_domains": 1
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1f1f5110-e1f4-53e7-97cd-587158611bad",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 22 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Japan. Counts: 22 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e8a01d7c92",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e8a01d7c92"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 22
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1f48336b-7de8-5e42-9a07-ff419347895c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 8 YouTube channels terminated, linked to Russia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Germany. Counts: 8 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-377698c443",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-377698c443"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 8
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1f67d854-7779-51b3-ba25-5c9da14026bb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 5 YouTube channels terminated, linked to Russia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 5 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ecd42f8639",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ecd42f8639"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 5
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1f7d9e0d-724b-5d44-8ea1-c9abbbf84b65",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 36 YouTube channels terminated, linked to India (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: India (\"linked to India\"). Counts: 36 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-785da41985",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-785da41985"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 36
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--1f993479-04ba-5eaf-b329-ea1cbc5a2e41",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1fa3e7f9d5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1fa3e7f9d5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 25
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2044e595-730b-5fbf-a2d7-971354272a76",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 166 YouTube channels terminated, linked to Brazil (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Brazil (\"linked to Brazil\"). Counts: 166 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b67772a72c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b67772a72c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Brazil",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 166
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--20ea8a25-b7e9-513b-b46a-95c7fba401d6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:31.000Z",
"modified": "2026-08-27T09:09:31.000Z",
"name": "Iran-Based Influence Operation Targeting Sub-Saharan Africa",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Iran (\"originating in Iran\"). Targets as stated: Sub-Saharan Africa. Counts: 23 Facebook accounts, 13 Pages, 1 Groups, 11 Instagram accounts, 12,800 followers. Meta lists 7 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-iran-cib-based-network-3.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-38440f3283",
"url": "https://undertow.theintelligence.company/#UT-META-38440f3283"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 23,
"pages": 13,
"groups": 1,
"instagram_accounts": 11,
"followers": 12800,
"indicators": 7
},
"x_tic_disarm_basis": {
"T0119.002": "mapped",
"T0116.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2163f8f0-d27d-503b-a242-804269f78edf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 8 YouTube channels terminated, linked to Serbia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Serbia (\"linked to Serbia\"). Countries named in the publisher's description: United States of America. Counts: 8 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1cf5b5dba3",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1cf5b5dba3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Serbia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 8
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2189182b-be5c-5056-b8bb-8957f61afdb0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 23 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Counts: 23 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-48e9e31507",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-48e9e31507"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 23
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--21a9e08b-7d24-5d18-89a0-32e35b8a28de",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-08T00:00:00.000Z",
"modified": "2026-10-08T00:00:00.000Z",
"name": "OpenAI: Disrupting AI-enabled “false front” operations",
"description": "OpenAI reports disrupting this network (2026-10). No origin stated. Counts: 2 operations. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-ai-enabled-false-front-operations",
"description": "OpenAI threat reporting, 2026-10-08"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-6bafc92085",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-6bafc92085"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-10",
"x_tic_counts": {
"operations": 2
},
"x_tic_disarm_basis": {
"T0097.102": "mapped",
"T0097.204": "mapped"
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2234ebb3-0a76-5a15-9ef5-1fcc59f00183",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, linked to France (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: France (\"linked to France\"). Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b09bf45944",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b09bf45944"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to France",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 21
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--223f4672-562e-5bef-82d4-156537858ccb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 236 YouTube channels terminated, linked to India (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: India (\"linked to India\"). Counts: 236 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6fc5afffc6",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6fc5afffc6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 236
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--240a84ed-0221-5b02-afcd-e7ef01be346d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 46 YouTube channels terminated, linked to Iran (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Azerbaijan. Counts: 46 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b25e685b49",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b25e685b49"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 46
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--24f4a7ba-e086-5806-9900-1556e5080efd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 68 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Pakistan. Counts: 68 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-db72c73835",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-db72c73835"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 68
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--25221259-6bbd-599e-a19c-62e7e74874bd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 13 YouTube channels terminated, linked to Argentina (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Argentina (\"linked to Argentina\"). Countries named in the publisher's description: Colombia. Counts: 13 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a29e0e259a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a29e0e259a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Argentina",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 13
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--25b0de2b-a763-5d84-a934-61b949d28354",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 10 YouTube channels terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Counts: 10 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ef71e2a87d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ef71e2a87d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 10
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--26691b51-ac83-567b-8628-77af816aa667",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 27 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Philippines. Counts: 27 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8da070f28f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8da070f28f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 27
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--26c2f277-7cef-59c8-82bb-f2fd02828bf7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 6 YouTube channels and 1 Blogger blog terminated, linked to Myanmar (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Myanmar (\"linked to Myanmar\"). Counts: 6 YouTube channels, 1 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-9a68399d9b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-9a68399d9b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Myanmar",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 6,
"blogger_blogs": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--26dd38f3-7ac6-5258-a78f-6f35adeb70a9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 115 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: Philippines. Counts: 115 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2b183c687b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2b183c687b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 115
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2815320e-0b34-593d-81fd-c3edbc558b06",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"name": "A2Z",
"description": "OpenAI reports disrupting this network (2024-10). No origin stated. Countries named in the publisher's description: Ukraine. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-a2z",
"description": "OpenAI threat reporting, 2024-10-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-463d6d73e9",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-463d6d73e9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2024-10",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--29619cdf-5fb8-54e2-a319-32fe7ff27418",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Iran (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7f5d19358e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7f5d19358e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--29b920e6-002f-523f-8ccc-7c4eb1c9d76b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 16 domains blocked from Google News and Discover, linked to Bulgaria (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Bulgaria (\"linked to Bulgaria\"). Countries named in the publisher's description: Russia. Counts: 16 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1025139d9f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1025139d9f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Bulgaria",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"news_discover_domains": 16
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--29e10eed-4b94-57dc-a06f-71f701a7262a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 20 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Chile. Counts: 20 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-322668f014",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-322668f014"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 20
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--29f428ce-22ff-585b-822a-fd481e6b9215",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 4 YouTube channels terminated, linked to Iran (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 4 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d376344aa0",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d376344aa0"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2a2fe8ba-cc0c-59d1-a252-827324873737",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:27.000Z",
"modified": "2026-08-27T09:09:27.000Z",
"name": "Iran-Based Influence Operation Targeting United States",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Iran (\"originating in Iran\"). Targets as stated: United States of America. Counts: 4 Facebook accounts, 31 Instagram accounts, 79,400 followers. Meta lists 0 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-iran-cib-based-network.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-4b0ee74e66",
"url": "https://undertow.theintelligence.company/#UT-META-4b0ee74e66"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 4,
"instagram_accounts": 31,
"followers": 79400,
"indicators": 0
},
"x_tic_disarm_basis": {
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2bac5e13-e7a7-5a6f-9752-64a8c45026c7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 Ads account terminated, linked to Israel (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Israel (\"linked to Israel\"). Countries named in the publisher's description: Russia, France, Serbia, United States of America. Counts: 1 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5c3bf36437",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5c3bf36437"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Israel",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"ads_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2c3becc7-3c5a-5799-9814-83457c076b8b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 2,254 YouTube channels terminated, linked to China (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: China (\"linked to People’s Republic of China\"). Countries named in the publisher's description: United States of America. Counts: 2,254 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-996f8673cf",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-996f8673cf"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to People’s Republic of China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 2254
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2d9a30bc-cb9d-5727-a30d-9489085f0f5d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-389407daf1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-389407daf1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2de658ec-6228-5553-8526-3d2eec057542",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 9 YouTube channels terminated, linked to Pakistan (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Countries named in the publisher's description: Palestine, Israel. Counts: 9 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-027acc52a5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-027acc52a5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 9
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "Spamouflage",
"description": "The EEAS names Spamouflage among the Information Manipulation Sets active in 2025 (report p. 29). No origin attributed; the publisher calls it aligned with China. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-a838d1f219",
"url": "https://undertow.theintelligence.company/#UT-EEAS-a838d1f219"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "The Chinese-aligned IMS",
"x_tic_origin_level_stated": "none",
"x_tic_alignment": [
"CN"
],
"x_tic_period": "2025",
"x_tic_counts": {
"platforms": 50
},
"x_tic_disarm_basis": {
"T0143.003": "mapped",
"T0150.005": "mapped",
"T0119.002": "mapped",
"T0087.001": "mapped",
"T0086.002": "mapped"
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2e6b0439-ad4a-50ce-8bd6-6f547410035b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2,320 YouTube channels terminated, linked to China (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: China (\"linked to PRC\"). Countries named in the publisher's description: United States of America. Counts: 2,320 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ebb11ba774",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ebb11ba774"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to PRC",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 2320
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2ef807e3-ad82-562a-8b01-cb533af6874a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 22 YouTube channels terminated, linked to India (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: India (\"linked to India\"). Counts: 22 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c71d4c55bb",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c71d4c55bb"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 22
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--2f3cc963-b0ae-5490-a288-7b65c4a2f0a7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 36 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Poland. Counts: 36 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0d3286d618",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0d3286d618"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 36
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--30b8bd79-3679-55fc-bc70-81e77fd96a08",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 22 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Taiwan. Counts: 22 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ff2246f250",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ff2246f250"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 22
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3125b23f-50d6-5f52-925e-1c3a4815aeea",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 45 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 45 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-752c69b2d2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-752c69b2d2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 45
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--31a33830-83eb-53cd-9c70-debcabd9e49b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Germany. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-18d8a4d8e4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-18d8a4d8e4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--31b3bf44-a770-5f3c-a7ed-0eba4f37a36d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 235 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 235 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d9bcea432d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d9bcea432d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 235
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--31c80d24-b1b7-580f-869a-09418fcd4784",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 6,103 YouTube channels terminated, linked to China (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: China (\"linked to People’s Republic of China\"). Countries named in the publisher's description: United States of America. Counts: 6,103 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-34531800b1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-34531800b1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to People’s Republic of China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 6103
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--31d26223-b76b-547b-b4b6-a65be8af617f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 20 YouTube channels terminated, linked to United States of America (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: United States of America (\"linked to United States\"). Counts: 20 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cdcecc6a4c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cdcecc6a4c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 20
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3246d9c7-6635-5d88-bfb0-2914e24f6912",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 397 YouTube channels and 1 Blogger blog terminated, linked to Cambodia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Cambodia (\"linked to Cambodia\"). Countries named in the publisher's description: Thailand. Counts: 397 YouTube channels, 1 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4fd8952d29",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4fd8952d29"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Cambodia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 397,
"blogger_blogs": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--337a011d-1532-5825-9c1e-692c346365c8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 14 YouTube channels terminated, linked to Canada (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Canada (\"linked to Canada\"). Countries named in the publisher's description: United Kingdom. Counts: 14 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0c670ad080",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0c670ad080"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Canada",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 14
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--33942079-14cc-59ef-8a42-907f6890a7e4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 Ads account and 2 Blogger blogs terminated, linked to Iran (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Pakistan, Israel, United States of America. Counts: 1 Ads accounts, 2 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6380801904",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6380801904"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"ads_accounts": 1,
"blogger_blogs": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--33e773b1-78ba-5f29-88bb-fb111a34f6e6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 63 YouTube channels terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, Ukraine, United Kingdom. Counts: 63 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-949cc294b1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-949cc294b1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 63
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3415c078-7550-566a-a362-7eaf930748e5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 25 YouTube channels and 2 domains blocked from Google News and Discover terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 25 YouTube channels, 2 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-30f1942b07",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-30f1942b07"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 25,
"news_discover_domains": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--34797274-be28-55e7-a3b0-d06b06664bb3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 50 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Pakistan. Counts: 50 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-defbc72f41",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-defbc72f41"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 50
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--36decfd8-cdc6-598d-a6cb-5b6fc886f2dc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 64 YouTube channels terminated, linked to China (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: China (\"linked to China\"). Counts: 64 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8c4327d14c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8c4327d14c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 64
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--37ca1f0a-46cd-5efd-aab5-2043967f382f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:07.000Z",
"modified": "2026-05-18T14:40:07.000Z",
"name": "Iran-Based Influence Operation Network Targeting Azerbaijan",
"description": "Meta reports disrupting this network (H1 2026). Origin as Meta states it: Iran. Targets as stated: Azerbaijan. Counts: 367 Facebook accounts, 3 Pages, 360 Instagram accounts, 4,000 followers. Meta lists 2 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h1-2026-iran-based-cib-network-2.md",
"description": "Meta Adversarial Threat Report H1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-0615609656",
"url": "https://undertow.theintelligence.company/#UT-META-0615609656"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H1 2026",
"x_tic_counts": {
"facebook_accounts": 367,
"pages": 3,
"instagram_accounts": 360,
"followers": 4000,
"indicators": 2
},
"x_tic_disarm_basis": {
"T0116.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--390d981f-469e-5e73-bcd7-731b9bcf70ba",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 39 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Republic of the Congo. Counts: 39 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-27b93fa312",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-27b93fa312"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 39
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:39.000Z",
"modified": "2026-05-19T11:52:39.000Z",
"name": "India-Based Influence Operation Network Targeting India",
"description": "Meta reports disrupting this network (H2 2025). Origin as Meta states it: India (\"originating in India\"). Targets as stated: India. Counts: 59 Facebook accounts, 11 Pages, 152 Instagram accounts, 102,100 followers. Meta lists 0 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2025-india-based-cib-network.md",
"description": "Meta Adversarial Threat Report H2 2025"
},
{
"source_name": "undertow",
"external_id": "UT-META-403e8f8765",
"url": "https://undertow.theintelligence.company/#UT-META-403e8f8765"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2025",
"x_tic_counts": {
"facebook_accounts": 59,
"pages": 11,
"instagram_accounts": 152,
"followers": 102100,
"indicators": 0
},
"x_tic_disarm_basis": {
"T0116.001": "mapped",
"T0085.001": "mapped",
"T0145.002": "mapped",
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--39e4c4c6-b983-5996-94cc-a91a7c3200cf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 8 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: United States of America, Ukraine, Israel, Moldova. Counts: 8 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ffd15b9233",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ffd15b9233"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 8
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3cee8fc4-9eef-5342-a48e-732edd5ec614",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 20 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 20 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2396235c11",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2396235c11"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 20
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3d7da887-67e7-54f5-95eb-7551a2f33a33",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, linked to Azerbaijan (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-fd28e5f1b9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-fd28e5f1b9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 25
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3d9a4f91-a2f1-5295-a2d7-7f262814151e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 57 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Poland. Counts: 57 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8880454054",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8880454054"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 57
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3d9dc53f-07d9-5670-aeca-352ba7fb3d1e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 34 YouTube channels, 1 Blogger blog and 84 domains blocked from Google News and Discover terminated, linked to Pakistan (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Countries named in the publisher's description: Palestine, Iran, United Arab Emirates. Counts: 34 YouTube channels, 1 Blogger blogs, 84 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3ef14752c8",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3ef14752c8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 34,
"blogger_blogs": 1,
"news_discover_domains": 84
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3f3ca979-c388-5502-a2d3-82dabdf1c924",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "Portal Kombat",
"description": "The EEAS names Portal Kombat among the Information Manipulation Sets active in 2025 (report p. 29). No origin attributed; the publisher calls it aligned with Russia. Targets as stated: Bosnia and Herzegovina, Spain, the Balkans. Counts: 101 websites. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-d5db140752",
"url": "https://undertow.theintelligence.company/#UT-EEAS-d5db140752"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Also known as Pravda network, it is one of the most prolific Russia-aligned IMS",
"x_tic_origin_level_stated": "none",
"x_tic_alignment": [
"RU"
],
"x_tic_period": "2025",
"x_tic_counts": {
"websites": 101,
"articles_per_day": 10000,
"new_subdomains_end_2024": 26
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3f454965-9736-5d74-b99c-718fa0b8e017",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 4 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: United States of America. Counts: 4 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ce5cb5de47",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ce5cb5de47"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3f7e3aec-a69a-5a24-a458-8759d161b42d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 30 YouTube channels terminated, linked to Indonesia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Indonesia (\"linked to Indonesia\"). Counts: 30 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-fa04e56281",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-fa04e56281"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Indonesia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 30
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--3faba592-a634-5c12-a2ea-c8d2f667c291",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 105 YouTube channels terminated, linked to Hungary (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Hungary (\"linked to Hungary\"). Counts: 105 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1c4ec23c07",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1c4ec23c07"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Hungary",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 105
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--42bf4083-84b9-5700-b88b-a51e374084c8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: Republic of the Congo. Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c24a320344",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c24a320344"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 21
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--432270d1-6ea2-50f1-b626-f0305d3d9f1a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Iran (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Palestine, Israel, United States of America. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f8ee317822",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f8ee317822"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--440af0dc-29c2-5125-bfb6-239b6bac9d38",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 5,090 YouTube channels terminated, linked to China (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: China (\"linked to PRC\"). Countries named in the publisher's description: United States of America. Counts: 5,090 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-847e58a5ee",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-847e58a5ee"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to PRC",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 5090
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--442ad461-7bcf-5989-83d5-150654c6b9c2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"name": "Fish Food",
"description": "OpenAI reports disrupting this network (2026-02). Origin as OpenAI states it: Russia (\"Russia-origin\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-fish-food",
"description": "OpenAI threat reporting, 2026-02-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-27a8112a94",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-27a8112a94"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Russia-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_disarm_basis": {
"T0119.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--450be43a-161b-5e75-93c5-fc7c5f2c9575",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 9 accounts operated from Malta that targeted a Maltese audience",
"description": "TikTok reports disrupting this network (2026-05). Origin as TikTok states it: Malta (\"We assess that this network operated from Malta\"). Targets as stated: Malta. Counts: 9 accounts, 433 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-12042ebc57",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-12042ebc57"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Malta",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"accounts": 9,
"followers": 433
},
"x_tic_disarm_basis": {
"T0097.202": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--453f1eaf-a9f3-5d0a-bf2e-8cc4aeacecaf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 53 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 53 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a437c0f5bc",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a437c0f5bc"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 53
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--460143f1-96f4-5093-924c-96ca9b7896e6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 45 YouTube channels terminated, linked to Canada (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Canada (\"linked to Canada\"). Countries named in the publisher's description: Cuba, United States of America. Counts: 45 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b0176b4454",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b0176b4454"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Canada",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 45
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--470461f0-2b0c-5d12-8b12-f58bc5d1d3fb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 37 YouTube channels terminated, linked to India (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: India (\"linked to India\"). Counts: 37 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-68760b2b0f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-68760b2b0f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 37
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4751d1dc-6f7a-58c8-a52f-8bc8d416a0e0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 29 YouTube channels terminated, linked to Iran (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Azerbaijan, Israel. Counts: 29 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7b78374b10",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7b78374b10"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 29
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--485644b9-9fcb-562e-ad30-3d35d1ebe32d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:45.000Z",
"modified": "2026-08-27T09:09:45.000Z",
"name": "Russia-Based Influence Operation Targeting Europe, the Middle East, and Africa",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Russia (\"originating in Russia\"). Targets as stated: the Middle East, Europe, Africa. Counts: 16 Facebook accounts, 24 Pages, 1 Groups, 64,600 followers. Meta lists 2 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-russia-cib-based-network.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-f6a52f7deb",
"url": "https://undertow.theintelligence.company/#UT-META-f6a52f7deb"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 16,
"pages": 24,
"groups": 1,
"followers": 64600,
"indicators": 2
},
"x_tic_disarm_basis": {
"T0119.002": "mapped",
"T0150.005": "mapped",
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4944da77-466f-588b-95f3-1ad03db6e996",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 93 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Counts: 93 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4b60915753",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4b60915753"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 93
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--49cb9404-16a5-5f98-9f91-1491f957346a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 51 accounts operated from Germany that targeted a German audience",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Germany (\"We assess that this network operated from Germany\"). Targets as stated: Germany. Counts: 51 accounts, 46,388 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-44f24b05a2",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-44f24b05a2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Germany",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 51,
"followers": 46388
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4a2d346b-e42e-5203-a109-89a1ecafe9bd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 22 domains blocked from Google News and Discover, linked to China (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America. Counts: 22 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-fc87ad283c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-fc87ad283c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"news_discover_domains": 22
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4aa183be-41fd-5a90-8e87-6d01afb6747f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "HaiEnergy",
"description": "The EEAS names HaiEnergy among the Information Manipulation Sets active in 2025 (report p. 29). No origin attributed; the publisher calls it aligned with China. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-422c02f5ab",
"url": "https://undertow.theintelligence.company/#UT-EEAS-422c02f5ab"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "These Chinese state-aligned IMS",
"x_tic_origin_level_stated": "none",
"x_tic_alignment": [
"CN"
],
"x_tic_period": "2025"
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4c5f4b2b-32cc-5799-816f-1c878c429739",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1,096 YouTube channels terminated, linked to China (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: China (\"linked to PRC\"). Countries named in the publisher's description: United States of America. Counts: 1,096 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-28fa963a2a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-28fa963a2a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to PRC",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 1096
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4c7184d1-210e-5c5b-8920-c03eef9b7643",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 4 YouTube channels and 1 Ads account terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Iran, Ukraine, United States of America. Counts: 4 YouTube channels, 1 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0d346acaea",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0d346acaea"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 4,
"ads_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4c8c1659-e567-5af4-889e-7c85f404ed1b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 41 accounts operated from China that targeted a global audience",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: China (\"We assess that this network operated from China\"). Targets as stated: global. Counts: 41 accounts, 195,566 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-4765dc514d",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-4765dc514d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 41,
"followers": 195566
},
"x_tic_disarm_basis": {
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4cf59072-3bbd-5f24-9441-a6dd98ecdce2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 72 YouTube channels terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Counts: 72 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-57345adc1b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-57345adc1b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 72
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4d56fd16-af11-5f98-bc43-c8bfd7486d0c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 46 YouTube channels terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 46 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d2a63fa70a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d2a63fa70a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 46
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4dcf74c2-1a92-56b4-91fd-db45f00b6f6d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 4,963 YouTube channels terminated, linked to China (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: China (\"linked to PRC\"). Countries named in the publisher's description: United States of America. Counts: 4,963 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-495fac1102",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-495fac1102"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to PRC",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 4963
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4deb1947-2ad9-55fa-a4e1-0a4b1ad08d9f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"name": "Sneer Review",
"description": "OpenAI reports disrupting this network (2025-06). Origin as OpenAI states it: China (\"China-origin\"). Countries named in the publisher's description: Taiwan, United States of America. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-sneer-review",
"description": "OpenAI threat reporting, 2025-06-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-d8f9be26bc",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-d8f9be26bc"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "China-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-06",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4e566d82-5702-595e-b147-bffdfa01f611",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 6 YouTube channels terminated, linked to Azerbaijan (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 6 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4a5dab127e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4a5dab127e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 6
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4e6291c0-4696-5b0f-a38c-716e9983dd24",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 4 YouTube channels terminated, linked to Iran (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 4 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cd4c5e250d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cd4c5e250d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--4fc8e48d-1e1e-5af4-9633-32d3daa2dcd0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 10 YouTube channels and 13 domains blocked from Google News and Discover terminated, linked to Sudan (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Sudan (\"linked to Sudan\"). Counts: 10 YouTube channels, 13 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3f6217bae8",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3f6217bae8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Sudan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 10,
"news_discover_domains": 13
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--50052f63-c2d2-5ec1-8722-82f8318a5bc8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 4 YouTube channels terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Hungary. Counts: 4 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e57929da57",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e57929da57"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5030645f-be1d-5a54-b14f-7c92b279830e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 3,406 YouTube channels terminated, linked to China (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: China (\"linked to PRC\"). Countries named in the publisher's description: United States of America. Counts: 3,406 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a43b162cd2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a43b162cd2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to PRC",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 3406
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5036771c-86d5-54f0-bac1-8584c7048521",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Iran (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Palestine. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-99e4f07aa8",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-99e4f07aa8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--50645af8-3650-5919-9ddd-e476e554c78a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:10.000Z",
"modified": "2026-05-18T14:40:10.000Z",
"name": "Russia-Based Influence Operation Network Targeting Sub-Saharan Africa",
"description": "Meta reports disrupting this network (H1 2026). Origin as Meta states it: Russia (\"originating in Russia that targeted audiences in Sub-Saharan Africa\"). Targets as stated: Sub-Saharan Africa. Counts: 37 Facebook accounts, 29 Pages, 30,000 followers. Meta lists 5 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h1-2026-russia-based-cib-network-1.md",
"description": "Meta Adversarial Threat Report H1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-358e671a72",
"url": "https://undertow.theintelligence.company/#UT-META-358e671a72"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Russia that targeted audiences in Sub-Saharan Africa",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H1 2026",
"x_tic_counts": {
"facebook_accounts": 37,
"pages": 29,
"followers": 30000,
"indicators": 5
},
"x_tic_disarm_basis": {
"T0143.002": "mapped",
"T0085.001": "mapped",
"T0086.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--511111d9-5950-5683-ad7e-9f10fb20f05e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 6 accounts operated from Kazakhstan that targeted a global English-speaking audience",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Kazakhstan (\"We assess that this network operated from Kazakhstan\"). Targets as stated: global. Counts: 6 accounts, 492,739 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-001e9f9ad8",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-001e9f9ad8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Kazakhstan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 6,
"followers": 492739
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--52264298-1b8e-5500-bd0d-4665dbde537e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 132 YouTube channels terminated, linked to Azerbaijan (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 132 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6a3d1037cc",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6a3d1037cc"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 132
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--54ad9c2e-ebae-5804-a38f-4429bfa9d437",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 2,854 YouTube channels terminated, linked to Indonesia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Indonesia (\"linked to Indonesia\"). Counts: 2,854 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-60b0d06fd9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-60b0d06fd9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Indonesia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 2854
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--55358f9c-a01c-56e9-9791-bd053a083b07",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-08-16T11:00:00.000Z",
"modified": "2024-08-16T11:00:00.000Z",
"name": "OpenAI: Disrupting a covert Iranian influence operation",
"description": "OpenAI reports disrupting this network (2024-08). Origin as OpenAI states it: Iran (\"a covert Iranian influence operation\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-a-covert-iranian-influence-operation",
"description": "OpenAI threat reporting, 2024-08-16"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-f75f080189",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-f75f080189"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "a covert Iranian influence operation",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2024-08",
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--570073e5-01b2-5b2a-8537-b7475258be20",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 61 YouTube channels terminated, linked to Iran (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Azerbaijan, Israel. Counts: 61 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f57038af65",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f57038af65"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 61
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--57544b96-3d03-5f9e-ae00-6e9d8d108d53",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 4 YouTube channels terminated, linked to Iran (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Iran (\"linked to Iran\"). Counts: 4 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-74524caa88",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-74524caa88"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5858061e-8fec-5674-927d-ff6446b2259e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 19 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine, United Kingdom. Counts: 19 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-805fd45090",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-805fd45090"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 19
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--58aed277-5ef0-55af-b5c6-53a9178ecfa9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:06.000Z",
"modified": "2026-05-18T14:40:06.000Z",
"name": "China-Based Influence Operation Network Targeting Taiwan",
"description": "Meta reports disrupting this network (H1 2026). Origin as Meta states it: China (\"originating in China that targeted audiences in Taiwan\"). Targets as stated: Taiwan. Counts: 154 Facebook accounts, 23 Pages, 1 Instagram accounts, 93,000 followers. Meta lists 5 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h1-2026-china-based-cib-network.md",
"description": "Meta Adversarial Threat Report H1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-0c5cdb46d3",
"url": "https://undertow.theintelligence.company/#UT-META-0c5cdb46d3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in China that targeted audiences in Taiwan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H1 2026",
"x_tic_counts": {
"facebook_accounts": 154,
"pages": 23,
"instagram_accounts": 1,
"followers": 93000,
"indicators": 5
},
"x_tic_disarm_basis": {
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--59e8bbe5-f7ee-5437-8c3f-44ea811c53b6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 173 YouTube channels terminated, linked to Uzbekistan (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Uzbekistan (\"linked to Uzbekistan\"). Counts: 173 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-57b576262c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-57b576262c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Uzbekistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 173
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5a2fdc86-c155-5a3e-ade8-697e4109e733",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"name": "Nine–emdash Line",
"description": "OpenAI reports disrupting this network (2025-10). Origin as OpenAI states it: China (\"PRC-origin\"). Countries named in the publisher's description: Hong Kong, United States of America. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-nine-emdash-line",
"description": "OpenAI threat reporting, 2025-10-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-e52c9cdf4f",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-e52c9cdf4f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "PRC-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-10",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5b0aff67-df3d-5b15-859e-7dfb8370c9fe",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 352 YouTube channels terminated, linked to Indonesia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Indonesia (\"linked to Indonesia\"). Counts: 352 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-78158d035b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-78158d035b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Indonesia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 352
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5b364c78-75d7-5970-9058-69642dfd7b87",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 11 YouTube channels terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 11 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-183eb66506",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-183eb66506"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 11
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"name": "Israel-Based Influence Operation Targeting France, the UK, Australia, and Africa",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Israel (\"originating in Israel\"). Targets as stated: France, United Kingdom, Australia, Iran, Togo, Gabon, Angola. Counts: 215 Facebook accounts, 4 Pages, 1,044 Instagram accounts, 32,500 followers. Meta lists 8 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-israel-cib-based-network.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-ddef46e602",
"url": "https://undertow.theintelligence.company/#UT-META-ddef46e602"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Israel",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 215,
"pages": 4,
"instagram_accounts": 1044,
"followers": 32500,
"indicators": 8
},
"x_tic_disarm_basis": {
"T0119.002": "mapped",
"T0116.001": "mapped",
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5c9940c2-d2ab-594d-a60c-388bf39e9b9a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 17 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Bangladesh. Counts: 17 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2de5b7316f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2de5b7316f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 17
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5cc48d82-6fee-5fc0-82e6-47817011d95b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7e5e9b4dd3",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7e5e9b4dd3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5e66d119-68af-5613-a933-a134fe9ef845",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cc2669c308",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cc2669c308"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 21
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5e809180-ea9f-5196-8c09-da83278de6ba",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 74 YouTube channels terminated, linked to France (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: France (\"linked to France\"). Countries named in the publisher's description: Israel, Iran, Palestine. Counts: 74 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c426d8604d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c426d8604d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to France",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 74
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5ebe163a-dbb6-585c-9e71-29b13e4d45b9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 60 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 60 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-23c02b7781",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-23c02b7781"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 60
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5ee28ef1-39ce-502c-bc91-3d37cd42347e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 8 YouTube channels and 1 domain blocked from Google News and Discover terminated, linked to China (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America. Counts: 8 YouTube channels, 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1acb91166d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1acb91166d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 8,
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--5f7c1ce8-e8ee-50fc-95d6-fa5045eb0546",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1 Ads account and 2 domains blocked from Google News and Discover terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Counts: 1 Ads accounts, 2 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6eb8177ce9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6eb8177ce9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"ads_accounts": 1,
"news_discover_domains": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--60432786-36b0-54f9-9952-6560c6b06478",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 621 YouTube channels terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 621 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f1e9ec97af",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f1e9ec97af"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 621
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--614a0e15-1ea0-5a2f-8d3d-c75967f11354",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 15 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine, Moldova, United States of America. Counts: 15 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c2d93d5cf9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c2d93d5cf9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 15
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--61a1fb22-b1b8-5366-a294-1deadd2c781e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 12 YouTube channels terminated, linked to Belarus (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Belarus (\"linked to Belarus\"). Counts: 12 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-69901f57b7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-69901f57b7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Belarus",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 12
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--62041f62-1c9d-5a8e-a695-62c8a25e9213",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 560 YouTube channels terminated, linked to Azerbaijan (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 560 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-9d030b1cc0",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-9d030b1cc0"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 560
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--637cc5f2-9973-5ef4-9ea5-4520044f5464",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Iran (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3ef2b393c0",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3ef2b393c0"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--63e611e0-fac9-58df-ae6b-459aac6d971b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 12 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 12 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ac05f9f4a2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ac05f9f4a2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 12
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6450fe50-566f-5b5e-9d43-38ae79379ef7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 12 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Counts: 12 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f5e6f5ca99",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f5e6f5ca99"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 12
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--64a9e4c6-ce8b-5f6b-9e40-9b7bb808fcb1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"name": "OpenAI: Iranian influence nexus: Cross-platform activity",
"description": "OpenAI reports disrupting this network (2025-02). Origin as OpenAI states it: Iran (\"Iran-linked\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-iranian-influence-nexus",
"description": "OpenAI threat reporting, 2025-02-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-1b6256bb62",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-1b6256bb62"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Iran-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-02",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 50
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "Storm-1516",
"description": "The EEAS names Storm-1516 among the Information Manipulation Sets active in 2025 (report p. 29). No origin attributed; the publisher calls it aligned with Russia. Targets as stated: Germany, United States of America, France, Moldova, Armenia, Ukraine. Counts: 453 websites. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-1c6c2fcc00",
"url": "https://undertow.theintelligence.company/#UT-EEAS-1c6c2fcc00"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Also known as CopyCop or False Façade, this nonattributed Russia-aligned IMS",
"x_tic_origin_level_stated": "none",
"x_tic_alignment": [
"RU"
],
"x_tic_period": "2025",
"x_tic_counts": {
"websites": 453,
"website_networks_created_2025": 5
},
"x_tic_disarm_basis": {
"T0097.202": "mapped",
"T0098.001": "mapped",
"T0100.003": "mapped",
"T0087.001": "mapped"
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--663d149d-c84e-5fe3-83d1-c787d22f14c0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 5 YouTube channels and 4 domains blocked from Google News and Discover terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Iran, Ukraine, United States of America. Counts: 5 YouTube channels, 4 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-774b4ec132",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-774b4ec132"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 5,
"news_discover_domains": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--666b8e5c-17eb-5928-aa89-9cade1ecfde0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 30 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Japan. Counts: 30 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7ce3fd31fc",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7ce3fd31fc"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 30
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6732479f-0bd0-50c4-9335-1d471421f3ed",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, linked to Azerbaijan (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ba7f21fcdf",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ba7f21fcdf"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 25
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--67550555-c2ba-576e-b511-0deee51bbeab",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 38 accounts operated from Russia that targeted a Ukrainian",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Russia (\"We assessed that this network operated from Russia\"). Targets as stated: Ukraine. Counts: 38 accounts, 124,008 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-4730c09028",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-4730c09028"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assessed that this network operated from Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 38,
"followers": 124008
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--67a19003-c93d-597a-b12f-655d7398a19f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 24 YouTube channels terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, Ukraine. Counts: 24 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e5c70bc3c6",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e5c70bc3c6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 24
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--680e1ac9-00ec-53ec-bc0b-9fe8567dc8e5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 14 YouTube channels terminated, linked to Canada (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Canada (\"linked to Canada\"). Countries named in the publisher's description: United Kingdom. Counts: 14 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-dc3881bcf4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-dc3881bcf4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Canada",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 14
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6ae0f9e4-47ea-5069-b9c7-2fe2ef189459",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 12 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: France. Counts: 12 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b79b39a147",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b79b39a147"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 12
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6af87921-ff30-5a97-b16a-cc0c27c2fd5b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"name": "VAGue Focus",
"description": "OpenAI reports disrupting this network (2025-06). No origin stated. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-vague-focus",
"description": "OpenAI threat reporting, 2025-06-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-a0cc931f63",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-a0cc931f63"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2025-06"
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6afef5ea-7c10-5eaf-88a9-cc4fc9ace350",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 402 YouTube channels terminated, no country named (2026-02)",
"description": "Google reports terminating this campaign (2026-02). No origin stated. Countries named in the publisher's description: Ukraine, Russia. Counts: 402 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-589d6506bc",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-589d6506bc"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 402
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6b49a745-8142-5614-afed-b6ae8dbdd38a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 34 accounts operated from Bulgaria that targeted a Bulgarian audience",
"description": "TikTok reports disrupting this network (2026-03). Origin as TikTok states it: Bulgaria (\"We assess that this network operated from Bulgaria\"). Targets as stated: Bulgaria. Counts: 34 accounts, 66,763 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-5a8ee042f2",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-5a8ee042f2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Bulgaria",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"accounts": 34,
"followers": 66763
},
"x_tic_disarm_basis": {
"T0119.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6c99159e-9b8e-5bdd-8e61-219dbb198bb0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"name": "Trolling Stone",
"description": "OpenAI reports disrupting this network (2026-02). Origin as OpenAI states it: Russia (\"Russia-linked\"). Countries named in the publisher's description: Argentina. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-trolling-stone",
"description": "OpenAI threat reporting, 2026-02-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-0d820ede21",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-0d820ede21"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Russia-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_disarm_basis": {
"T0116.001": "mapped",
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6e1dd9d9-ba39-53d8-8310-2caa3945e047",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 818 YouTube channels terminated, linked to Azerbaijan (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 818 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-02219fce1c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-02219fce1c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 818
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6e9a408b-dce6-5031-82cb-ffdfdcb9f92d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"name": "Tech and Tariffs",
"description": "OpenAI reports disrupting this network (2026-06). Origin as OpenAI states it: China (\"likely PRC-origin\"). Countries named in the publisher's description: United States of America. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-tech-and-tariffs",
"description": "OpenAI threat reporting, 2026-06-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-9b7c0efc15",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-9b7c0efc15"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "likely PRC-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_disarm_basis": {
"T0116.001": "mapped",
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6f103d69-5e6d-580b-bc9f-b3fba943f2af",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 148 YouTube channels terminated, linked to Bangladesh (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Bangladesh (\"linked to Bangladesh\"). Counts: 148 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ea565f4eaf",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ea565f4eaf"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Bangladesh",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 148
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6f6f193e-4c5d-53a1-8eba-d7db5843dc10",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 74 YouTube channels terminated, linked to Thailand (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Thailand (\"linked to Thailand\"). Countries named in the publisher's description: China, Russia. Counts: 74 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2aa4389231",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2aa4389231"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Thailand",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 74
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--6f71b733-c697-566e-a6a9-81bfc2078fef",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"name": "IUVM",
"description": "OpenAI reports disrupting this network (2024-05). Origin as OpenAI states it: Iran (\"Iran-linked\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-iuvm",
"description": "OpenAI threat reporting, 2024-05-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-761e9350e5",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-761e9350e5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Iran-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2024-05",
"confidence": 50
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--70514dd8-6dd7-5f63-9506-1495eb6383b0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 domain blocked from Google News and Discover, linked to Romania (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Romania (\"linked to Romania\"). Countries named in the publisher's description: Russia. Counts: 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-035f3400b3",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-035f3400b3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Romania",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--70655dea-9bb0-519e-9f28-321790b45d82",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 26 accounts operated from Pakistan that targeted the Pakistani and Indian diasporas globally",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Pakistan (\"We assess that this network operated from Pakistan\"). Targets as stated: Pakistan, India. Counts: 26 accounts, 31,880 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-36c2235e03",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-36c2235e03"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 26,
"followers": 31880
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7279514d-6819-5eb8-9e60-2085ec6d03eb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 22 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Japan. Counts: 22 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-00580c67e6",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-00580c67e6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 22
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--72a14e2a-9370-5ccf-99b9-f75a812f01f2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 52 YouTube channels terminated, linked to India (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: India (\"linked to India\"). Counts: 52 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cff2794556",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cff2794556"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 52
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7395de65-e37c-5f8a-9846-9333f98c36f0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 34 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 34 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4b373d817f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4b373d817f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 34
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--748d6353-860e-5951-9acb-f95abf942fa9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 628 YouTube channels terminated, linked to India (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: India (\"linked to India\"). Counts: 628 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a37621c077",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a37621c077"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 628
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--74dd4414-cc05-5f31-9078-5515c0eaf6aa",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 28 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Argentina, Spain, United States of America. Counts: 28 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1df89769f1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1df89769f1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 28
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7520889b-d375-5647-bbc2-c6c26d067c3c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 34 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Peru. Counts: 34 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-830fa6e216",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-830fa6e216"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 34
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--765194d7-2360-5a49-a1e6-ca13cf859b5c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 35 YouTube channels terminated, linked to Hong Kong (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Hong Kong (\"linked to Hong Kong\"). Countries named in the publisher's description: United States of America, Ukraine, China. Counts: 35 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-df1cc4d930",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-df1cc4d930"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Hong Kong",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 35
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--76cd6da8-e358-5d67-b799-37af8fd385b9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 domain blocked from Google News and Discover, linked to Russia (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-85390df887",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-85390df887"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--76cec045-9f0a-57af-a9f0-6640455f4c44",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 107 accounts operated from Hungary that targeted a Hungarian audience",
"description": "TikTok reports disrupting this network (2026-02). Origin as TikTok states it: Hungary (\"We assess that this network operated from Hungary\"). Targets as stated: Hungary. Counts: 107 accounts, 37,070 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-761b9151bb",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-761b9151bb"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Hungary",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"accounts": 107,
"followers": 37070
},
"x_tic_disarm_basis": {
"T0085.001": "mapped",
"T0086.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--784b45b2-4ca1-5d96-a490-1db3565762c0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Russia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1af17be768",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1af17be768"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--78b8ec0a-39e7-5413-97fa-8493b2a288fb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 37 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 37 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7e711c220f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7e711c220f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 37
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--78cdb621-e5ce-5eff-8b6e-1e88f5a13efa",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Iran (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Afghanistan. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-728c60a2e5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-728c60a2e5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7936b64c-c041-5bf1-975e-16a5b290130d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 34 YouTube channels terminated, linked to India (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: India (\"linked to India\"). Counts: 34 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2c54562812",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2c54562812"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 34
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--794940be-8e56-5de4-8d47-f1178d2ca844",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 992 YouTube channels terminated, linked to India (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: India (\"linked to India\"). Counts: 992 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f84df4094f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f84df4094f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 992
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7950f540-0cdf-5a71-8ffb-90b962227220",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Thailand. Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-390b8905a7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-390b8905a7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 21
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7a4b7fde-d889-54dd-8127-e33e04024032",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 81 YouTube channels terminated, linked to India (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: India (\"linked to India-based actors\"). Counts: 81 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ae49929207",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ae49929207"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India-based actors",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 81
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7ad2d38f-4849-576c-a467-f9ccd31cee66",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 domain blocked from Google News and Discover, linked to Morocco (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Morocco (\"linked to Morocco\"). Countries named in the publisher's description: Algeria. Counts: 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3c3db3a945",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3c3db3a945"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Morocco",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7b335bb6-1bb6-5839-a592-d349adec8b96",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:38.000Z",
"modified": "2026-05-19T11:52:38.000Z",
"name": "Moldova-Based Influence Operation Network Targeting Moldova",
"description": "Meta reports disrupting this network (H2 2025). Origin as Meta states it: Moldova. Targets as stated: Moldova. Counts: 15 Facebook accounts, 6 Pages, 7 Groups, 4 Instagram accounts, 6,300 followers. Meta lists 8 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2025-moldova-based-cib-network.md",
"description": "Meta Adversarial Threat Report H2 2025"
},
{
"source_name": "undertow",
"external_id": "UT-META-d4c173f935",
"url": "https://undertow.theintelligence.company/#UT-META-d4c173f935"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2025",
"x_tic_counts": {
"facebook_accounts": 15,
"pages": 6,
"groups": 7,
"instagram_accounts": 4,
"followers": 6300,
"indicators": 8
},
"x_tic_disarm_basis": {
"T0119.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7b83dfd9-5429-576a-8b35-6d28ffd41b3a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 5 YouTube channels and 15 domains blocked from Google News and Discover terminated, linked to Iran (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 5 YouTube channels, 15 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-af2bce4782",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-af2bce4782"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 5,
"news_discover_domains": 15
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7b8495bf-efbf-53f6-ac1e-761a1372d238",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 89 YouTube channels terminated, linked to Japan (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Japan (\"linked to Japan\"). Countries named in the publisher's description: Ukraine, Iran, Russia. Counts: 89 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d9c15db77c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d9c15db77c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Japan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 89
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7bbd0046-9476-513c-9626-6f395d35b99d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 52 YouTube channels terminated, linked to Pakistan (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Pakistan (\"linked to Pakistan-based actors\"). Countries named in the publisher's description: Palestine, Israel, United States of America. Counts: 52 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ded766c365",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ded766c365"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan-based actors",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 52
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7bcd0c89-09c3-5bc0-b3fd-028407474d88",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 180 YouTube channels terminated, linked to United States of America (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: United States of America (\"linked to United States\"). Counts: 180 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f01fb904ef",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f01fb904ef"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 180
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7d62e734-c557-5b0b-bedd-b47fa34d8264",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 4 YouTube channels terminated, linked to Iran (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel. Counts: 4 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-455e6da927",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-455e6da927"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7df6d402-a5d0-5008-ba7f-e1d4be0bc07b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 24 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Turkey. Counts: 24 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5c20659a01",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5c20659a01"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 24
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--7eb37e4e-4c61-568a-ad65-2610945a467d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:09.000Z",
"modified": "2026-05-18T14:40:09.000Z",
"name": "Deep Dive: Dissecting the Kill Chain of an Early-Stage Iranian Influence Operation",
"description": "Meta reports disrupting this network (H1 2026). Origin as Meta states it: Iran (\"originated in Iran and primarily targeted English-speaking audiences in the United States\"). Targets as stated: United States of America, Iraq. Counts: 8 Facebook accounts, 2 Pages, 294 Instagram accounts, 15 followers. Meta lists 4 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h1-2026-iran-based-cib-network-1.md",
"description": "Meta Adversarial Threat Report H1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-84045579c1",
"url": "https://undertow.theintelligence.company/#UT-META-84045579c1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originated in Iran and primarily targeted English-speaking audiences in the United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H1 2026",
"x_tic_counts": {
"facebook_accounts": 8,
"pages": 2,
"instagram_accounts": 294,
"followers": 15,
"indicators": 4
},
"x_tic_disarm_basis": {
"T0086.002": "mapped",
"T0116.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8086d2f9-75a8-58a7-b73e-402354770117",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 10 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Japan. Counts: 10 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e64e36fdcb",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e64e36fdcb"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 10
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--814c80f7-a5e9-5c33-9f40-7dc4a99e9d0f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 45 YouTube channels terminated, linked to Denmark (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Denmark (\"linked to Denmark\"). Countries named in the publisher's description: Russia, United States of America. Counts: 45 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2f2d76b175",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2f2d76b175"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Denmark",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 45
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8182853f-fc46-5f77-8dd2-4296567eacd2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 11 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 11 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-004436c09b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-004436c09b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 11
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--81af31cb-4fd3-5e51-bc28-a5ee297ce3e0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 108 YouTube channels terminated, linked to India (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: India (\"linked to India\"). Counts: 108 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8a04884096",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8a04884096"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 108
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--830831b4-6799-5ae0-a077-ddfeb79aebef",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 8 YouTube channels and 6 domains blocked from Google News and Discover terminated, linked to Israel (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Israel (\"linked to Israel\"). Countries named in the publisher's description: Iran, Palestine. Counts: 8 YouTube channels, 6 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5bc7efcd9b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5bc7efcd9b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Israel",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 8,
"news_discover_domains": 6
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--83feb463-c342-5c93-972f-f3e869671482",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:42.000Z",
"modified": "2026-08-27T09:09:42.000Z",
"name": "Deep Dive: Beyond Brute Force—Doppelganger’s Changing Operations",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Russia. Targets as stated: France, Germany, Hungary. Meta lists 14 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-russia-cib-based-network-4.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-27d0708765",
"url": "https://undertow.theintelligence.company/#UT-META-27d0708765"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "high",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"indicators": 14
},
"x_tic_disarm_basis": {
"T0119.002": "mapped"
},
"confidence": 50
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8445c1c7-18fe-57e5-b018-98ec4c3f18ab",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 70 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Japan. Counts: 70 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1a54990e74",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1a54990e74"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 70
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--84c01a27-7b10-5318-9598-7b2d6fe73f5b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 150 YouTube channels and 1 Ads account terminated, linked to Pakistan (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Countries named in the publisher's description: India. Counts: 150 YouTube channels, 1 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a3c971e9af",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a3c971e9af"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 150,
"ads_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--850d0cbc-f049-5053-a2c7-bcb3277bdc85",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to China (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: Philippines. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-228288e6c9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-228288e6c9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--87fdeca7-e56f-54da-b4fa-662137552141",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 7 YouTube channels terminated, linked to Poland (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Poland (\"linked to Poland\"). Countries named in the publisher's description: Iran, Russia, Israel, Ukraine, United States of America. Counts: 7 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-256f6c1352",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-256f6c1352"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Poland",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 7
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8830144c-c6d1-5e8e-bd2b-4ccecff3a7c0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:43.000Z",
"modified": "2026-05-19T11:52:43.000Z",
"name": "Russian Use of Authentic Operators in SSA",
"description": "Meta reports disrupting this network (H2 2025). Origin as Meta states it: Russia. Targets as stated: Sub-Saharan Africa. Meta lists 5 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2025-russia-based-cib-network-2.md",
"description": "Meta Adversarial Threat Report H2 2025"
},
{
"source_name": "undertow",
"external_id": "UT-META-d499c2a47b",
"url": "https://undertow.theintelligence.company/#UT-META-d499c2a47b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2025",
"x_tic_counts": {
"indicators": 5
},
"x_tic_disarm_basis": {
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--885c8a1c-c2e6-5689-9477-9acf6c41aa57",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 16 accounts operated from Colombia that targeted a Colombian audience",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Colombia (\"We assessed that this network operated from Colombia\"). Targets as stated: Colombia. Counts: 16 accounts, 22,773 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-26c8f57e8a",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-26c8f57e8a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assessed that this network operated from Colombia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 16,
"followers": 22773
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--889e0d0a-a93a-5aa4-b31f-edf29f2091d4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 3 YouTube channels and 1 Ads account terminated, linked to China (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America. Counts: 3 YouTube channels, 1 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0d4512f10e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0d4512f10e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 3,
"ads_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8ab087ee-6b93-522c-b55f-6122995b633b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 37 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 37 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e11bea0ad2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e11bea0ad2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 37
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8b655e96-6a26-5321-a578-84d0e700e1eb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 7 YouTube channels terminated, linked to Armenia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Armenia (\"linked to Armenia\"). Countries named in the publisher's description: Russia. Counts: 7 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f3df9d2115",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f3df9d2115"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Armenia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 7
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8b6f9871-2991-586e-a4ba-8613487aa6d1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 103 YouTube channels terminated, linked to India (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: India (\"linked to India\"). Counts: 103 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-599325820c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-599325820c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 103
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8beeb6ff-6aa2-5e20-a038-57758af2f328",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 Google Play account banned, linked to China (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America, Taiwan. Counts: 1 Play accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b352ba7ad2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b352ba7ad2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"play_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8c284afc-2c67-5eed-911d-4e4f63f3d09e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 10,134 YouTube channels terminated, linked to Indonesia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Indonesia (\"linked to Indonesia\"). Counts: 10,134 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-fbf2407eeb",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-fbf2407eeb"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Indonesia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 10134
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8c47b602-60d0-514f-bbef-e1b22a743430",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 74 YouTube channels terminated, linked to Hungary (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Hungary (\"linked to Hungary\"). Counts: 74 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-49f147d476",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-49f147d476"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Hungary",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 74
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8c5fed14-97af-5c33-a0c9-c09a81bbbb9e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 310 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 310 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ac083c0558",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ac083c0558"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 310
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8c9b5d0d-1b00-5cb5-bf56-3152a7735a96",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 436 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 436 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b8ac716b18",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b8ac716b18"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 436
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8cfe82a4-f272-5e3d-8f03-5aec0335d961",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine, United States of America. Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-552bb04391",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-552bb04391"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 25
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8d49a139-8e16-5a7a-be1a-6e82672c6061",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Belarus (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Belarus (\"linked to Belarus\"). Countries named in the publisher's description: Ukraine. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5537507962",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5537507962"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Belarus",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8d533773-30f4-586e-809d-d17190065133",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 28 YouTube channels terminated, linked to Russia (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Hungary. Counts: 28 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e222fb49dd",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e222fb49dd"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 28
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8d916bb2-630c-5c6c-bd91-5e0108cb055f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 19 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, United States of America. Counts: 19 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-972eea3fa3",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-972eea3fa3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 19
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8d969f9c-4ca7-53c8-ae28-09b1e8457995",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 2,350 YouTube channels terminated, linked to Indonesia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Indonesia (\"linked to Indonesia\"). Counts: 2,350 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-48972c8d80",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-48972c8d80"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Indonesia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 2350
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8ea2cf15-447d-5fa0-b16f-6c9583511f73",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 37 YouTube channels terminated, no country named (2026-02)",
"description": "Google reports terminating this campaign (2026-02). No origin stated. Countries named in the publisher's description: Brazil. Counts: 37 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1d7c32c8c7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1d7c32c8c7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 37
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8ebd5a82-4a24-5f71-bae5-a1b75e9b2ec2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Russia (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-003c2221c2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-003c2221c2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8ecd8e1b-f3a3-59a8-aee8-63d2685cf19a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 23 YouTube channels terminated, linked to Russia (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 23 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-eb0b834510",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-eb0b834510"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 23
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8ed1d456-17bc-5a8e-bc44-c7beb06455f2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-baee893d2a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-baee893d2a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 25
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8ededc09-af87-509e-bb37-cfe188d654c8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 7 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: China, Iran, Israel. Counts: 7 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-26f492f126",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-26f492f126"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 7
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--8f31493a-3cf1-5bcf-8627-0b714a8b8dd1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 52 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 52 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c09f24d8dc",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c09f24d8dc"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 52
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9078eb70-433b-5f24-8da2-170d8f75ecef",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, France. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c53328b8c6",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c53328b8c6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--909acfdc-ad08-5692-907b-8593825245ea",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 49 YouTube channels terminated, linked to India (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: India (\"linked to India\"). Counts: 49 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-96e0a64c26",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-96e0a64c26"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 49
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--90b38da1-626e-5a86-8914-be1679afbc11",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 53 accounts operated from Ukraine that targeted a Russian audience",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). Origin as TikTok states it: Ukraine (\"We assess that this network operated from Ukraine\"). Targets as stated: Russia. Counts: 53 accounts, 114,830 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-4bc557f369",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-4bc557f369"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Ukraine",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 53,
"followers": 114830
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--90f740da-2a51-52fc-a922-4a298491a33e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ba948c0d17",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ba948c0d17"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--92e666b0-1271-5652-a030-27147369851f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 216 YouTube channels terminated, linked to Azerbaijan (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 216 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d72c73b2e5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d72c73b2e5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 216
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9437a1aa-cc58-591c-8d46-5d9b1d78021b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 71 YouTube channels terminated, no country named (2026-01)",
"description": "Google reports terminating this campaign (2026-01). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 71 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7c0e11303a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7c0e11303a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 71
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9536187e-55d8-5854-9a4f-c82fb8150890",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 17 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 17 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1a047ae41b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1a047ae41b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 17
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--967d688e-6caf-5968-9587-84bb1f73b05f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"name": "Sponsored Discontent",
"description": "OpenAI reports disrupting this network (2025-02). Origin as OpenAI states it: China (\"likely China-origin\"). Countries named in the publisher's description: Spain. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-sponsored-discontent",
"description": "OpenAI threat reporting, 2025-02-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-6cf735f121",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-6cf735f121"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "likely China-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-02",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9794a326-99c6-51e5-889e-7911b5e2a92b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 6 YouTube channels terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 6 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-307f21a363",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-307f21a363"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 6
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--97dc979b-333e-5a70-aa34-6b647fcf7b39",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 24 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Japan. Counts: 24 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-00ffbacd69",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-00ffbacd69"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 24
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--982be462-0bed-5a98-a69b-8cb1a3cbb182",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 26 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Counts: 26 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-eb4d36e7d2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-eb4d36e7d2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 26
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9855f44e-e138-58b9-876d-21019adf6e85",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:40.000Z",
"modified": "2026-05-19T11:52:40.000Z",
"name": "Poland-Based Influence Operation Network Targeting Poland",
"description": "Meta reports disrupting this network (H2 2025). Origin as Meta states it: Poland (\"based in Poland\"). Targets as stated: Poland. Counts: 55 Facebook accounts, 36 Pages, 23 Groups, 1 Instagram accounts, 49,000 followers. Meta lists 0 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2025-poland-based-cib-network.md",
"description": "Meta Adversarial Threat Report H2 2025"
},
{
"source_name": "undertow",
"external_id": "UT-META-bf3ff5892f",
"url": "https://undertow.theintelligence.company/#UT-META-bf3ff5892f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "based in Poland",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2025",
"x_tic_counts": {
"facebook_accounts": 55,
"pages": 36,
"groups": 23,
"instagram_accounts": 1,
"followers": 49000,
"indicators": 0
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9a703a7d-1c2b-5fd9-b8f3-73a5c15daaff",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 39 YouTube channels terminated, linked to Serbia (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Serbia (\"linked to Serbia\"). Counts: 39 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-015a10946e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-015a10946e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Serbia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 39
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9b34450f-1387-5916-bd01-65c7025b97f8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 545 YouTube channels terminated, linked to India (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: India (\"linked to India\"). Counts: 545 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-966dad3d0b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-966dad3d0b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 545
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9c79fd42-dd73-54d9-af9f-111182ace1cb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 7 YouTube channels terminated, linked to Iran (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 7 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3f1a813fc5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3f1a813fc5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 7
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--9e93f690-2c32-554d-a7a4-1f75ca29c606",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8f94d9a4a1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8f94d9a4a1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 25
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a165671a-d648-503e-91d9-464184e2f1fe",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1 Ads account terminated, linked to Kenya (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Kenya (\"linked to Kenya\"). Countries named in the publisher's description: Somalia, Ethiopia. Counts: 1 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3ef383efc2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3ef383efc2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Kenya",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"ads_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a1839976-d703-523c-9ffd-a2621f736f45",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"name": "Cyber Special Operations",
"description": "OpenAI reports disrupting this network (2026-02). Origin as OpenAI states it: China (\"China-linked\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-special-operations",
"description": "OpenAI threat reporting, 2026-02-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-dc22466567",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-dc22466567"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "China-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a200330c-b1dc-5b7e-bd29-3aceae271bc8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1 domain blocked from Google News and Discover and 1 Google Play account blocked, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: France. Counts: 1 domains blocked from Google News and Discover, 1 Play accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f0b11aefcc",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f0b11aefcc"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"news_discover_domains": 1,
"play_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a2657c9c-f52f-5b7f-81b1-2c36f51f442d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 505 YouTube channels terminated, linked to Russia (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 505 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f8ab664a55",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f8ab664a55"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 505
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a2ca4610-8bbd-5246-a218-03cd8cd82239",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"name": "STORM-2035",
"description": "OpenAI reports disrupting this network (2024-10). Origin as OpenAI states it: Iran (\"Iran-origin\"). Countries named in the publisher's description: United States of America, United Kingdom. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-storm-2035-2024",
"description": "OpenAI threat reporting, 2024-10-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-58935ce0d7",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-58935ce0d7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Iran-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2024-10",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "Operation Overload",
"description": "The EEAS names Operation Overload among the Information Manipulation Sets active in 2025 (report p. 28). No origin attributed; the publisher calls it aligned with Russia. Targets as stated: Poland, Romania, Armenia, Moldova, France, Germany, Ukraine. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-7be5a8dca2",
"url": "https://undertow.theintelligence.company/#UT-EEAS-7be5a8dca2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Also known as Matryoshka, this non-attributed but Russia-aligned IMS",
"x_tic_origin_level_stated": "none",
"x_tic_alignment": [
"RU"
],
"x_tic_period": "2025",
"x_tic_counts": {
"videos_2025": 700,
"videos_per_day_peak": 20
},
"x_tic_disarm_basis": {
"T0143.003": "mapped",
"T0087.001": "mapped"
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a3717f80-81cb-55a0-aa23-49131910567f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 147 YouTube channels terminated, linked to China (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: Canada. Counts: 147 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1444e90f2b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1444e90f2b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 147
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a3a0105a-a28c-5091-8f86-e9bab2c597e1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"name": "OpenAI: Covert influence operation: Ghana election activity",
"description": "OpenAI reports disrupting this network (2025-02). No origin stated. Countries named in the publisher's description: Ghana. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-ghana-election",
"description": "OpenAI threat reporting, 2025-02-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-19b1bbebf1",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-19b1bbebf1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2025-02",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a3e1808d-98fe-50b1-af07-dfc31cf52c02",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 78 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 78 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6fb0cd59de",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6fb0cd59de"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 78
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a4987d5c-e8c9-59dc-b2e6-0e33b658c1af",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 6 YouTube channels and 11 Blogger blogs terminated, linked to China (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America. Counts: 6 YouTube channels, 11 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-27cec30103",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-27cec30103"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 6,
"blogger_blogs": 11
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"name": "France and Spain-Based Influence Operation Targeting Sub-Saharan Africa",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: France, Spain (\"originating in France and Spain\"). Targets as stated: France, Mali, Chad, Democratic Republic of the Congo, Senegal, Cameroon, Burkina Faso, Côte d'Ivoire. Counts: 8 Facebook accounts, 24 Pages, 6 Instagram accounts, 184,200 followers. Meta lists 0 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-france-and-spain-cib-based-network.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-651bd76b68",
"url": "https://undertow.theintelligence.company/#UT-META-651bd76b68"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in France and Spain",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 8,
"pages": 24,
"instagram_accounts": 6,
"followers": 184200,
"indicators": 0
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a66c42a2-61e9-5e10-ae9b-d04cc6855658",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 16 YouTube channels terminated, linked to Iran (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Palestine, Israel, United States of America. Counts: 16 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-576ba44c01",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-576ba44c01"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 16
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a6afbb10-3ac8-5133-bab3-e83393443dcc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Iran (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: United States of America. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a735c38a65",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a735c38a65"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a6cd15a4-bb74-5fbf-aa4b-6e9e4fab862b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"name": "STORM-2035",
"description": "OpenAI reports disrupting this network (2025-06). Origin as OpenAI states it: Iran (\"likely Iran-linked\"). Countries named in the publisher's description: United States of America, United Kingdom, Ireland, Venezuela. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-storm-2035-2025",
"description": "OpenAI threat reporting, 2025-06-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-c13396f0f3",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-c13396f0f3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "likely Iran-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-06",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a90a7028-83f1-587d-bbc1-625b8c00b4ba",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 Blogger blog terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: China. Counts: 1 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-df8c144b61",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-df8c144b61"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"blogger_blogs": 1
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--a98c3768-d3ab-53da-bd9a-aa146befdd08",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 2,602 YouTube channels terminated, linked to China (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: China (\"linked to PRC\"). Countries named in the publisher's description: United States of America. Counts: 2,602 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-377a55e425",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-377a55e425"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to PRC",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 2602
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--aa152686-669d-556b-84d1-0afcf42c2777",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 5 YouTube channels terminated, linked to Russia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: France, Ukraine, United States of America, Moldova. Counts: 5 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-de8449cce5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-de8449cce5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 5
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--aaf9c88e-9fef-5fc7-bacd-fb1cb4a21bd4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 10 accounts operated from United States of America that targeted a global audience",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). Origin as TikTok states it: United States of America (\"We assess that this network operated from the US\"). Targets as stated: global. Counts: 10 accounts, 57,000 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-165d1d8e4c",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-165d1d8e4c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from the US",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 10,
"followers": 57000
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ab3382a3-fda8-500e-9c6b-89ecba74b366",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-112cec61c1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-112cec61c1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ab40d9ec-1efc-51df-a1db-4c9478f95fea",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3a8e00ed77",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3a8e00ed77"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 21
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ab42cd0c-483e-57d3-9fba-8c29fb8e3da0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 90 YouTube channels terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 90 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2c227fecae",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2c227fecae"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 90
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--abbcfc43-1080-5c91-bbed-9272456a0248",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 867 YouTube channels terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 867 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-15c2b87a8c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-15c2b87a8c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 867
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--acccc183-ad58-5547-9a16-aafe3c49d5b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 341 YouTube channels terminated, linked to India (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: India (\"linked to India\"). Counts: 341 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7c707311e7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7c707311e7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 341
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ad224067-923f-5727-9f72-1379977b1b2b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, Azerbaijan, Turkey, United States of America. Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-031758e196",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-031758e196"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 25
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ad29a057-cbbf-57d9-823e-50934ab4cf9f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 43 YouTube channels terminated, linked to Venezuela (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Venezuela (\"linked to Venezuela\"). Counts: 43 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5e4540e8ca",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5e4540e8ca"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Venezuela",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 43
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--adc89117-68bb-5590-a3b8-5e125f6c500e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 45 accounts operated from Ukraine that targeted European audiences",
"description": "TikTok reports disrupting this network (2026-02). Origin as TikTok states it: Ukraine (\"We assess that this network operated from Ukraine\"). Targets as stated: European. Counts: 45 accounts, 47,114 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-2ecc6e9b6d",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-2ecc6e9b6d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Ukraine",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"accounts": 45,
"followers": 47114
},
"x_tic_disarm_basis": {
"T0097.202": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--adefa0f0-3488-51bb-8eca-71bb9ad29596",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 142 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 142 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-27c0671ad4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-27c0671ad4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 142
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ae1984a9-966d-59ca-9f74-53e144e72f8f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 34 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Mexico. Counts: 34 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5ae99e8cf2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5ae99e8cf2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 34
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ae6009e9-9c78-5e96-958a-047d2439ca8d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 44 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 44 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-68079f6753",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-68079f6753"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 44
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--af0d37c7-74f2-5f55-9e61-a4f689bbea6a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Myanmar (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Myanmar (\"linked to Myanmar\"). Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-735bc95b56",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-735bc95b56"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Myanmar",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--afb69189-8475-5c09-96a3-11a9204e2a33",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-30T10:00:00.000Z",
"modified": "2024-05-30T10:00:00.000Z",
"name": "OpenAI: Disrupting deceptive uses of AI by covert influence operations",
"description": "OpenAI reports disrupting this network (2024-05). No origin stated. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-deceptive-uses-of-ai-by-covert-influence-operations",
"description": "OpenAI threat reporting, 2024-05-30"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-91e61ea05c",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-91e61ea05c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2024-05"
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b026d544-3e64-5871-a6e6-5307441a89e4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 19 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Poland. Counts: 19 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-10575d337c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-10575d337c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 19
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b047f7cc-0e8c-5aaa-8116-9526a1a02420",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 110 YouTube channels terminated, linked to Chile (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Chile (\"linked to Chile\"). Countries named in the publisher's description: Colombia. Counts: 110 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-42d2793c12",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-42d2793c12"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Chile",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 110
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b09873d8-d3de-5662-9fb5-da049b2940c3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 239 YouTube channels terminated, linked to Ukraine (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Ukraine (\"linked to Ukraine\"). Countries named in the publisher's description: Russia. Counts: 239 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-052e482407",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-052e482407"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Ukraine",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 239
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b0b8b0d2-fee4-5025-a64d-a4f562f440e2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8dc8ec72ef",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8dc8ec72ef"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b20ca440-eb46-5ca5-946a-2ef4fe37b35b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine, United States of America. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8e39dd39ee",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8e39dd39ee"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b286193a-c652-542b-9531-898c3c677d90",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 112 YouTube channels terminated, linked to Pakistan (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Counts: 112 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e9717729c0",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e9717729c0"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 112
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b3e482e0-32b9-57e5-86d0-d8bc95d0710b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"name": "Spamouflage",
"description": "OpenAI reports disrupting this network (2024-05). Origin as OpenAI states it: China (\"China-linked\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-spamouflage",
"description": "OpenAI threat reporting, 2024-05-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-096930ea5e",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-096930ea5e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "China-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2024-05",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b515a3cd-f1a5-54cd-8644-4031b9a21ec3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 463 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 463 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5bd2594910",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5bd2594910"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 463
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b83632a5-537d-5e0d-ae82-e2cb6065d72a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 8 YouTube channels and 1 domain blocked from Google News and Discover terminated, linked to China (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: Taiwan. Counts: 8 YouTube channels, 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3bf5581a27",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3bf5581a27"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 8,
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--b90999b7-bae4-5f97-8d6f-66150b1a3574",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 80 YouTube channels terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 80 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5b572c109f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5b572c109f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 80
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ba18eb99-c6a6-51b8-84ba-ffb7e3554ef6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1,763 YouTube channels terminated, linked to China (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: China (\"linked to People’s Republic of China\"). Countries named in the publisher's description: United States of America. Counts: 1,763 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0ca647f4a8",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0ca647f4a8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to People’s Republic of China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 1763
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ba7cfe96-dd89-5184-bda9-8e4b2bc23c25",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "Doppelgänger",
"description": "The EEAS names Doppelgänger among the Information Manipulation Sets active in 2025 (report p. 28). Origin as European External Action Service (EEAS) states it: Russia (\"operated by the EU-sanctioned entities Social Design Agency (SDA) and Struktura\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-2289cdf9ba",
"url": "https://undertow.theintelligence.company/#UT-EEAS-2289cdf9ba"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "operated by the EU-sanctioned entities Social Design Agency (SDA) and Struktura",
"x_tic_origin_level_stated": "high",
"x_tic_period": "2025",
"x_tic_disarm_basis": {
"T0097.202": "mapped"
},
"confidence": 50
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--bb8115f9-a07a-56cc-af03-db306f31287b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 17 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 17 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d19c7f5140",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d19c7f5140"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 17
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--bb8b2970-1d82-5a8e-aec2-8574ea63a04b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Iran (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: United States of America. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e5ed2b14e9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e5ed2b14e9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--bba71f8c-0c64-5a7b-90d8-e210580351dc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 51 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Counts: 51 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8607f26888",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8607f26888"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 51
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--bbdc9c99-ff9b-5e5c-8d7a-ebf062dc836d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:33.000Z",
"modified": "2026-08-27T09:09:33.000Z",
"name": "Iran-Based Influence Operation Targeting Azerbaijan",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Iran (\"originating in Iran and primarily\"). Targets as stated: Azerbaijan. Counts: 15 Facebook accounts, 7 Pages, 96 Instagram accounts, 23,600 followers. Meta lists 5 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-iran-cib-based-network-2.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-d2968412b9",
"url": "https://undertow.theintelligence.company/#UT-META-d2968412b9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Iran and primarily",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 15,
"pages": 7,
"instagram_accounts": 96,
"followers": 23600,
"indicators": 5
},
"x_tic_disarm_basis": {
"T0119.002": "mapped",
"T0116.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--bd180ef6-9c16-52af-a670-b57bf0fe04e3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 14 accounts that targeted an Israeli audience",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). No origin stated. Targets as stated: Israel. Counts: 14 accounts, 12,685 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-956c9b8eac",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-956c9b8eac"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 14,
"followers": 12685
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--be5cf859-d954-57a0-8c50-243d098f32bd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 6 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Iran, Armenia, United States of America. Counts: 6 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-bbef18a489",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-bbef18a489"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 6
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--bf7fb8d1-7240-53f1-9147-4a8fd5a5bd35",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 77 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Thailand. Counts: 77 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f46bfe1217",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f46bfe1217"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 77
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c00113ee-162b-53a6-a7fc-e0334edc5a29",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 22 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Counts: 22 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4a5276c138",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4a5276c138"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 22
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c03540e4-bc5c-5d45-93b0-f364f4c4cd84",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 74 YouTube channels terminated, linked to United States of America (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: United States of America (\"linked to United States\"). Counts: 74 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d34cd77f75",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d34cd77f75"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 74
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c0b34262-b8d7-56a0-a513-f91a5dd0df19",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 31 YouTube channels terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 31 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-7f71f3bfd1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-7f71f3bfd1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 31
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c2428639-63b6-581d-a81d-9ef953e1dfeb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "Paperwall",
"description": "The EEAS names Paperwall among the Information Manipulation Sets active in 2025 (report p. 34). Origin as European External Action Service (EEAS) states it: China (\"These Chinese state-aligned IMS ... leveraged by the public relations firm Haimai\"). Targets as stated: Australia, Africa, the Middle East, Southeast Asia. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en",
"description": "4th EEAS Report on Foreign Information Manipulation and Interference Threats"
},
{
"source_name": "undertow",
"external_id": "UT-EEAS-e7ebbf0d02",
"url": "https://undertow.theintelligence.company/#UT-EEAS-e7ebbf0d02"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "These Chinese state-aligned IMS ... leveraged by the public relations firm Haimai",
"x_tic_origin_level_stated": "high",
"x_tic_alignment": [
"CN"
],
"x_tic_period": "2025",
"x_tic_counts": {
"additional_domains": 108,
"new_countries": 40,
"new_languages": 15
},
"x_tic_disarm_basis": {
"T0098.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c33ed9ff-760f-55e5-8d8f-266927469b36",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 57 YouTube channels terminated, no country named (2026-01)",
"description": "Google reports terminating this campaign (2026-01). No origin stated. Countries named in the publisher's description: Bangladesh, India. Counts: 57 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-32aeb3d134",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-32aeb3d134"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 57
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c5e91a3f-74bc-59e4-b5be-3457cb16a2b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-bffcc7eaf2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-bffcc7eaf2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c62ab781-082a-5623-a497-0b2cc2baa4d3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Iran (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Palestine, Israel. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0d411a3903",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0d411a3903"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c69a38f3-7826-50d8-bbeb-24cc8c1f4f66",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 37 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: Japan. Counts: 37 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-4d4bc4c3b6",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-4d4bc4c3b6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 37
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c6fcc5e8-6f6a-5eb6-ab97-40b0292717ec",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 157 YouTube channels terminated, linked to United States of America (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: United States of America (\"linked to United States\"). Counts: 157 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-08f6e1c2c7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-08f6e1c2c7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 157
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c7ae0cc5-c9d4-52cb-b671-814fbe76a4c6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 54 YouTube channels terminated, linked to Spain (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Spain (\"linked to Spain\"). Counts: 54 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a527461193",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a527461193"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Spain",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 54
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c8ab141a-7742-5a6b-a2b2-8f116d86f236",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 31 YouTube channels terminated, linked to India (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: India (\"linked to India\"). Counts: 31 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a0dfd047ea",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a0dfd047ea"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 31
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c8af1f11-afb3-5d3a-b913-0b2e84d9dc35",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to China (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: China (\"linked to China\"). Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-47749d9e0b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-47749d9e0b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c8beb4ee-eea1-55d6-bc07-e72dfac80023",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 91 accounts operated from Hungary that targeted a Hungarian audience",
"description": "TikTok reports disrupting this network (2026-03). Origin as TikTok states it: Hungary (\"We assess that this network operated from Hungary\"). Targets as stated: Hungary. Counts: 91 accounts, 246 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-220bee008d",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-220bee008d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Hungary",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"accounts": 91,
"followers": 246
},
"x_tic_disarm_basis": {
"T0145.007": "mapped",
"T0145.001": "mapped",
"T0143.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--c90c51a9-984b-5ddc-8435-61963449dff2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1 Ads account terminated, linked to China (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: China (\"linked to China\"). Countries named in the publisher's description: United States of America. Counts: 1 Ads accounts. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b50d8c54c3",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b50d8c54c3"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to China",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"ads_accounts": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ca4ee82c-8832-51e5-a867-b5109bcf8c62",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c85d5c0bda",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c85d5c0bda"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--cac1ade0-72f4-5c95-96bf-4ab30310b4d0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 100 YouTube channels terminated, linked to Azerbaijan (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 100 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1885813625",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1885813625"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 100
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"name": "Updating Attribution of Persistent Iranian Influence Operation to “Endless Mayfly”",
"description": "Meta reports disrupting this network (H2 2025). Origin as Meta states it: Iran. Targets as stated: United States of America, France, Israel, United Kingdom. Meta lists 7 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2025-iran-based-cib-network.md",
"description": "Meta Adversarial Threat Report H2 2025"
},
{
"source_name": "undertow",
"external_id": "UT-META-8a141ee28c",
"url": "https://undertow.theintelligence.company/#UT-META-8a141ee28c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2025",
"x_tic_counts": {
"indicators": 7
},
"x_tic_disarm_basis": {
"T0143.003": "mapped"
},
"confidence": 50
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--cb1a4799-f5c6-5fd3-b9cc-4b87b589127f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 10 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Côte d'Ivoire. Counts: 10 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e752d5af30",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e752d5af30"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 10
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--cb39c69a-93b9-51ea-9e58-d2818880343e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 75 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Benin. Counts: 75 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-91c3baedd2",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-91c3baedd2"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 75
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--cc7db5ac-d042-5659-ac94-e6be04d30b45",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 27 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 27 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-890835c62b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-890835c62b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 27
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--cefba062-1b37-5216-b842-39403ad0ded3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"name": "Data Center Bandwagon",
"description": "OpenAI reports disrupting this network (2026-06). Origin as OpenAI states it: China (\"likely PRC-origin\"). Countries named in the publisher's description: United States of America. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-data-center-bandwagon",
"description": "OpenAI threat reporting, 2026-06-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-e316a22948",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-e316a22948"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "likely PRC-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--cfb884b6-5974-5c2e-bb5c-53f632c2e3fe",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 domains blocked from Google News and Discover, linked to Iran (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Palestine, Israel, United States of America. Counts: 2 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d01e74a7a1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d01e74a7a1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"news_discover_domains": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d00200c2-9bc6-5f65-b4b6-482a783947c4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 36 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 36 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ca609f32af",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ca609f32af"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 36
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d01a842a-55ee-524b-8cb5-edceca3fbdd4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 6 YouTube channels terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Georgia, Ukraine. Counts: 6 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-838466ee27",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-838466ee27"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 6
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d1a4ab1f-75a1-5e9f-bea7-c34716efa860",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 YouTube channels terminated, linked to Iran (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-81c89d182d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-81c89d182d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d1c0a571-fa0a-554a-be56-532a61f3a3d4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Iran (2026-04)",
"description": "Google reports terminating this campaign (2026-04). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8000fc4977",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8000fc4977"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d2b8854d-5780-5a24-9cda-cd81b5022ef2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"name": "Uncle Spam",
"description": "OpenAI reports disrupting this network (2025-06). Origin as OpenAI states it: China (\"China-origin\"). Countries named in the publisher's description: United States of America. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-uncle-spam",
"description": "OpenAI threat reporting, 2025-06-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-6dfc448ff1",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-6dfc448ff1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "China-origin",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-06",
"x_tic_disarm_basis": {
"T0085.001": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d30fd973-dc75-5d18-9b67-e7ce56e267d1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 164 YouTube channels terminated, linked to Taiwan (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Taiwan (\"linked to Taiwan\"). Countries named in the publisher's description: China. Counts: 164 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c4b79c1a58",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c4b79c1a58"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Taiwan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 164
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d3e5db65-8774-5efb-9d54-9d70ab1252f2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, linked to Pakistan (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Pakistan (\"linked to Pakistan\"). Countries named in the publisher's description: United States of America. Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cff6521192",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cff6521192"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Pakistan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 21
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d54e5983-73b5-5338-ab13-e6429b5a9832",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 106 YouTube channels terminated, linked to India (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: India (\"linked to India\"). Counts: 106 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-39ec2b2299",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-39ec2b2299"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 106
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d5a7ebd1-8f7a-5eab-9f80-519b014443f0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:03.000Z",
"modified": "2026-05-18T14:40:03.000Z",
"name": "Russia-Based Influence Operation Network Targeting Eastern Europe",
"description": "Meta reports disrupting this network (H1 2026). Origin as Meta states it: Russia (\"originating in Russia that targeted audiences in approximately 20 countries\"). Targets as stated: Eastern Europe. Counts: 52 Facebook accounts, 134 Pages, 35 Instagram accounts, 238,000 followers. Meta lists 0 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h1-2026-russia-based-cib-network-2.md",
"description": "Meta Adversarial Threat Report H1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-1da3c42858",
"url": "https://undertow.theintelligence.company/#UT-META-1da3c42858"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Russia that targeted audiences in approximately 20 countries",
"x_tic_origin_level_stated": "high",
"x_tic_period": "H1 2026",
"x_tic_counts": {
"facebook_accounts": 52,
"pages": 134,
"instagram_accounts": 35,
"followers": 238000,
"indicators": 0
},
"x_tic_disarm_basis": {
"T0119.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d5e55889-716a-5a7c-87ab-4c974c3db1b2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 78 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 78 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-dce4681511",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-dce4681511"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 78
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d62f7c1a-1179-579e-9b8f-234e9e2227fe",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 598 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 598 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6f1028857d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6f1028857d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 598
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d6c187f3-3cab-506f-8fdc-095ef21a21e7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 74 YouTube channels and 1 Blogger blog terminated, linked to United States of America (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: United States of America (\"linked to United States\"). Counts: 74 YouTube channels, 1 Blogger blogs. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-15f8193854",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-15f8193854"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 74,
"blogger_blogs": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d71f2309-c4e6-5855-8098-ece7bf841029",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 5 accounts operated from Iran that targeted an American and Israeli audience",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Iran (\"Network Origin: Iran\"). Targets as stated: United States of America, Israel. Counts: 5 accounts, 401 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-766d2e1e83",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-766d2e1e83"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Network Origin: Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 5,
"followers": 401
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d7948137-1dc7-5fc1-9a8e-8851c35d4338",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 92 YouTube channels terminated, linked to India (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: India (\"linked to an India-based actor\"). Counts: 92 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8cf4735c28",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8cf4735c28"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to an India-based actor",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 92
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--d80544ca-c265-529f-87b5-30d6c2181fdd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"name": "OpenAI: PRC-linked abuse: Surveillance and influence activity",
"description": "OpenAI reports disrupting this network (2025-10). Origin as OpenAI states it: China (\"PRC-linked\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-prc-linked-abuse",
"description": "OpenAI threat reporting, 2025-10-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-c415498189",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-c415498189"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "PRC-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-10",
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--dc3a6df0-3953-52ef-8eed-ce7d43fa0870",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 15 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Philippines. Counts: 15 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-089be3d2a0",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-089be3d2a0"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 15
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--dc9262d2-2851-592c-b79d-92d0ce899519",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f87f442a70",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f87f442a70"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--dcd786f5-712a-5a52-9c92-60143faaa85e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 2 domains blocked from Google News and Discover, linked to Morocco (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Morocco (\"linked to Morocco\"). Countries named in the publisher's description: Algeria. Counts: 2 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b0ab3a958f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b0ab3a958f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Morocco",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"news_discover_domains": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--dd581ffc-088a-5b61-b8f8-17ca8e9d3b30",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 domain blocked from Google News and Discover, linked to Iran (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Iran (\"linked to Iran\"). Counts: 1 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e60b8c091d",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e60b8c091d"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"news_discover_domains": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ddd2d9e8-931e-5b6d-a599-7c4419f910c8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 11 YouTube channels terminated, linked to Iran (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 11 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c88430d8a9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c88430d8a9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 11
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--deb02afa-2f53-565a-9249-b22dedf8fe5c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 123 YouTube channels terminated, linked to Armenia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Armenia (\"linked to Armenia\"). Counts: 123 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-9469806688",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-9469806688"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Armenia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 123
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--df08c384-1475-502a-a2ad-9b016752499b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 27 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Ukraine. Counts: 27 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-6ba9cfa775",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-6ba9cfa775"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 27
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--df27dd13-1805-54e8-8ac8-9a8af811e1e6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 46 YouTube channels terminated, linked to United States of America (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: United States of America (\"linked to United States\"). Countries named in the publisher's description: Israel. Counts: 46 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-369dbc2bbd",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-369dbc2bbd"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 46
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e028fc68-7a99-5cf2-b235-31082d6516a3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 22 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Counts: 22 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d659fb6a24",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d659fb6a24"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 22
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e09ae2a5-af83-56a1-8297-55022de55013",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Israel (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Israel (\"linked to Israel\"). Countries named in the publisher's description: Spain, Palestine, Qatar. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ef98113e72",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ef98113e72"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Israel",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e18836df-b3f2-55be-9f7c-80e06032685d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 45 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: China. Counts: 45 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cc9d18de58",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cc9d18de58"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 45
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e1f6348c-7681-5766-b9ac-6859ecd4ed45",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 54 YouTube channels terminated, linked to India (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: India (\"linked to India\"). Counts: 54 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a6a33b9dee",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a6a33b9dee"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 54
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e2e234d3-3651-5d14-a6d0-c8537eac5a75",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 38 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Spain. Counts: 38 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1cbb0ace96",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1cbb0ace96"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 38
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e2e78893-3ac5-51d5-a1bb-fa86f8b9a50a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 224 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 224 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-5835bd9a29",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-5835bd9a29"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 224
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e4b7e110-e480-5876-b934-b647619dabd1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 16 accounts operated from Belarus that targeted a Russian-speaking audience within Ukraine",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). Origin as TikTok states it: Belarus (\"We assess that this network operated from Belarus\"). Targets as stated: Ukraine. Counts: 16 accounts, 37,680 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-dc9c71aced",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-dc9c71aced"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Belarus",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 16,
"followers": 37680
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e5570b7c-4a18-555b-bdef-4a5122ad7274",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 302 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Indonesia. Counts: 302 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-8d39490f3b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-8d39490f3b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 302
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e5990cf5-ff4c-549c-934b-892f634c7386",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 975 YouTube channels terminated, linked to Azerbaijan (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 975 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-63f0c00de0",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-63f0c00de0"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 975
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e7115b92-ef60-51ba-a7e7-78a64f774656",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 28 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Venezuela. Counts: 28 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cfb6cb2bd7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cfb6cb2bd7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 28
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e75dc771-0fe6-517f-becf-fc8d83f2f84f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 49 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: South Africa. Counts: 49 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e1ad78838b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e1ad78838b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 49
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e78aa57c-e247-5e3f-a5d4-8605a8e68f6e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 20 YouTube channels terminated, linked to Russia (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 20 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a74cbb630b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a74cbb630b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 20
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e8718c8d-4337-5ddd-a5fe-996952c5f5c4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 18 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: Colombia. Counts: 18 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b7d02509d5",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b7d02509d5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 18
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--e8bf6d43-442e-5d7d-96ea-1ea7231f8eef",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 15 YouTube channels terminated, linked to Brazil (2026-02)",
"description": "Google reports terminating this campaign (2026-02). Origin as Google states it: Brazil (\"linked to Brazil\"). Counts: 15 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1ba483096e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1ba483096e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Brazil",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-02",
"x_tic_counts": {
"youtube_channels": 15
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ea1f7502-8c62-5154-9368-864ba0b2080e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 47 accounts operated from France that targeted audiences in Armenia and Azerbaijan",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: France (\"We assess that this network operated from France\"). Targets as stated: Armenia, Azerbaijan. Counts: 47 accounts, 7,281 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-264e545fa5",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-264e545fa5"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from France",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 47,
"followers": 7281
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ea335bfb-bd03-5cfa-a011-385c1b19072b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 85 YouTube channels terminated, linked to Azerbaijan (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Azerbaijan (\"linked to Azerbaijan\"). Countries named in the publisher's description: Armenia. Counts: 85 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-451425e840",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-451425e840"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Azerbaijan",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 85
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--eaa61271-90b3-5bbd-9421-42f3cb0c48e1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 22 accounts operated from Iran that targeted Israeli and Palestinian audiences",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). Origin as TikTok states it: Iran (\"We assess that this network operated from Iran\"). Targets as stated: Israel, Palestine. Counts: 22 accounts, 15,061 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-73cc6961b9",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-73cc6961b9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 22,
"followers": 15061
},
"x_tic_disarm_basis": {
"T0097.202": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--eaace7ae-d136-5a81-89cd-71d650bce75f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 34 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova, Ukraine. Counts: 34 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-07fe849bf7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-07fe849bf7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 34
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--eb31fbb0-39b6-51d9-a28b-a2a0ba838a20",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok removed a network of 27 accounts operated from Ukraine that targeted a Russian audience",
"description": "TikTok reports disrupting this network (2026-01 to 2026-06). Origin as TikTok states it: Ukraine (\"We assessed that this network operated from Ukraine\"). Targets as stated: Russia. Counts: 27 accounts, 60,918 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9",
"description": "TikTok, Code of Conduct on Disinformation report: September 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-46e993beab",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-46e993beab"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assessed that this network operated from Ukraine",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01 to 2026-06",
"x_tic_counts": {
"accounts": 27,
"followers": 60918
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ebaf6874-607f-5842-bf7f-0223331a77f2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 2 Ads accounts, 2 Blogger blogs and 2 YouTube channels terminated, linked to Iran (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Palestine, Israel. Counts: 2 Ads accounts, 2 Blogger blogs, 2 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-993b192b7a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-993b192b7a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"ads_accounts": 2,
"blogger_blogs": 2,
"youtube_channels": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--eca3e9f9-0e96-594b-8461-b9797804385c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 13 YouTube channels terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, Ukraine, United States of America. Counts: 13 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-02f32c043f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-02f32c043f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 13
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ed137401-2f33-5ac8-9dff-d8eac46b370e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 18 YouTube channels terminated, no country named (2026-07)",
"description": "Google reports terminating this campaign (2026-07). No origin stated. Countries named in the publisher's description: France. Counts: 18 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-05bcb721c1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-05bcb721c1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 18
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ed94f134-53dc-5b9d-bf2c-dc2a16b040b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 32 YouTube channels terminated, linked to Russia (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, Ukraine, United States of America. Counts: 32 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0ff0742451",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0ff0742451"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 32
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--edafa58f-3d89-5729-b2b2-8d951a79cecc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok removed a network of 35 accounts operated from Ukraine that targeted a Russian audience",
"description": "TikTok reports disrupting this network (2025-07 to 2025-12). Origin as TikTok states it: Ukraine (\"We assess that this network operated from Ukraine\"). Targets as stated: Russia. Counts: 35 accounts, 1,184,387 followers. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8",
"description": "TikTok, Code of Conduct on Disinformation report: March 2026"
},
{
"source_name": "undertow",
"external_id": "UT-TIKTOK-dca4045af1",
"url": "https://undertow.theintelligence.company/#UT-TIKTOK-dca4045af1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "We assess that this network operated from Ukraine",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2025-07 to 2025-12",
"x_tic_counts": {
"accounts": 35,
"followers": 1184387
},
"x_tic_disarm_basis": {
"T0097.202": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ee0984bb-a1b1-5d5f-85a6-5397ad7206b7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 53 YouTube channels terminated, linked to Russia (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Armenia, Moldova, Poland, Ukraine, United States of America. Counts: 53 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-a5088fef84",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-a5088fef84"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 53
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ee5b8b09-783a-54ca-ba76-8b8332dd49f2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 88 YouTube channels terminated, linked to United States of America (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: United States of America (\"linked to United States\"). Counts: 88 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-be80a1c78c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-be80a1c78c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United States",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 88
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ef08211d-194d-5e0f-8f73-03a6535ff05c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 4 YouTube channels terminated, linked to Russia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: France, Tunisia. Counts: 4 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0711f08d43",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0711f08d43"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 4
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f0913e3e-4a6b-59b8-9cc0-443eb508fbde",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 34 YouTube channels terminated, linked to India (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: India (\"linked to India\"). Counts: 34 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-1da6022790",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-1da6022790"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 34
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f172a157-80d7-5379-9694-27f16dc1f59d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 88 YouTube channels terminated, linked to India (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: India (\"linked to India\"). Counts: 88 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-efead7609a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-efead7609a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to India",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 88
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f1d5026c-7bb2-5ae5-8cab-2b6707656605",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 18 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Armenia. Counts: 18 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-0d840271eb",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-0d840271eb"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 18
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f220e4c7-4713-5abb-a9d4-1fbe4d3973b9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 44 YouTube channels terminated, no country named (2026-04)",
"description": "Google reports terminating this campaign (2026-04). No origin stated. Countries named in the publisher's description: Iraq. Counts: 44 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-ff9a63b0f4",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-ff9a63b0f4"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-04",
"x_tic_counts": {
"youtube_channels": 44
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f267733a-6a76-5812-916e-dbabde1cccbb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 40 YouTube channels terminated, linked to Venezuela (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Venezuela (\"linked to Venezuela\"). Counts: 40 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-e3cea8da1f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-e3cea8da1f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Venezuela",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 40
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f37f2596-e843-5067-8f65-4643093d7b93",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 31 YouTube channels terminated, linked to United Kingdom (2026-05)",
"description": "Google reports terminating this campaign (2026-05). Origin as Google states it: United Kingdom (\"linked to United Kingdom\"). Countries named in the publisher's description: Iran, United States of America. Counts: 31 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c59247a4db",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c59247a4db"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to United Kingdom",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 31
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f3f6d9d2-d4a8-5995-a20c-62ec35463404",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 106 YouTube channels terminated, linked to Russia (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 106 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-488918540c",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-488918540c"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 106
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f473192e-f929-5126-842e-1b3390c9f000",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 22 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Argentina. Counts: 22 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3d931c8849",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3d931c8849"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 22
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f5bbc44f-8238-53eb-96b6-f0037589151b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 409 YouTube channels terminated, linked to Russia (2026-09)",
"description": "Google reports terminating this campaign (2026-09). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 409 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-3916c1983a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-3916c1983a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-09",
"x_tic_counts": {
"youtube_channels": 409
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f645b673-d1a3-5c49-a216-06f24b6166b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 9 YouTube channels terminated, linked to Myanmar (2026-01)",
"description": "Google reports terminating this campaign (2026-01). Origin as Google states it: Myanmar (\"linked to Myanmar\"). Counts: 9 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-9439a5d39f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-9439a5d39f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Myanmar",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 9
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f6fc1113-7504-50fb-b8b1-76f7836f0b44",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 25 YouTube channels and 2 domains blocked from Google News and Discover terminated, linked to Switzerland (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: Switzerland (\"linked to Switzerland\"). Countries named in the publisher's description: Azerbaijan. Counts: 25 YouTube channels, 2 domains blocked from Google News and Discover. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2c810d974e",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2c810d974e"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Switzerland",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 25,
"news_discover_domains": 2
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f73558d9-46c9-501d-97f9-f26bbe1f0c88",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 3 YouTube channels terminated, linked to Russia (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine, United States of America. Counts: 3 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f83df6e798",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f83df6e798"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 3
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f88e9b12-df8c-5346-a669-6829a41e3899",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 21 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Republic of the Congo. Counts: 21 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-d7aea95a9f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-d7aea95a9f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 21
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--f8cddb9b-b725-5008-81e4-7c6317871c7b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 25 YouTube channels terminated, no country named (2026-06)",
"description": "Google reports terminating this campaign (2026-06). No origin stated. Countries named in the publisher's description: Burkina Faso. Counts: 25 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-038f9c54c7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-038f9c54c7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 25
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fa1fead0-20d4-5596-a3f9-7efa84e09cae",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 121 YouTube channels terminated, linked to France (2026-08)",
"description": "Google reports terminating this campaign (2026-08). Origin as Google states it: France (\"linked to France\"). Countries named in the publisher's description: Israel, Iran. Counts: 121 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-af5bfbee72",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-af5bfbee72"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to France",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 121
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--faf24c00-8424-595a-93bc-ab304f60a25f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Russia (2026-06)",
"description": "Google reports terminating this campaign (2026-06). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Moldova. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-9f4a350f58",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-9f4a350f58"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-06",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fb805297-becb-526c-b3d6-b2b7be59a2b0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 60 YouTube channels terminated, linked to Russia (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Russia (\"linked to Russia\"). Countries named in the publisher's description: Ukraine. Counts: 60 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-b145b647e6",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-b145b647e6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 60
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fb98b45d-8197-5f2c-88b1-e327e9a6d205",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 16 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Poland. Counts: 16 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-c74728033b",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-c74728033b"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 16
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fba28e92-ed1e-5b10-bbd5-e7459d135d48",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:39.000Z",
"modified": "2026-08-27T09:09:39.000Z",
"name": "Russia-Based Influence Operation Targeting Hungary",
"description": "Meta reports disrupting this network (H2 2026). Origin as Meta states it: Russia (\"originating in Russia\"). Targets as stated: Hungary. Counts: 6 Facebook accounts, 4 Pages, 15,200 followers. Meta lists 3 indicators; Undertow keeps the count only. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Meta",
"url": "https://github.com/meta/threat-research/blob/main/indicators/meta-h2-2026-russia-cib-based-network-3.md",
"description": "Meta Adversarial Threat Report H2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-META-44d22ff0e6",
"url": "https://undertow.theintelligence.company/#UT-META-44d22ff0e6"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "originating in Russia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "H2 2026",
"x_tic_counts": {
"facebook_accounts": 6,
"pages": 4,
"followers": 15200,
"indicators": 3
},
"x_tic_disarm_basis": {
"T0098.001": "mapped",
"T0085.001": "mapped",
"T0086.002": "mapped"
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fc30c14b-83d1-552d-8314-d8cf8cd04a20",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Iran (2026-03)",
"description": "Google reports terminating this campaign (2026-03). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-2b161575ff",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-2b161575ff"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-03",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fcb31455-7c4f-5c56-ac14-5ae155ed6a34",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"name": "Zero Zeno",
"description": "OpenAI reports disrupting this network (2024-05). Origin as OpenAI states it: Israel (\"Israel-linked\"). Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-zero-zeno",
"description": "OpenAI threat reporting, 2024-05-01"
},
{
"source_name": "undertow",
"external_id": "UT-OPENAI-1ac0674302",
"url": "https://undertow.theintelligence.company/#UT-OPENAI-1ac0674302"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "Israel-linked",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2024-05",
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fd098c21-c1cb-5abf-90ca-fd85d2d9011f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 6,888 YouTube channels terminated, linked to Indonesia (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Indonesia (\"linked to Indonesia\"). Counts: 6,888 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-fe9985db2a",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-fe9985db2a"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Indonesia",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 6888
},
"confidence": 15
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fde21c03-3f30-52e0-800f-322f5578191b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 69 YouTube channels terminated, no country named (2026-08)",
"description": "Google reports terminating this campaign (2026-08). No origin stated. Countries named in the publisher's description: Germany. Counts: 69 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-88bac2d2c7",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-88bac2d2c7"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-08",
"x_tic_counts": {
"youtube_channels": 69
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--fe5b1c6a-9801-5a66-a940-2e8771a78967",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google: 40 YouTube channels terminated, no country named (2026-01)",
"description": "Google reports terminating this campaign (2026-01). No origin stated. Counts: 40 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/",
"description": "Google Influence Operations Bulletin Q1 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-cb6d0aaec1",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-cb6d0aaec1"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-01",
"x_tic_counts": {
"youtube_channels": 40
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--feb01977-e309-5711-9f4a-6d809446bcf6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google: 29 YouTube channels terminated, no country named (2026-05)",
"description": "Google reports terminating this campaign (2026-05). No origin stated. Countries named in the publisher's description: Bangladesh. Counts: 29 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/",
"description": "Google Influence Operations Bulletin Q2 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-f9edc1b8a9",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-f9edc1b8a9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_origin_level_stated": "none",
"x_tic_period": "2026-05",
"x_tic_counts": {
"youtube_channels": 29
}
},
{
"type": "campaign",
"spec_version": "2.1",
"id": "campaign--ffb0f3ab-2d9f-5ca2-b9dc-d30341c13c19",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google: 1 YouTube channel terminated, linked to Iran (2026-07)",
"description": "Google reports terminating this campaign (2026-07). Origin as Google states it: Iran (\"linked to Iran\"). Countries named in the publisher's description: Israel, United States of America. Counts: 1 YouTube channels. Origin is where the operators were, never a finding of who directed it.",
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/",
"description": "Google Influence Operations Bulletin Q3 2026"
},
{
"source_name": "undertow",
"external_id": "UT-GOOGLE-925e7d798f",
"url": "https://undertow.theintelligence.company/#UT-GOOGLE-925e7d798f"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"x_tic_source_grade": "A2",
"x_tic_status_class": "reported",
"x_tic_attribution_wording": "linked to Iran",
"x_tic_origin_level_stated": "moderate",
"x_tic_period": "2026-07",
"x_tic_counts": {
"youtube_channels": 1
},
"confidence": 15
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "The Intelligence Company (Undertow)",
"identity_class": "organization",
"description": "Undertow: attributed influence-operation takedowns at operation level. Public, non-commercial.",
"contact_information": "https://undertow.theintelligence.company"
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.073632Z",
"modified": "2024-11-22T16:43:58.073632Z",
"name": "DISARM Foundation",
"description": "DISARM is a framework designed for describing and understanding disinformation incidents.",
"identity_class": "organization"
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--02e03f8a-de21-5ea5-b7c2-ed566d40859d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "RRN/Media Brands",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
],
"aliases": [
"RRN Media brands",
"Media Brands"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--0b140f5e-c89a-5eb3-961b-eb466a6e64b4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Paperwall",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--0bc341f2-5887-5e11-b8ee-cf73be1bdc68",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Doppelganger",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
],
"aliases": [
"Doppelgänger"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--0f66d5b4-0697-5b82-98d2-3b6b2f13021c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Cyber Special Operations",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--168f723d-64b0-581d-9873-bcf9157396c3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Nine—emdash Line",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
],
"aliases": [
"Nine-emdash Line"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--1b21142b-536c-5dec-90e5-1e73343b4299",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "HaiEnergy",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--524df0a9-1742-5d3e-9538-c7dac6beec33",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "IUVM",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--552d82c7-f319-5eb0-864f-f3712e1cd370",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Tech and Tariffs",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--765fe3fc-719b-58a5-beab-598678ddcf1d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Data Center Bandwagon",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--8dc293c8-f4f7-5b5f-b197-2c9ed120446f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Operation Overload",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
],
"aliases": [
"Matryoshka",
"Overload"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--8f83b7c1-ead2-5024-a6be-cb02351df72f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Fish Food",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--9482f58f-8fc4-5b9e-842c-f159baf92e77",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Uncle Spam",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--a5313399-16a8-5f18-aa5b-eadf6e2e2073",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Sponsored Discontent",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--b25bd9af-9285-59d8-9f0f-b89be7a655c4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Zero Zeno",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--b5fdce69-b4c6-5b00-bc0a-c4734138c1db",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Sneer Review",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--bd055bb4-ecb8-5bf6-9689-7af9b0bddcfb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "STORM-2035",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--d909dd5d-be9b-52b5-9c21-15c5ef627fb2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Portal Kombat",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
],
"aliases": [
"Pravda network"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--ec4eb979-85fd-55ee-800e-32dc1224d900",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Spamouflage",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--ef8f1e00-5db1-55fe-967d-74408ec4a102",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Storm-1516",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
],
"aliases": [
"CopyCop",
"False Façade",
"False Facade"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--f5c9ec70-e432-5751-b58a-cdb6c48e639c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Endless Mayfly",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--fc39b5ba-b9e5-5891-b322-727a5494087f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Trolling Stone",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--fce43469-60a5-55b3-8378-ac3340ab3ca6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Falsos Amigos",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
],
"aliases": [
"CGTN-linked network"
]
},
{
"type": "intrusion-set",
"spec_version": "2.1",
"id": "intrusion-set--fd46a43e-be19-54ec-92d7-29324ecb6a0c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Stop News",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
]
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--08713524-c6f5-5947-8b2a-1c4aff6c4802",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Thailand",
"country": "TH"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--08c97afe-2658-58f0-b757-c61ee4cc8e9e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Morocco",
"country": "MA"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--0ad6240a-6a8c-5e1a-9ca0-3ee577b93ab3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Kazakhstan",
"country": "KZ"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--0b0525e7-0456-5f78-9dfd-a54b131f9d5e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Senegal",
"country": "SN"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--0d222f42-9155-5679-ba8a-d001ac9fac35",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Kenya",
"country": "KE"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--155f9eac-3bf3-5aae-8893-c68693915381",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Bosnia and Herzegovina",
"country": "BA"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--238f9802-6ea4-5732-acfa-4fd479ecfc2a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Turkey",
"country": "TR"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--2ad681b0-997b-5849-b736-854e2eb5a7c1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Iraq",
"country": "IQ"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--2c0010f6-7dba-5211-8c99-a3e2cb7b1ce6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Chile",
"country": "CL"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--2df297bc-6e93-59f1-b681-26fcd9e4fcac",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Serbia",
"country": "RS"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--309c0940-ec30-5293-becf-577b59073faa",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Azerbaijan",
"country": "AZ"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "India",
"country": "IN"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--3396a3a3-8e7c-51d0-aab8-31b4faa47771",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Spain",
"country": "ES"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--33aa280f-dc5e-50cb-a7fa-ae9d407c781f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Palestine",
"country": "PS"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--35d84834-709e-52fd-9de8-0bd6f7a19b3d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Burkina Faso",
"country": "BF"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--36f1d41c-6121-5809-9eee-3dcb27e26244",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Brazil",
"country": "BR"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--3b4782b9-a3d8-598e-94ce-2c71295da398",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Myanmar",
"country": "MM"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--3cea18d5-5dc6-5601-84a3-2a1c325fd12e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Togo",
"country": "TG"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--46166d72-af7b-5d51-918b-93d521a25c9d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Australia",
"country": "AU"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--4d355485-0f91-5833-ac43-e3cd5d005b64",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Ghana",
"country": "GH"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Armenia",
"country": "AM"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Russia",
"country": "RU"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Israel",
"country": "IL"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--55946fed-5d6c-5526-b148-42a1d53ef8f8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Democratic Republic of the Congo",
"country": "CD"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--5a16ad21-ba07-5839-86e3-722295e17a92",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Taiwan",
"country": "TW"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--623d4362-7695-5c21-84e9-3e330de7266a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Japan",
"country": "JP"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--683242b3-110d-57d2-afb1-4d36ef3c0a11",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Netherlands",
"country": "NL"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Bulgaria",
"country": "BG"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Iran",
"country": "IR"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--6f4a1f82-fe4f-556d-a69b-ab947cafcd6a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Latvia",
"country": "LV"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "China",
"country": "CN"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--74be65f3-a92d-5c17-b866-420156ca322c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Canada",
"country": "CA"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--8116ecca-9f0c-5cd0-b40a-b3cfb8ff776b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Colombia",
"country": "CO"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--8605a628-1249-532f-8293-4eb9be796709",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Malta",
"country": "MT"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Indonesia",
"country": "ID"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--87d79067-c5a5-55aa-a0b4-d15e935f3597",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Cameroon",
"country": "CM"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Ukraine",
"country": "UA"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--91d429ed-a39a-5da7-9531-0f13d9a2576e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Côte d'Ivoire",
"country": "CI"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--98733b8c-1f55-564d-ba69-9a69db59bfd4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Venezuela",
"country": "VE"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--a03825d9-e942-537c-aa9d-55a029969d38",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Sudan",
"country": "SD"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--a180d9cb-90b3-5125-ae14-78f233837847",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Argentina",
"country": "AR"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Poland",
"country": "PL"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--b1a8187e-287e-5825-bc8c-f81858867685",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Denmark",
"country": "DK"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "United Kingdom",
"country": "GB"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--b49b6f1a-097f-51c6-94d1-9b85dfad789d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Uzbekistan",
"country": "UZ"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--b778cc0c-cfa5-5581-bc2f-519fe0eb3768",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Belgium",
"country": "BE"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--bf22e52f-4055-58c6-9661-f8a1049a72dd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Cambodia",
"country": "KH"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Pakistan",
"country": "PK"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--c1b8fa18-b779-5765-a3d4-2a0b198b5f83",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Chad",
"country": "TD"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--c2d377c2-d276-5cbd-98e3-452fb9ef5d2d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Mali",
"country": "ML"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Hungary",
"country": "HU"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--c7b38d14-1faf-5e54-a7a8-7a201b73dea4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Angola",
"country": "AO"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Belarus",
"country": "BY"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "France",
"country": "FR"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--ddae6574-00e5-51a7-96dc-515c944e9519",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Gabon",
"country": "GA"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "United States of America",
"country": "US"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Moldova",
"country": "MD"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--edbabf65-5bf7-5fd7-839c-f5f96ea38f7f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Bangladesh",
"country": "BD"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--f16cd89c-095e-5121-984b-4700a3ed6d8b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Hong Kong",
"country": "HK"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--f1c00926-5352-51c2-9fa1-baaa81648068",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Switzerland",
"country": "CH"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--f7e7b770-0145-5dd0-a2da-07aae35cb4b2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Romania",
"country": "RO"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Germany",
"country": "DE"
},
{
"type": "location",
"spec_version": "2.1",
"id": "location--f9d89657-cc44-5483-94ca-564d2fc36ec2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-11-14T00:00:00.000Z",
"modified": "2026-11-14T00:00:00.000Z",
"name": "Italy",
"country": "IT"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9",
"created": "2026-11-14T00:00:00.000Z",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"name": "Source terms: Meta",
"definition_type": "statement",
"definition": {
"statement": "MIT (Meta threat-research repository)"
}
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569",
"created": "2026-11-14T00:00:00.000Z",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"name": "Source terms: Google",
"definition_type": "statement",
"definition": {
"statement": "Google; facts and counts only (no bulletin text republished)"
}
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3",
"created": "2026-11-14T00:00:00.000Z",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"name": "Source terms: TikTok, via the EU Code of Conduct Transparency Centre",
"definition_type": "statement",
"definition": {
"statement": "EU Code of Conduct on Disinformation Transparency Centre; no terms of use stated"
}
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"created": "2022-10-01T00:00:00.000Z",
"name": "TLP:CLEAR",
"extensions": {
"extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": {
"extension_type": "property-extension",
"tlp_2_0": "clear"
}
}
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2",
"created": "2026-11-14T00:00:00.000Z",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"name": "Source terms: OpenAI",
"definition_type": "statement",
"definition": {
"statement": "OpenAI news RSS feed (title and one-line summary quoted with credit; report pages not read)"
}
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2",
"created": "2026-11-14T00:00:00.000Z",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"name": "Source terms: European External Action Service (EEAS)",
"definition_type": "statement",
"definition": {
"statement": "EEAS: reuse authorised provided the source is acknowledged"
}
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2024-11-22T16:43:58.073969Z",
"definition_type": "statement",
"name": "DISARM Foundation",
"definition": {
"statement": "CC-BY-SA-4.0 DISARM Foundation"
}
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0079ef6a-7328-5922-9d85-1fc383ccd64e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0081d93c-2978-5d83-bc88-28a9279643b3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7b83dfd9-5429-576a-8b35-6d28ffd41b3a",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0326d616-0b0a-5a72-b304-530657ef528a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4c8c1659-e567-5af4-889e-7c85f404ed1b",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--03fa2237-e717-53ef-b379-bdacf453c01c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:06.000Z",
"modified": "2026-05-18T14:40:06.000Z",
"relationship_type": "uses",
"source_ref": "campaign--58aed277-5ef0-55af-b5c6-53a9178ecfa9",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--03ffddf7-beb4-5fc3-8a12-2ae797d9d9f1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ed94f134-53dc-5b9d-bf2c-dc2a16b040b5",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--04804226-0ace-5cb6-ab35-1ac7512ec729",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1ba23e28-f78b-588f-8ff8-c0dda94ac064",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--053e5a13-49bf-55fb-8e27-aa5d9c7507f7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--057b4391-7fde-5073-a551-e2fb3912c0db",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--fb805297-becb-526c-b3d6-b2b7be59a2b0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--059667b1-1713-5f63-bb18-c852458a3b4d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--cac1ade0-72f4-5c95-96bf-4ab30310b4d0",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0651d867-35cf-5f43-a57e-ba4881ce8047",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--aaf9c88e-9fef-5fc7-bacd-fb1cb4a21bd4",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--068c6eeb-5045-5d71-b1d3-fa8fcce8efa1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f267733a-6a76-5812-916e-dbabde1cccbb",
"target_ref": "location--98733b8c-1f55-564d-ba69-9a69db59bfd4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0727994a-04a9-57bf-b230-fedccb8ae35e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1b823e58-f436-52ae-b6c5-f48a28223e45",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--07c881e8-abc1-5475-bc13-d52502145bd8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--f9d89657-cc44-5483-94ca-564d2fc36ec2",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--094c08ae-9633-56ba-a97c-2cfbe7f13a1c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--a3a0105a-a28c-5091-8f86-e9bab2c597e1",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0960a6a3-1bc8-5d16-99c5-d94b34bb7cf7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "targets",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--09b3299f-f1aa-5476-bf4b-abbbffbcd3a9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8c284afc-2c67-5eed-911d-4e4f63f3d09e",
"target_ref": "location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0b625699-3032-59bd-911e-940cfeb74649",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:07.000Z",
"modified": "2026-05-18T14:40:07.000Z",
"relationship_type": "targets",
"source_ref": "campaign--37ca1f0a-46cd-5efd-aab5-2043967f382f",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0b78ad16-09a9-595f-98fc-47902d1492e9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:39.000Z",
"modified": "2026-08-27T09:09:39.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--fba28e92-ed1e-5b10-bbd5-e7459d135d48",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0b8993c7-0772-5cd5-8fd3-4a50deae762c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7d62e734-c557-5b0b-bedd-b47fa34d8264",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0c0bc991-2fcb-59d9-b710-dbf8f7a713b2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7bcd0c89-09c3-5bc0-b3fd-028407474d88",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0c66273c-0acf-595b-a022-82712c9ad517",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d7948137-1dc7-5fc1-9a8e-8851c35d4338",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0d7a48d3-96a6-5f4e-b925-7e207bef533e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1f67d854-7779-51b3-ba25-5c9da14026bb",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0d81b093-287b-5cc7-bf98-425da9aa3520",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7b8495bf-efbf-53f6-ac1e-761a1372d238",
"target_ref": "location--623d4362-7695-5c21-84e9-3e330de7266a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0d8de4f1-a677-5d5d-86fc-72882f5e7b96",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0f88c402-60d2-58da-a0fd-a0b712b8de93",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0dd6c4d3-03bd-5ec4-9489-ad55fbd06903",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6f6f193e-4c5d-53a1-8eba-d7db5843dc10",
"target_ref": "location--08713524-c6f5-5947-8b2a-1c4aff6c4802",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0df2ef5d-807d-5acf-8231-2f60d40c291d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "intrusion-set--02e03f8a-de21-5ea5-b7c2-ed566d40859d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0ecd1771-b4ba-583c-80ad-9a45b2c622ed",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--ea1f7502-8c62-5154-9368-864ba0b2080e",
"target_ref": "location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0f12af48-3ceb-58b9-9c0b-81b006ba4b0a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:03.000Z",
"modified": "2026-05-18T14:40:03.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d5a7ebd1-8f7a-5eab-9f80-519b014443f0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0f4db630-212f-530e-a8f7-7a219039246b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--440af0dc-29c2-5125-bfb6-239b6bac9d38",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0fae243f-9787-55de-b1e7-8080c065bd07",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--830831b4-6799-5ae0-a077-ddfeb79aebef",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--10be10ff-375c-5221-ba58-c69a89d1a342",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b286193a-c652-542b-9531-898c3c677d90",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--111ec9a9-f2d0-5d10-b35f-8e95c80d3e2d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--11638a91-285c-513f-816c-d23a98663571",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8d916bb2-630c-5c6c-bd91-5e0108cb055f",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--117240f7-25d0-50b7-94a0-35b34e710a22",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "targets",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--129e993e-a1c1-5d40-94a0-088842e47bb7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d3e5db65-8774-5efb-9d54-9d70ab1252f2",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--14123ed5-6b64-5d48-8ef1-2becadd67336",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--90b38da1-626e-5a86-8914-be1679afbc11",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--152e0e67-baf0-5cfe-9c2b-6455e785f8b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--b3e482e0-32b9-57e5-86d0-d8bc95d0710b",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--153a97b6-a5a5-5146-9d49-5fe46e799afa",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6f71b733-c697-566e-a6a9-81bfc2078fef",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--153bd6b9-27e1-5bed-b1d8-b179903d7ef0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--1ba23e28-f78b-588f-8ff8-c0dda94ac064",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1564cb96-52f9-5c1f-9f90-68debd1de2e7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--a1839976-d703-523c-9ffd-a2621f736f45",
"target_ref": "intrusion-set--0f66d5b4-0697-5b82-98d2-3b6b2f13021c",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1573f3e7-a047-589a-adc0-a4fd99431d37",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--26c2f277-7cef-59c8-82bb-f2fd02828bf7",
"target_ref": "location--3b4782b9-a3d8-598e-94ce-2c71295da398",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--162ae139-119a-5796-84c1-40c575522f54",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c6fcc5e8-6f6a-5eb6-ab97-40b0292717ec",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--171ace84-6293-52ec-b572-4575dadd7bc3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--17e88237-f0a6-5edc-8de8-89753a8a3d3d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0b533052-2db0-5af8-bf83-ace5356d83cb",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--181c570e-57ee-5014-a18f-2308d3604717",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--4deb1947-2ad9-55fa-a4e1-0a4b1ad08d9f",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--182f0003-10f9-5b14-a20d-d88dc425bc5f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--59e8bbe5-f7ee-5437-8c3f-44ea811c53b6",
"target_ref": "location--b49b6f1a-097f-51c6-94d1-9b85dfad789d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--18a02531-ce1e-50fa-9776-7202778f4203",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2de658ec-6228-5553-8526-3d2eec057542",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--18f72db1-e4d2-51ad-b4b3-e9caef14a135",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:38.000Z",
"modified": "2026-05-19T11:52:38.000Z",
"relationship_type": "targets",
"source_ref": "campaign--7b335bb6-1bb6-5839-a592-d349adec8b96",
"target_ref": "location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--19b53372-8169-530f-a223-d73e8952cb38",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--edafa58f-3d89-5729-b2b2-8d951a79cecc",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1aff40d6-0f74-5678-bcbf-2cda2386b646",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0dd5dbf1-6d0d-50dd-8c37-ba4abd26e156",
"target_ref": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1b786827-2938-5286-9a76-e30315996e34",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--e09ae2a5-af83-56a1-8297-55022de55013",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1bfed2e4-94f1-5fc8-ad7b-659c1e9592f8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0d154eb2-3ed6-53fb-b3ad-d9faa3e04b3d",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1ce49ed5-568d-5999-8be5-2f93333998f1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--453f1eaf-a9f3-5d0a-bf2e-8cc4aeacecaf",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1d2c7d44-0196-5a1d-bf3b-3995ade0cf72",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--07b9cbf7-a224-5652-a193-7e89a472eaa6",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1dd7cdc2-5c36-54dd-ab59-d612e19f579d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5858061e-8fec-5674-927d-ff6446b2259e",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1e156e33-4f09-507b-80e2-9ffa2852eab2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d54e5983-73b5-5338-ab13-e6429b5a9832",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1e1cc3bb-4c2f-50c9-9486-7b82b3e1df59",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--183b73eb-d2b8-5896-ab9f-976a1a100d89",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1ee445d2-ec2c-5bf6-a2a9-c5f779c89fd3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2234ebb3-0a76-5a15-9ef5-1fcc59f00183",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1f8055cd-4d3e-593a-a3d5-80baccf5c69d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1f946c52-4d04-5a5a-a10a-df52defc902e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--17ebe0c0-97f2-5b1e-9f36-a38d642cac12",
"target_ref": "intrusion-set--fce43469-60a5-55b3-8378-ac3340ab3ca6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1fd375d0-dfbc-5729-98c1-f5a82d6d135f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--c1b8fa18-b779-5765-a3d4-2a0b198b5f83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2041c606-faa3-5f17-a252-ef12e7760e04",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--25221259-6bbd-599e-a19c-62e7e74874bd",
"target_ref": "location--a180d9cb-90b3-5125-ae14-78f233837847",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--205d365b-b85f-5dac-a6e8-7724f008a256",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--213bf5d1-aadf-5b92-9fd5-4578e0e73a7f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "location--f7e7b770-0145-5dd0-a2da-07aae35cb4b2",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--217fa720-69df-59d5-8818-4b8def40540f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--55946fed-5d6c-5526-b148-42a1d53ef8f8",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2189d283-538a-59f4-82fb-4052b8cd2138",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6e9a408b-dce6-5031-82cb-ffdfdcb9f92d",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--21903cfd-83a7-5a30-ba86-31af1cdaf0ad",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--6e9a408b-dce6-5031-82cb-ffdfdcb9f92d",
"target_ref": "intrusion-set--552d82c7-f319-5eb0-864f-f3712e1cd370",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--21f6755f-9002-5cde-bbbc-1a19dc20f0d6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6450fe50-566f-5b5e-9d43-38ae79379ef7",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--22214be4-39ad-5e2c-98f1-c2e2307c14f1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--d71f2309-c4e6-5855-8098-ece7bf841029",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--236978c2-ce3e-588d-9d6b-1a2572218ea8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--6f4a1f82-fe4f-556d-a69b-ab947cafcd6a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--23d98fc6-8159-57d6-9f8c-b11d41b70600",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:10.000Z",
"modified": "2026-05-18T14:40:10.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--50645af8-3650-5919-9ddd-e476e554c78a",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--243e1ab3-fc31-512b-bebf-de9219dd00bf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:22.000Z",
"modified": "2026-08-27T09:09:22.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0f0c4a29-e46b-526f-89f2-a7b005506d09",
"target_ref": "attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2448524a-2f48-5572-87de-77adf8351c80",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--5a2fdc86-c155-5a3e-ade8-697e4109e733",
"target_ref": "intrusion-set--168f723d-64b0-581d-9873-bcf9157396c3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2459063a-e163-5894-8865-6cd7e5196b0b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--67550555-c2ba-576e-b511-0deee51bbeab",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2494e260-01cf-597c-9d93-f9b1a4902060",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--76cd6da8-e358-5d67-b799-37af8fd385b9",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2517a5b7-9fd1-5d44-b59b-e5b570b3b9ce",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--470461f0-2b0c-5d12-8b12-f58bc5d1d3fb",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--253d9d99-27ad-5489-8289-0e612887b3cd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--78cdb621-e5ce-5eff-8b6e-1e88f5a13efa",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2558fafc-0336-5901-8882-8ef4f4025364",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d1c0a571-fa0a-554a-be56-532a61f3a3d4",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--25ed6d29-da37-54f8-af5b-542b4f97521e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c8ab141a-7742-5a6b-a2b2-8f116d86f236",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--275028e7-b1cf-52c7-a97f-2fd53aec4f45",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0d4346db-c168-5f4f-9c41-716f68b3f23c",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2762dad4-b5cb-560e-ae46-365e69c3892d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--28062521-49ca-5e76-93e1-6cc4cb5e87cb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--288933ae-d065-569e-a807-fadcfe61316f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--28bf0ee1-fc58-56b8-867d-a6bfefe0c04c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--6e9a408b-dce6-5031-82cb-ffdfdcb9f92d",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--297e5739-3b85-5461-8273-5b8b8272bc04",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1dd6916f-dcc0-5c90-8587-682257dc94d2",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--29db335b-0c7d-5d82-8bb1-0670a050b7c9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:06.000Z",
"modified": "2026-05-18T14:40:06.000Z",
"relationship_type": "targets",
"source_ref": "campaign--58aed277-5ef0-55af-b5c6-53a9178ecfa9",
"target_ref": "location--5a16ad21-ba07-5839-86e3-722295e17a92",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--29e212a9-bddc-5900-9a9c-4d237fedf699",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-25T00:00:00.000Z",
"modified": "2026-08-25T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--084094f2-cc4d-5205-a8b2-79dc3be9789e",
"target_ref": "attack-pattern--758f2786-68fa-4c9e-bce3-0b09ea00978f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2a55a8d9-33af-560d-b0b5-cce59840321e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2acbf825-6f85-5731-beac-cc660582cf51",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--fd098c21-c1cb-5abf-90ca-fd85d2d9011f",
"target_ref": "location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2af0b7a6-167a-5481-a7e4-e036d05353e9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--fc30c14b-83d1-552d-8314-d8cf8cd04a20",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2af45db9-6c13-5f9e-87d4-e16b780eb00e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--54ad9c2e-ebae-5804-a38f-4429bfa9d437",
"target_ref": "location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2b27a163-0f8b-5218-889e-b94926d0a224",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0dcb50ec-7cb3-5e83-9d1b-2f7c8bb12c79",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2b90e7a8-d20d-544b-ac1d-720fbaf12f2d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2b9c236c-dbb8-58e0-8fd5-eb1ec8269327",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5a2fdc86-c155-5a3e-ade8-697e4109e733",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2bfaae88-788e-5285-b9da-8ffec0123b73",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--faf24c00-8424-595a-93bc-ab304f60a25f",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2ca9b806-a9de-5ee8-96c4-fbad0610109f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--6b49a745-8142-5614-afed-b6ae8dbdd38a",
"target_ref": "location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2d0cadeb-1e3a-5d9e-a3bf-cb9c01b83f90",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:39.000Z",
"modified": "2026-08-27T09:09:39.000Z",
"relationship_type": "targets",
"source_ref": "campaign--fba28e92-ed1e-5b10-bbd5-e7459d135d48",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2d7cc578-9d94-5a61-ab37-15434ee9c7f7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--b3e482e0-32b9-57e5-86d0-d8bc95d0710b",
"target_ref": "intrusion-set--ec4eb979-85fd-55ee-800e-32dc1224d900",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2d97ca3f-011c-5bab-8319-74d85938bfd2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1a53fcfe-246d-5a68-ae52-de65565cd614",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2dde0ec2-5182-5583-ba9b-7ff6cb8eab63",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--eaa61271-90b3-5bbd-9421-42f3cb0c48e1",
"target_ref": "location--33aa280f-dc5e-50cb-a7fa-ae9d407c781f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2e612b56-01ec-5a45-a3ab-f7c339e182d9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2e871a18-1b4f-5872-9c3b-ad33a239c428",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--31c80d24-b1b7-580f-869a-09418fcd4784",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--2f93312b-e626-59c2-9ecc-d71db09abcf9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3050d173-e824-505e-ae77-b9dac6f00d1c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--d2b8854d-5780-5a24-9cda-cd81b5022ef2",
"target_ref": "intrusion-set--9482f58f-8fc4-5b9e-842c-f159baf92e77",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--31046b47-1467-5063-96bb-3a65fc3c74c7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:43.000Z",
"modified": "2026-05-19T11:52:43.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8830144c-c6d1-5e8e-bd2b-4ccecff3a7c0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--328db685-a1ea-5810-840b-9b812ac6a6e4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:10.000Z",
"modified": "2026-05-18T14:40:10.000Z",
"relationship_type": "uses",
"source_ref": "campaign--50645af8-3650-5919-9ddd-e476e554c78a",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--32ba949f-94d2-5d0f-9a82-86c86eb4be1f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--17ebe0c0-97f2-5b1e-9f36-a38d642cac12",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3331c61b-753d-579e-befb-9501947f6119",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--3f3ca979-c388-5502-a2d3-82dabdf1c924",
"target_ref": "location--3396a3a3-8e7c-51d0-aab8-31b4faa47771",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--33694ab5-5034-5363-90aa-33737033e2d9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8c9b5d0d-1b00-5cb5-bf56-3152a7735a96",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--33ce4d4b-f408-51c5-b13b-feb25f542951",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:27.000Z",
"modified": "2026-08-27T09:09:27.000Z",
"relationship_type": "uses",
"source_ref": "campaign--2a2fe8ba-cc0c-59d1-a252-827324873737",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--343d575e-6025-58d2-b844-b121e74b8f83",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--794940be-8e56-5de4-8d47-f1178d2ca844",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--344e61b2-6474-5dd4-bdb4-2768e1869b21",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:42.000Z",
"modified": "2026-08-27T09:09:42.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--83feb463-c342-5c93-972f-f3e869671482",
"target_ref": "intrusion-set--0bc341f2-5887-5e11-b8ee-cf73be1bdc68",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--344f4dba-394b-56a3-874c-e43055ccd746",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--e1f6348c-7681-5766-b9ac-6859ecd4ed45",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--35295ca9-9382-5919-b046-d4dcff4c501a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1de08901-c78d-5692-be20-3c7c026f5f5d",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--36a05feb-0432-5931-ab94-67dfc6a3d0b7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--29b920e6-002f-523f-8ccc-7c4eb1c9d76b",
"target_ref": "location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--36edfd33-34d3-5a40-bfb6-79d6ef9c948e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--36fa2c08-d710-57fe-b794-7caf730f6cc6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "targets",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--37a5f3f6-6361-5591-b888-cda024d28223",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:22.000Z",
"modified": "2026-08-27T09:09:22.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0f0c4a29-e46b-526f-89f2-a7b005506d09",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3850a472-1ad3-5d20-b4d0-4ebea94fde4e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f5bbc44f-8238-53eb-96b6-f0037589151b",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--38ae6258-a05a-50be-8546-8799fcb0fd8f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--c8beb4ee-eea1-55d6-bc07-e72dfac80023",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3926e0d6-d697-522f-91d8-84af92b17763",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--dcd786f5-712a-5a52-9c92-60143faaa85e",
"target_ref": "location--08c97afe-2658-58f0-b757-c61ee4cc8e9e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--396cc829-3107-5389-b002-1a97e123a802",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "targets",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--396fa75f-bf0e-5d27-9b04-4e91e4b1cf3f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--76cec045-9f0a-57af-a9f0-6640455f4c44",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--39beb8de-b947-5873-9066-c9acaca41a40",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:04.000Z",
"modified": "2026-05-18T14:40:04.000Z",
"relationship_type": "uses",
"source_ref": "campaign--17be4d6a-fd71-56d8-8336-6075460a425b",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3a278ad8-f6ed-5778-a32c-dd65a054d332",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--442ad461-7bcf-5989-83d5-150654c6b9c2",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3a52bfa9-3d30-5e53-b411-ac8d3c0fecb0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:06.000Z",
"modified": "2026-05-18T14:40:06.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--58aed277-5ef0-55af-b5c6-53a9178ecfa9",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3b7f34d8-52f0-5f4c-9ecc-ebd9a37663ac",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--6c99159e-9b8e-5bdd-8e61-219dbb198bb0",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3ba06534-0a8f-5a78-a86d-e5b6c2e1d031",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--3faba592-a634-5c12-a2ea-c8d2f667c291",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3c0d5598-7f1d-520a-9594-c1ccefc8fec6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--156cd610-6794-51ee-9ee3-96f18dc1cb74",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3c84ca50-e2d1-50ff-a392-8e16b5950025",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:22.000Z",
"modified": "2026-08-27T09:09:22.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0f0c4a29-e46b-526f-89f2-a7b005506d09",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3d7d1d86-8582-5f2b-93c3-378b9a212ca2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--511111d9-5950-5683-ad7e-9f10fb20f05e",
"target_ref": "location--0ad6240a-6a8c-5e1a-9ca0-3ee577b93ab3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3eeaa4ec-a4f7-58ca-8549-4e64b72120ce",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--c8beb4ee-eea1-55d6-bc07-e72dfac80023",
"target_ref": "attack-pattern--d6be7b47-6d49-4859-b741-e1547538c079",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--41591bba-1517-5d23-b2ea-f5bbd3a53957",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d80544ca-c265-529f-87b5-30d6c2181fdd",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4186d2a5-c993-5bf6-b78d-8411c16053fd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--41913b83-dfbb-5d0d-bb22-40d2675d2de2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c2428639-63b6-581d-a81d-9ef953e1dfeb",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4237b0b8-1271-5813-bcc0-93d7b5e4bd30",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--39e4c4c6-b983-5996-94cc-a91a7c3200cf",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--42d4e57a-8c73-58ec-bcc9-d4057e0f460a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--adc89117-68bb-5590-a3b8-5e125f6c500e",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--431ebec7-d564-52cb-9fda-c22c25ec5314",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5ee28ef1-39ce-502c-bc91-3d37cd42347e",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4325b289-8e22-546d-a992-b950c6d8a459",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-08T00:00:00.000Z",
"modified": "2026-10-08T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--21a9e08b-7d24-5d18-89a0-32e35b8a28de",
"target_ref": "attack-pattern--758f2786-68fa-4c9e-bce3-0b09ea00978f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--433c192e-d4ab-55cb-8298-cbadc305b6bf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--be5cf859-d954-57a0-8c50-243d098f32bd",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--440cb2c8-279b-577a-96fd-398511f803fc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--885c8a1c-c2e6-5689-9477-9acf6c41aa57",
"target_ref": "location--8116ecca-9f0c-5cd0-b40a-b3cfb8ff776b",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4425f17d-c171-5944-8fb3-92c990fe1ccd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1affdc3c-3fd2-5db5-a3ce-3d2a162055e7",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4440215c-cb49-5cd0-9a7c-eb8c66dccf19",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1f7d9e0d-724b-5d44-8ea1-c9abbbf84b65",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--44fd0fae-9041-55dc-b75d-06575bc1f206",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "attack-pattern--0cc5110d-f7a1-49f7-8667-ae454698f11d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4775bfbd-ea0e-5490-938a-3616f2e469f4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--460143f1-96f4-5093-924c-96ca9b7896e6",
"target_ref": "location--74be65f3-a92d-5c17-b866-420156ca322c",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--481ed58a-bd60-5354-9978-402a94f77557",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a1839976-d703-523c-9ffd-a2621f736f45",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--48394a41-4cf0-50a8-9326-f119aa4f92d2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ba18eb99-c6a6-51b8-84ba-ffb7e3554ef6",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--497b31ed-0edf-57b7-bf90-91811f20e0cd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f6fc1113-7504-50fb-b8b1-76f7836f0b44",
"target_ref": "location--f1c00926-5352-51c2-9fa1-baaa81648068",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4996ddb7-a5a3-5783-9094-b79ef9886573",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--6b49a745-8142-5614-afed-b6ae8dbdd38a",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--49e5c94d-0ee7-5b39-b69a-b767b550aae7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--1de08901-c78d-5692-be20-3c7c026f5f5d",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4a3b1cb4-e64a-588e-9a02-6b304f01bbe9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--33e773b1-78ba-5f29-88bb-fb111a34f6e6",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4b0361ec-e7d3-521c-b56d-bfb3dccc8035",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4b6d462c-3978-59d7-ad87-5711ca1fc2e4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4fc8e48d-1e1e-5af4-9633-32d3daa2dcd0",
"target_ref": "location--a03825d9-e942-537c-aa9d-55a029969d38",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4c071e6c-0f6e-5490-9a01-deef898cc5de",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--337a011d-1532-5825-9c1e-692c346365c8",
"target_ref": "location--74be65f3-a92d-5c17-b866-420156ca322c",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4c32bf19-326a-565c-9cc9-c4a4a74e92e1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2ef807e3-ad82-562a-8b01-cb533af6874a",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4c3e8725-1b27-572d-96e8-0783b605b0a8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0f88c402-60d2-58da-a0fd-a0b712b8de93",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4c73848a-abea-591d-be3d-45a95d7896b7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--5a2fdc86-c155-5a3e-ade8-697e4109e733",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4ca2f697-a055-5ab7-8ba9-093579c22891",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a200330c-b1dc-5b7e-bd29-3aceae271bc8",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4ce0cca6-aa39-5e0c-84e7-2d6280296d03",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--67a19003-c93d-597a-b12f-655d7398a19f",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4db5bae7-0a23-5fed-984b-f3bbc9ddba14",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "attack-pattern--2295615a-89ad-4f5b-b8ed-e70245a6d209",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4e1f3030-6ad9-5380-b3ea-ed5d1f9708b3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:33.000Z",
"modified": "2026-08-27T09:09:33.000Z",
"relationship_type": "uses",
"source_ref": "campaign--bbdc9c99-ff9b-5e5c-8d7a-ebf062dc836d",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4f5fb755-3044-5b55-9c53-ed81e5657f6f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--2815320e-0b34-593d-81fd-c3edbc558b06",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5023c529-f9e6-5217-9644-7043d3c9f164",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f645b673-d1a3-5c49-a216-06f24b6166b5",
"target_ref": "location--3b4782b9-a3d8-598e-94ce-2c71295da398",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--514999de-9431-599d-bb04-d51b32ef7dc9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--c2d377c2-d276-5cbd-98e3-452fb9ef5d2d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--51af489a-b7ad-5b38-b3a4-3385451ac272",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ea335bfb-bd03-5cfa-a011-385c1b19072b",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--51b1a722-7725-5bd3-8e2a-37005c0cbd57",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--240a84ed-0221-5b02-afcd-e7ef01be346d",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--520da56b-b51a-5162-9abf-0d81e07cc6b3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:42.000Z",
"modified": "2026-08-27T09:09:42.000Z",
"relationship_type": "targets",
"source_ref": "campaign--83feb463-c342-5c93-972f-f3e869671482",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--526102ee-fd2a-53ab-9e6d-adb76d7c09db",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "targets",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--ddae6574-00e5-51a7-96dc-515c944e9519",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--52d3fa90-e3c8-5171-a3b2-c3ccdbecd870",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5331e8b2-e131-5888-890d-2ba321628735",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d30fd973-dc75-5d18-9b67-e7ce56e267d1",
"target_ref": "location--5a16ad21-ba07-5839-86e3-722295e17a92",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5365230c-c387-5f57-8bad-c7b9b9e45840",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--748d6353-860e-5951-9acb-f95abf942fa9",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--540e1c1c-da65-5ac2-9f9f-579b3df39f2a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--e4b7e110-e480-5876-b934-b647619dabd1",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5505fcd2-c63f-5d32-80c6-32676a671f98",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:39.000Z",
"modified": "2026-08-27T09:09:39.000Z",
"relationship_type": "uses",
"source_ref": "campaign--fba28e92-ed1e-5b10-bbd5-e7459d135d48",
"target_ref": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--555da556-2977-562c-8543-6a9635180e5a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--90f740da-2a51-52fc-a922-4a298491a33e",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--55c59446-07e5-53c9-8f89-038755ecdb64",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--70514dd8-6dd7-5f63-9506-1495eb6383b0",
"target_ref": "location--f7e7b770-0145-5dd0-a2da-07aae35cb4b2",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--563701d3-c5be-582e-abea-9f7ec11eab7a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5b0aff67-df3d-5b15-859e-7dfb8370c9fe",
"target_ref": "location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--57b8b5ec-36fb-55c0-84df-fd486887a52e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:39.000Z",
"modified": "2026-05-19T11:52:39.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--57dfb26a-9ccf-55a2-b1a0-8ac74db52a1a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-08-16T11:00:00.000Z",
"modified": "2024-08-16T11:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--55358f9c-a01c-56e9-9791-bd053a083b07",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--58070cf5-f17d-5086-9d06-17341b03b316",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--03d28809-93cd-5b8f-b894-e24758af1f36",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5814f0cd-ef4c-572a-95cd-db513e86ccfd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a6afbb10-3ac8-5133-bab3-e83393443dcc",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--595156aa-a743-53dc-b6ee-8324871239bf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ad29a057-cbbf-57d9-823e-50934ab4cf9f",
"target_ref": "location--98733b8c-1f55-564d-ba69-9a69db59bfd4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5a337d56-01da-59c8-80ea-f176ea304ecf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--acccc183-ad58-5547-9a16-aafe3c49d5b5",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5a983a46-31a5-5fd2-bf6b-7d43e6ef7598",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--25b0de2b-a763-5d84-a934-61b949d28354",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5aea479b-bc7b-5133-9557-edd2a42c70e0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--17afe927-1209-5278-8a85-db38a8148a58",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5b184b8a-17bc-568e-9857-b09fa44736e2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4751d1dc-6f7a-58c8-a52f-8bc8d416a0e0",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5b6b26f8-2b69-5d2f-beb8-5af3bd71eb3a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5b7ad41c-4cc4-5104-9eae-c57678c262d3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5bc24784-f947-5854-8b07-16a2f3be98f3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6e1dd9d9-ba39-53d8-8310-2caa3945e047",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5c6018d9-cc28-503e-8478-5f7ab26319ca",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--c2428639-63b6-581d-a81d-9ef953e1dfeb",
"target_ref": "location--46166d72-af7b-5d51-918b-93d521a25c9d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5cd8e988-2ea2-583d-aaba-64de0d3ef53c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:41.000Z",
"modified": "2026-05-19T11:52:41.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--13411a27-b176-5c9e-9cee-1075626c93e0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5d4071f6-2706-5c17-89bd-60af6388aa4f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2d9a30bc-cb9d-5727-a30d-9489085f0f5d",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5d756285-51e1-52e2-81db-a079433fcd4a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--50052f63-c2d2-5ec1-8722-82f8318a5bc8",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5e217e2e-6322-584a-add1-a15b027ece1e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--3f454965-9736-5d74-b99c-718fa0b8e017",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5f72656d-e992-5b0d-bd25-bf9d4006ba26",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--fa1fead0-20d4-5596-a3f9-7efa84e09cae",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6134bf69-f8a6-5716-93cd-305dd3e8ddc4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "intrusion-set--ef8f1e00-5db1-55fe-967d-74408ec4a102",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--61585f84-0810-5b8d-ae1d-b007134345c2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:39.000Z",
"modified": "2026-08-27T09:09:39.000Z",
"relationship_type": "uses",
"source_ref": "campaign--fba28e92-ed1e-5b10-bbd5-e7459d135d48",
"target_ref": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--626b8a09-b1a5-52c6-ab95-4472ad3ca712",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--deb02afa-2f53-565a-9249-b22dedf8fe5c",
"target_ref": "location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--630791ef-295e-5104-8dc8-93908ecbbf87",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8beeb6ff-6aa2-5e20-a038-57758af2f328",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--63101bc0-1231-50f2-8bc6-72c9ab0ad62a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "intrusion-set--f5c9ec70-e432-5751-b58a-cdb6c48e639c",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--632d8f6f-a833-5a3e-a57b-0f09bf368733",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f0913e3e-4a6b-59b8-9cc0-443eb508fbde",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6334da1f-e419-5878-b5db-13d5c31d1cef",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c90c51a9-984b-5ddc-8435-61963449dff2",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--636e8483-c8d0-5adc-bbbd-0df7086fe7e4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--eaa61271-90b3-5bbd-9421-42f3cb0c48e1",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--638d2c2e-a39b-5b49-92f7-a31c7a55432b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--dd581ffc-088a-5b61-b8f8-17ca8e9d3b30",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6399d386-8c27-5b60-8122-854cb8000669",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--63b0df77-b2d1-5416-bd34-f6b059cd8194",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--63c90b3f-5730-5df5-90fd-ce15298b11a1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--3d7da887-67e7-54f5-95eb-7551a2f33a33",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--63cfeffd-d6e4-559f-beb3-d0f97f63a074",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6c99159e-9b8e-5bdd-8e61-219dbb198bb0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--64481493-3338-5ac1-8b0b-9f74d5c60fd1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--967d688e-6caf-5968-9587-84bb1f73b05f",
"target_ref": "intrusion-set--a5313399-16a8-5f18-aa5b-eadf6e2e2073",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6533af3a-583c-5dd7-97ed-ff5e864d7834",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:43.000Z",
"modified": "2026-05-19T11:52:43.000Z",
"relationship_type": "uses",
"source_ref": "campaign--8830144c-c6d1-5e8e-bd2b-4ccecff3a7c0",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--653786c9-73d6-5ace-85f6-8a57df799b28",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--cfb884b6-5974-5c2e-bb5c-53f632c2e3fe",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--65637eee-99a5-5e55-8d85-ba99d7b30a22",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--76cec045-9f0a-57af-a9f0-6640455f4c44",
"target_ref": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--65bfdd04-2139-5215-9c8f-d0696f7a3249",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c5e91a3f-74bc-59e4-b5be-3457cb16a2b5",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--663150cc-5836-544f-85ee-b776ae42a0fc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--70655dea-9bb0-519e-9f28-321790b45d82",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6715a083-2425-536d-9869-3fa024738a32",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--c2428639-63b6-581d-a81d-9ef953e1dfeb",
"target_ref": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--672f044b-28bf-56fd-8110-5f4b90e36b86",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7bbd0046-9476-513c-9626-6f395d35b99d",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6745e8e2-96a4-5612-8ea6-bfb3de852fa0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--765194d7-2360-5a49-a1e6-ca13cf859b5c",
"target_ref": "location--f16cd89c-095e-5121-984b-4700a3ed6d8b",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6748b20a-ad6e-5718-8bd4-6d80d3845d92",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2044e595-730b-5fbf-a2d7-971354272a76",
"target_ref": "location--36f1d41c-6121-5809-9eee-3dcb27e26244",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--675b901b-6469-5fe0-9fe5-f97885fe6a31",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--432270d1-6ea2-50f1-b626-f0305d3d9f1a",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--67612e3b-5a5a-5972-ab06-70d6bbcd4701",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f3f6d9d2-d4a8-5995-a20c-62ec35463404",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6866d9f9-163e-583a-88b1-dbb1431c095f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1b8a39b5-e575-5b41-b5fd-ff546f6e0be4",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--691de309-1f58-59c4-998c-3369d4402922",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:09.000Z",
"modified": "2026-05-18T14:40:09.000Z",
"relationship_type": "targets",
"source_ref": "campaign--7eb37e4e-4c61-568a-ad65-2610945a467d",
"target_ref": "location--2ad681b0-997b-5849-b736-854e2eb5a7c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6a3d8088-bac8-5b5f-95fd-d4524ab7f9e6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c0b34262-b8d7-56a0-a513-f91a5dd0df19",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6b4d2530-964a-5f39-b93c-867fe8ac23c4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8c47b602-60d0-514f-bbef-e1b22a743430",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6be9d7e8-c834-5788-873c-28919ff93128",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a6cd15a4-bb74-5fbf-aa4b-6e9e4fab862b",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6c26dd31-4c54-5a05-8d0b-23356291f665",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--3d9dc53f-07d9-5670-aeca-352ba7fb3d1e",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6d105d9d-e94d-5683-9f04-84efc42ff4c6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a66c42a2-61e9-5e10-ae9b-d04cc6855658",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6dcc440b-3dda-512f-89dc-c98067a0580e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4dcf74c2-1a92-56b4-91fd-db45f00b6f6d",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6e51deb4-6ab7-551a-ae9b-a79e3f335265",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:42.000Z",
"modified": "2026-08-27T09:09:42.000Z",
"relationship_type": "targets",
"source_ref": "campaign--83feb463-c342-5c93-972f-f3e869671482",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6ebc0257-4596-5f77-8a3b-77afed60a088",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--70655dea-9bb0-519e-9f28-321790b45d82",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6f11955d-4084-5db1-9c55-215974508056",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:39.000Z",
"modified": "2026-05-19T11:52:39.000Z",
"relationship_type": "uses",
"source_ref": "campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6f6ac447-1d27-5861-b5c6-186d25162971",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "targets",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--3cea18d5-5dc6-5601-84a3-2a1c325fd12e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6fe0d8b1-c3f0-5fb0-b8eb-71fa42536d9d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:41.000Z",
"modified": "2026-05-19T11:52:41.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--13411a27-b176-5c9e-9cee-1075626c93e0",
"target_ref": "location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--70ab2fa3-352c-577f-a527-b72465c28729",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8ededc09-af87-509e-bb37-cfe188d654c8",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--70fb9cfe-9429-5db0-b070-b302f55566dc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--b778cc0c-cfa5-5581-bc2f-519fe0eb3768",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--71c31b36-8170-5513-bea6-008a0dcf73ec",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "intrusion-set--524df0a9-1742-5d3e-9538-c7dac6beec33",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--71e06a82-f713-5f4b-a0ff-b164798beb12",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d01a842a-55ee-524b-8cb5-edceca3fbdd4",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--71ed6a9d-d73d-59ec-8780-6c13cd654e2e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "uses",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--724ded95-47e5-5067-b1a9-656986b1edfb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "targets",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--46166d72-af7b-5d51-918b-93d521a25c9d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--72a9557b-8dc2-51d5-895c-524efae7a8db",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--cefba062-1b37-5216-b842-39403ad0ded3",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--72f54e4d-d9c6-5853-8372-0c7cf31e00b6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a165671a-d648-503e-91d9-464184e2f1fe",
"target_ref": "location--0d222f42-9155-5679-ba8a-d001ac9fac35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--73256bf6-d2ad-5dc2-beb3-8d645a9b3268",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--49cb9404-16a5-5f98-9f91-1491f957346a",
"target_ref": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--734fe7e2-5b17-5a9f-afbb-74847f5bb691",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7461639c-c978-5a83-9937-03b4d6058a05",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--450be43a-161b-5e75-93c5-fc7c5f2c9575",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--75072552-1b02-5f55-afd5-ca76bbe460f0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--663d149d-c84e-5fe3-83d1-c787d22f14c0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--75515dd6-cfb1-583a-9d83-fd34675b93bd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--adc89117-68bb-5590-a3b8-5e125f6c500e",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--75f7a4ca-29e5-5f22-8ff8-4b4f62c28ad3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5f7c1ce8-e8ee-50fc-95d6-fa5045eb0546",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--76468000-8fd8-5b1b-9b14-b748b9c8cf15",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--eca3e9f9-0e96-594b-8461-b9797804385c",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--76b4b7ff-04f7-5e08-81c2-d99388c39b25",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--9a703a7d-1c2b-5fd9-b8f3-73a5c15daaff",
"target_ref": "location--2df297bc-6e93-59f1-b681-26fcd9e4fcac",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7776bb84-f2a4-531a-a2ec-5e5b681d0b59",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:45.000Z",
"modified": "2026-08-27T09:09:45.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--485644b9-9fcb-562e-ad30-3d35d1ebe32d",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--779badb2-af90-58e3-88d6-fec331f568e0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1f48336b-7de8-5e42-9a07-ff419347895c",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--77a09179-fb41-5b58-ae46-def465bf24e3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b90999b7-bae4-5f97-8d6f-66150b1a3574",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--77a96499-8926-5389-8f0b-f111421c384f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ee0984bb-a1b1-5d5f-85a6-5397ad7206b7",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--785463aa-e58c-50af-a26f-5e2cc49e2e6a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--64a9e4c6-ce8b-5f6b-9e40-9b7bb808fcb1",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--78d9a037-8895-56f8-b31e-ddf272ce565c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:39.000Z",
"modified": "2026-05-19T11:52:39.000Z",
"relationship_type": "uses",
"source_ref": "campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"target_ref": "attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7b154437-03f7-5fa6-808c-230436439b2c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c03540e4-bc5c-5d45-93b0-f364f4c4cd84",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7b1b68bb-4432-5100-8770-f18ef2f4e9c5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:42.000Z",
"modified": "2026-08-27T09:09:42.000Z",
"relationship_type": "uses",
"source_ref": "campaign--83feb463-c342-5c93-972f-f3e869671482",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7d4c075e-0429-58da-9483-ae177c5ce275",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ef08211d-194d-5e0f-8f73-03a6535ff05c",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7dd24441-2be1-571c-8908-ac301352582c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:09.000Z",
"modified": "2026-05-18T14:40:09.000Z",
"relationship_type": "uses",
"source_ref": "campaign--7eb37e4e-4c61-568a-ad65-2610945a467d",
"target_ref": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7f3cfc8c-6fc0-5960-bdd7-f584210f3fbb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-08T00:00:00.000Z",
"modified": "2026-10-08T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--21a9e08b-7d24-5d18-89a0-32e35b8a28de",
"target_ref": "attack-pattern--0cc5110d-f7a1-49f7-8667-ae454698f11d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--80355ea0-2bd5-53cc-9fae-bc621dd19194",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8ebd5a82-4a24-5f71-bae5-a1b75e9b2ec2",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--813a7e1d-3534-5d65-ad7e-1baf94a986b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--64a9e4c6-ce8b-5f6b-9e40-9b7bb808fcb1",
"target_ref": "intrusion-set--bd055bb4-ecb8-5bf6-9689-7af9b0bddcfb",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8258d821-f09b-5746-b0a6-5ff54448f522",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--784b45b2-4ca1-5d96-a490-1db3565762c0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--827c3b6b-d38c-5124-a643-75ad7412057d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--570073e5-01b2-5b2a-8537-b7475258be20",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--83981305-2e5f-5f19-8f76-38f90f3affd6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--e78aa57c-e247-5e3f-a5d4-8605a8e68f6e",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--839c2fd4-49c5-546c-8eb2-d16c3a0e818c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:39.000Z",
"modified": "2026-05-19T11:52:39.000Z",
"relationship_type": "uses",
"source_ref": "campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--83d13fff-5645-508a-8572-e8d9fd3ce1dc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1978f732-7ee7-5466-89b4-3990ab6b483a",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--83e10c9e-b137-5ebc-b1ce-b541d5aa2f49",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--edafa58f-3d89-5729-b2b2-8d951a79cecc",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--83eabeb2-74f7-5356-8a28-2e1f7028361e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--a6cd15a4-bb74-5fbf-aa4b-6e9e4fab862b",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--84746deb-22ca-5ea9-9817-45893421b0c0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0c1a648a-dca0-5d97-83d3-951d51e71a0f",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--850c4a91-f5ca-5079-b7c2-a2b64feca0ed",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--31d26223-b76b-547b-b4b6-a65be8af617f",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8624ecb5-03c7-579d-942d-1a0846eeff5e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2bac5e13-e7a7-5a6f-9752-64a8c45026c7",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--86a19ab7-02c0-57f4-8d16-4f3c811ece18",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d71f2309-c4e6-5855-8098-ece7bf841029",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--86be0aea-222e-5df3-81a0-e17515096411",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--86eb1e02-b993-552e-9567-d68a566cb642",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--aa152686-669d-556b-84d1-0afcf42c2777",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--871ead48-4046-5bc5-8083-5dd533187900",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "intrusion-set--8dc293c8-f4f7-5b5f-b197-2c9ed120446f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--87ba1cbb-716e-5852-9643-1f16ba792a66",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5e809180-ea9f-5196-8c09-da83278de6ba",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--87c5c4bb-4e87-5d9e-b9b8-eed310202a20",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--6e9a408b-dce6-5031-82cb-ffdfdcb9f92d",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8823b535-dbc9-5368-a33f-b24e1f892cc8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:04.000Z",
"modified": "2026-05-18T14:40:04.000Z",
"relationship_type": "targets",
"source_ref": "campaign--17be4d6a-fd71-56d8-8336-6075460a425b",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8907a1e2-c69b-5761-b551-94a85d2c002c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8924a751-649e-597b-825a-47471e47e4e3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--e4b7e110-e480-5876-b934-b647619dabd1",
"target_ref": "location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--893afcb6-aee3-5281-a3da-98a794dd1561",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4c5f4b2b-32cc-5799-816f-1c878c429739",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--89a5bcbc-7877-56da-b729-ec39e786c6f5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f172a157-80d7-5379-9694-27f16dc1f59d",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--89ff1843-d362-5608-b488-457d57337239",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--08ad801c-84c1-5176-835b-7b2ee2660018",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8a4d5159-071e-561e-83c3-e5d5994d08a1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--87fdeca7-e56f-54da-b4fa-662137552141",
"target_ref": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8ab461d9-e3f5-55f4-bc45-adb0995d6b48",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--cefba062-1b37-5216-b842-39403ad0ded3",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8caad1e7-a274-5c60-b991-758d5f04bf24",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8cd30586-4b6d-5371-a882-3dacf3ef7777",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--08ad801c-84c1-5176-835b-7b2ee2660018",
"target_ref": "intrusion-set--fd46a43e-be19-54ec-92d7-29324ecb6a0c",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8e49f656-adc2-557e-a693-28e2991463a3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:39.000Z",
"modified": "2026-05-19T11:52:39.000Z",
"relationship_type": "uses",
"source_ref": "campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8f433276-d4ef-59e8-942f-4b6879d266de",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8fe5881b-15c2-5717-8a2b-146b968a48e4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:38.000Z",
"modified": "2026-05-19T11:52:38.000Z",
"relationship_type": "uses",
"source_ref": "campaign--7b335bb6-1bb6-5839-a592-d349adec8b96",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--909799ac-e2d9-553d-942e-5a5f1dce356b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "location--f9d89657-cc44-5483-94ca-564d2fc36ec2",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--90c157ca-099c-5231-8d48-6c5387c0111c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--885c8a1c-c2e6-5689-9477-9acf6c41aa57",
"target_ref": "location--8116ecca-9f0c-5cd0-b40a-b3cfb8ff776b",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9137d783-ac59-5ff4-b460-ea73432c7d60",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a4987d5c-e8c9-59dc-b2e6-0e33b658c1af",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--914f1643-5377-59bf-aadd-8dd0e019c067",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--915961e9-a1e0-5e4d-9b36-870b564d4809",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--bb8b2970-1d82-5a8e-aec2-8574ea63a04b",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9362988e-6c2f-5440-8935-f6b87dfe2591",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0239b746-2dc5-5e07-a4c3-d6908d4cece9",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--93afb623-166c-50a4-9918-416cb701a327",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f37f2596-e843-5067-8f65-4643093d7b93",
"target_ref": "location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9551272b-6f8b-5e18-8dec-aea021271478",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--6c99159e-9b8e-5bdd-8e61-219dbb198bb0",
"target_ref": "intrusion-set--fc39b5ba-b9e5-5891-b322-727a5494087f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--967e00c9-6780-5a87-9ea8-c909149ef7b9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:39.000Z",
"modified": "2026-08-27T09:09:39.000Z",
"relationship_type": "uses",
"source_ref": "campaign--fba28e92-ed1e-5b10-bbd5-e7459d135d48",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--96f29996-4b9d-5348-ac94-e41e7a81096a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d1a4ab1f-75a1-5e9f-bea7-c34716efa860",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--97d8cd49-8ef6-55fd-8e8f-5eeece71e7e5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--1b8a39b5-e575-5b41-b5fd-ff546f6e0be4",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--984bb356-3691-5842-a7dc-67fe5b220e72",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8ecd8e1b-f3a3-59a8-aee8-63d2685cf19a",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--984d77fc-9f39-5aea-a82f-5899839d6842",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--a2ca4610-8bbd-5246-a218-03cd8cd82239",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--986ffce5-e665-57b7-80b2-9703924aa3d7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--57544b96-3d03-5f9e-ae00-6e9d8d108d53",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--98751be0-ed01-5897-8373-0658bdcca60a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--fcb31455-7c4f-5c56-ac14-5ae155ed6a34",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9909aa4c-e4fb-537c-aa4f-373000c18a72",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a2ca4610-8bbd-5246-a218-03cd8cd82239",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--99b19417-5bc9-5d00-a1dc-11e91d01fea8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b0b8b0d2-fee4-5025-a64d-a4f562f440e2",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--99edc313-1cae-5745-aa6b-ec08ed96e83c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:07.000Z",
"modified": "2026-05-18T14:40:07.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--37ca1f0a-46cd-5efd-aab5-2043967f382f",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9a3087f5-d64d-5544-98ba-24809c456360",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--4c8c1659-e567-5af4-889e-7c85f404ed1b",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9a5db5cb-4a8c-532e-8311-434535dddd0b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--df27dd13-1805-54e8-8ac8-9a8af811e1e6",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9a868e67-5d46-58f7-b307-728d06d02229",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--a6cd15a4-bb74-5fbf-aa4b-6e9e4fab862b",
"target_ref": "intrusion-set--bd055bb4-ecb8-5bf6-9689-7af9b0bddcfb",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9be56f7e-ff0d-55e4-b46f-c6d9249ffe72",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--198affbe-4d43-5c55-8d4d-c176cf99e976",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9ca83367-cf7a-5cbe-84b8-0d4184da7577",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--3f3ca979-c388-5502-a2d3-82dabdf1c924",
"target_ref": "location--155f9eac-3bf3-5aae-8893-c68693915381",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9d2aaa3f-92e9-5c38-8258-a425951a3733",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--08ad801c-84c1-5176-835b-7b2ee2660018",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9d67be47-fd3b-5537-b3d2-86db72c1046c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9de2eb13-3e32-5d33-bc63-9a29ad48dcca",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--76cec045-9f0a-57af-a9f0-6640455f4c44",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9e19fafc-9d5c-5194-89c9-d08fbe45f709",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c62ab781-082a-5623-a497-0b2cc2baa4d3",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9e63d761-9b80-5948-8ed6-3c45e3e6e61a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--4aa183be-41fd-5a90-8e87-6d01afb6747f",
"target_ref": "intrusion-set--1b21142b-536c-5dec-90e5-1e73343b4299",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9eb481ef-e437-5a54-ad20-21bb5874c56e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "targets",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9ede3252-f857-559c-af26-36a13c1fbc0e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c7ae0cc5-c9d4-52cb-b671-814fbe76a4c6",
"target_ref": "location--3396a3a3-8e7c-51d0-aab8-31b4faa47771",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9ef01404-70f3-52a0-bb66-1973a15069b4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--1b823e58-f436-52ae-b6c5-f48a28223e45",
"target_ref": "intrusion-set--fd46a43e-be19-54ec-92d7-29324ecb6a0c",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9f60524e-feb3-5b59-860b-befa514f2117",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2e6b0439-ad4a-50ce-8bd6-6f547410035b",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9ff66bb0-8365-51b0-9230-600ed1eb4a0a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--683242b3-110d-57d2-afb1-4d36ef3c0a11",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a01c74f2-c898-5855-9430-692484ce38a2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4e6291c0-4696-5b0f-a38c-716e9983dd24",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a02e309c-f0f1-5c57-a868-b0a36300c191",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"target_ref": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a050045e-5d03-5f1e-8592-ecca4baf19fb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a13f9908-02b1-5d56-b4be-e3f2bdba666f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--31a33830-83eb-53cd-9c70-debcabd9e49b",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a283f978-f784-5b49-9dae-8035625e76e9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--3f7e3aec-a69a-5a24-a458-8759d161b42d",
"target_ref": "location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a2f3dfce-71c6-5937-9bd9-b9af436d86a2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--3396a3a3-8e7c-51d0-aab8-31b4faa47771",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a4576dc7-479f-52e4-aeaa-3436b0c84aea",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--ba7cfe96-dd89-5184-bda9-8e4b2bc23c25",
"target_ref": "intrusion-set--0bc341f2-5887-5e11-b8ee-cf73be1bdc68",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a4c32273-1082-5882-8aed-397ce9e0851b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--eaa61271-90b3-5bbd-9421-42f3cb0c48e1",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a50ae457-c422-56b0-8a59-bb83cd09cb7d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--4deb1947-2ad9-55fa-a4e1-0a4b1ad08d9f",
"target_ref": "intrusion-set--b5fdce69-b4c6-5b00-bc0a-c4734138c1db",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a55d541c-fac9-5fd0-81a0-9148869c430c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:10.000Z",
"modified": "2026-05-18T14:40:10.000Z",
"relationship_type": "uses",
"source_ref": "campaign--50645af8-3650-5919-9ddd-e476e554c78a",
"target_ref": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a5890c00-921c-58c4-bf3a-c1d356c60365",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--1b823e58-f436-52ae-b6c5-f48a28223e45",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a5b38768-c41e-5a75-8715-53f545e9b6fc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--60432786-36b0-54f9-9952-6560c6b06478",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a5bb45b7-41ba-50c7-877e-836f638033f4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--450be43a-161b-5e75-93c5-fc7c5f2c9575",
"target_ref": "location--8605a628-1249-532f-8293-4eb9be796709",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a5bcc8a2-2e5b-5f61-b4b3-ec92bc3f18f6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:09.000Z",
"modified": "2026-05-18T14:40:09.000Z",
"relationship_type": "uses",
"source_ref": "campaign--7eb37e4e-4c61-568a-ad65-2610945a467d",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a65f7460-941b-55d8-b714-1c6f27f53340",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:04.000Z",
"modified": "2026-05-18T14:40:04.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--17be4d6a-fd71-56d8-8336-6075460a425b",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a6dedca0-7e2f-5272-b016-130b74150817",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b83632a5-537d-5e0d-ae82-e2cb6065d72a",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a70494ff-f145-5e98-a1fd-1a536024236f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--637cc5f2-9973-5ef4-9ea5-4520044f5464",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a73b0a7d-bd78-5817-a9bf-d0667bc66e91",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"target_ref": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a7a0ea5f-fc31-5c2e-a983-30ff91aabfc6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--dc9262d2-2851-592c-b79d-92d0ce899519",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a83a006f-1c2f-54e1-af35-bbe1a106cd92",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8d49a139-8e16-5a7a-be1a-6e82672c6061",
"target_ref": "location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a87f4015-2ee0-5c04-9d0d-f2fe3254fe11",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:03.000Z",
"modified": "2026-05-18T14:40:03.000Z",
"relationship_type": "uses",
"source_ref": "campaign--d5a7ebd1-8f7a-5eab-9f80-519b014443f0",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--a9b85dbb-c7a7-5a5e-af37-47309dbc8967",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--52264298-1b8e-5500-bd0d-4665dbde537e",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--aa5a39a4-fff7-5386-9371-90d5149ebb58",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--e2e78893-3ac5-51d5-a1bb-fa86f8b9a50a",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--aaa69c4e-0ab0-5ada-9bb4-c23615c913be",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c8beb4ee-eea1-55d6-bc07-e72dfac80023",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ab3f070d-8b64-5945-93d2-16a47bb6daef",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--35d84834-709e-52fd-9de8-0bd6f7a19b3d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ab77ed09-9c73-512d-8477-e540a2abccc9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--36decfd8-cdc6-598d-a6cb-5b6fc886f2dc",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--abcc6e19-affb-587d-8ee0-311300244364",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:40.000Z",
"modified": "2026-05-19T11:52:40.000Z",
"relationship_type": "targets",
"source_ref": "campaign--9855f44e-e138-58b9-876d-21019adf6e85",
"target_ref": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ac46c28a-8898-543a-b383-2c0b35d98cc0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4deb1947-2ad9-55fa-a4e1-0a4b1ad08d9f",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ad333783-b8b3-574b-9757-b7b6c4526cbb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2163f8f0-d27d-503b-a242-804269f78edf",
"target_ref": "location--2df297bc-6e93-59f1-b681-26fcd9e4fcac",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--afdb5b66-808d-5166-a6e7-d43210e3396e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--17ebe0c0-97f2-5b1e-9f36-a38d642cac12",
"target_ref": "attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b0190900-73a0-5e18-a640-888c18fd325b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:41.000Z",
"modified": "2026-05-19T11:52:41.000Z",
"relationship_type": "targets",
"source_ref": "campaign--13411a27-b176-5c9e-9cee-1075626c93e0",
"target_ref": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b02a9b9e-2c2a-5098-8cc4-36eb278f569b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5030645f-be1d-5a54-b14f-7c92b279830e",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b02e96ff-2a0e-5743-9ade-a19ab13d9f51",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1539d6ee-fa29-567d-b06b-6c4e63908925",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b132b387-b8d9-5dfe-9e12-8e25d3e34de3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--d71f2309-c4e6-5855-8098-ece7bf841029",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b16bcfcf-b039-5a3f-b1c9-083456dec5f6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--abbcfc43-1080-5c91-bbed-9272456a0248",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b192b29a-14ce-51d8-a4d9-e53af315c254",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--040b8407-b7de-504a-a6e1-540fa213821b",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b19db638-dc29-56af-80a4-488fd695a003",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--c2428639-63b6-581d-a81d-9ef953e1dfeb",
"target_ref": "intrusion-set--0b140f5e-c89a-5eb3-961b-eb466a6e64b4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b1e2714c-a8f5-56bd-ab45-59f9f1bd7f69",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8d969f9c-4ca7-53c8-ae28-09b1e8457995",
"target_ref": "location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b2297ea7-3cee-5ed8-a399-89ee7827dd73",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:27.000Z",
"modified": "2026-08-27T09:09:27.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2a2fe8ba-cc0c-59d1-a252-827324873737",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b23fc5f5-ae57-5df7-9ad8-155320f54bb3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--181905e4-aa74-5f43-93cc-6e45ebae3f53",
"target_ref": "location--4d355485-0f91-5833-ac43-e3cd5d005b64",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b2776fe2-46c8-5da4-be9f-ef673d9bc4b2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--a2ca4610-8bbd-5246-a218-03cd8cd82239",
"target_ref": "intrusion-set--bd055bb4-ecb8-5bf6-9689-7af9b0bddcfb",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b2f9685e-dbb2-5876-ba2b-7b1541aee58e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:04.000Z",
"modified": "2026-05-18T14:40:04.000Z",
"relationship_type": "uses",
"source_ref": "campaign--17be4d6a-fd71-56d8-8336-6075460a425b",
"target_ref": "attack-pattern--e6a5397a-9515-4ba6-80e5-8f1fe273b7a5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b3124f69-bf7e-5df6-97cc-bc9ef127e57d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6732479f-0bd0-50c4-9335-1d471421f3ed",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b35e5566-54d5-581f-9234-a4b61ccea8c0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--9b34450f-1387-5916-bd01-65c7025b97f8",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b3d7de31-2be1-5e13-a8e8-6a02a97ed5f5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b57bf6c9-57b9-5743-8784-e8e7edae6eb7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8cfe82a4-f272-5e3d-8f03-5aec0335d961",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b59a6969-9bd8-509b-814d-2319ea281fae",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--c8beb4ee-eea1-55d6-bc07-e72dfac80023",
"target_ref": "attack-pattern--e6a5397a-9515-4ba6-80e5-8f1fe273b7a5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b6a8bc6e-b144-51f9-85e3-c090b40d7124",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--3415c078-7550-566a-a362-7eaf930748e5",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b70dc638-a80a-5ddc-afb4-e4af198966c7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b3e482e0-32b9-57e5-86d0-d8bc95d0710b",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b7b04bff-c272-5dfe-94dc-c32c7ef2a907",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--6f71b733-c697-566e-a6a9-81bfc2078fef",
"target_ref": "intrusion-set--524df0a9-1742-5d3e-9538-c7dac6beec33",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b86f2816-3487-5869-a50e-10e87ebe3a52",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7ad2d38f-4849-576c-a467-f9ccd31cee66",
"target_ref": "location--08c97afe-2658-58f0-b757-c61ee4cc8e9e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b8b106c4-e3da-5f49-b881-dfeb107b8b6d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:39.000Z",
"modified": "2026-05-19T11:52:39.000Z",
"relationship_type": "targets",
"source_ref": "campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b8ee98d4-14bb-57ab-8b6b-dac8b4cf1a31",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ad224067-923f-5727-9f72-1379977b1b2b",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b8f794c9-7418-54f7-82cc-c67622db6fca",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b94a3201-41f5-53c6-9f81-0eb45e449e08",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--eaace7ae-d136-5a81-89cd-71d650bce75f",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b9dacbea-b7c8-52d4-82d0-ee9656fca846",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ba236953-51b2-530f-9438-9d73a6a8d1a2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--67550555-c2ba-576e-b511-0deee51bbeab",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bababb46-5eba-5828-aef5-58ee9efe2937",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:40.000Z",
"modified": "2026-05-19T11:52:40.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--9855f44e-e138-58b9-876d-21019adf6e85",
"target_ref": "location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bb338d42-c14c-59a6-ad06-3bc09dff1956",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--81af31cb-4fd3-5e51-bc28-a5ee297ce3e0",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bb47e75e-0085-572a-8c31-094fcd766453",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b20ca440-eb46-5ca5-946a-2ef4fe37b35b",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bb6bb384-fe8e-510e-864d-128da0755aa0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--31b3bf44-a770-5f3c-a7ed-0eba4f37a36d",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bbbd956e-a0a8-5ad7-9a66-bf9835f883f5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:31.000Z",
"modified": "2026-08-27T09:09:31.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--20ea8a25-b7e9-513b-b46a-95c7fba401d6",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bbcc5626-e7b3-5198-ac95-404759bb4b27",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--cefba062-1b37-5216-b842-39403ad0ded3",
"target_ref": "intrusion-set--765fe3fc-719b-58a5-beab-598678ddcf1d",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bbf3c3fb-297a-5385-897c-14eeb82db640",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--850d0cbc-f049-5053-a2c7-bcb3277bdc85",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bccdc05a-f18f-5225-907f-2d44607ef4b9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--031c32ef-bc4d-5f3c-a280-3701e3d5623d",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bcf6250e-a950-522f-bcd1-3627acbfd22e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bd82954e-1d83-54aa-9aef-956e58c9c818",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--76cec045-9f0a-57af-a9f0-6640455f4c44",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bd8dfabc-20ac-5638-a420-b1f86b3755e1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "targets",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bdbd3b5f-7c55-5dcd-9908-f7886d3ca165",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--af0d37c7-74f2-5f55-9e61-a4f689bbea6a",
"target_ref": "location--3b4782b9-a3d8-598e-94ce-2c71295da398",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--be2dd012-cf9b-56c3-9e73-3b2c1b4e8ef9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "targets",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--be64b425-50e9-5638-9fc9-d76410c44863",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:04.000Z",
"modified": "2026-05-18T14:40:04.000Z",
"relationship_type": "uses",
"source_ref": "campaign--17be4d6a-fd71-56d8-8336-6075460a425b",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--bfbac6c7-92ca-5e0d-a051-e712825ff254",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0c2280f5-30fa-5a9d-9854-76d39854ee32",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c0486a60-7fcb-51c4-ab50-d84cf0e62bb4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1837ea67-aa42-58f4-8702-2681eeaae445",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c096ab1a-781e-538c-94f0-533917d9dd4d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0dcb50ec-7cb3-5e83-9d1b-2f7c8bb12c79",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c09e3acd-683c-57e6-a529-6891cf0d4bfd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d62f7c1a-1179-579e-9b8f-234e9e2227fe",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c14af99e-4f63-5899-9d97-d20f02209b35",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--ea1f7502-8c62-5154-9368-864ba0b2080e",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c1900c9a-e9dd-5b5a-b1b1-1fcd5aed310e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8b6f9871-2991-586e-a4ba-8613487aa6d1",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c1f2d98b-ce6f-573c-90e7-55d2fd7eb6c1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:09.000Z",
"modified": "2026-05-18T14:40:09.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7eb37e4e-4c61-568a-ad65-2610945a467d",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c1ffb695-3448-5cd2-bcc3-458e96448686",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "targets",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "location--c7b38d14-1faf-5e54-a7a8-7a201b73dea4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c276aff1-d4a4-5269-9ca3-3412354fa552",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ddd2d9e8-931e-5b6d-a599-7c4419f910c8",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c303bb88-6eea-5e01-9684-d0ac360be49f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--33942079-14cc-59ef-8a42-907f6890a7e4",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c3b68062-df60-5d6b-8cdd-ce41ada1dde7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--0dcb50ec-7cb3-5e83-9d1b-2f7c8bb12c79",
"target_ref": "intrusion-set--0bc341f2-5887-5e11-b8ee-cf73be1bdc68",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c3bb3f1f-eb66-5514-b6c3-23c54c97d8ce",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--9794a326-99c6-51e5-889e-7911b5e2a92b",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c5e967a0-50af-5091-a92d-4f9d618ddbee",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:42.000Z",
"modified": "2026-08-27T09:09:42.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--83feb463-c342-5c93-972f-f3e869671482",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c667b606-45af-5636-89f6-915bb34fb620",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--c8beb4ee-eea1-55d6-bc07-e72dfac80023",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c67496e0-462b-5230-9f77-946b7068cc8f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5cc48d82-6fee-5fc0-82e6-47817011d95b",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c6fb6b7a-a6d3-5e31-98b9-e1dd37818c9d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0d154eb2-3ed6-53fb-b3ad-d9faa3e04b3d",
"target_ref": "attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c797cb2f-d6e4-5424-b16b-6fb47d5f490f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--29f428ce-22ff-585b-822a-fd481e6b9215",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c7b48b79-37b4-5cc8-b37f-0e076a76b42e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5036771c-86d5-54f0-bac1-8584c7048521",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c89a6110-4c2a-519c-9069-7e6e11c685f7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "uses",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c8c093ed-593a-5dc7-a954-d79580e04b4c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0e228e95-3f42-519b-bc19-58bfd09fa17f",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cab82ed2-4484-5902-bcf0-fed2c23485e3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:45.000Z",
"modified": "2026-08-27T09:09:45.000Z",
"relationship_type": "uses",
"source_ref": "campaign--485644b9-9fcb-562e-ad30-3d35d1ebe32d",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cac0db8c-6f7c-5436-9e64-540648579024",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--29619cdf-5fb8-54e2-a319-32fe7ff27418",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cb4ce661-52ca-5dc9-b920-123fad125589",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--eaa61271-90b3-5bbd-9421-42f3cb0c48e1",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cbbac130-35b2-5b2d-9fac-bc85d27d8608",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:31.000Z",
"modified": "2026-08-27T09:09:31.000Z",
"relationship_type": "uses",
"source_ref": "campaign--20ea8a25-b7e9-513b-b46a-95c7fba401d6",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cc5647fa-6ae3-53db-8717-451e28bb65f8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--5b364c78-75d7-5970-9058-69642dfd7b87",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cf650958-3393-5ae3-9504-d276be301f03",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--62041f62-1c9d-5a8e-a695-62c8a25e9213",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d0f96ba2-a934-5024-9167-33a6ac774929",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--90b38da1-626e-5a86-8914-be1679afbc11",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d11acb93-8632-59e1-a42a-4bacbb0e7eae",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--889e0d0a-a93a-5aa4-b31f-edf29f2091d4",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d1e83434-3506-597d-9bda-cfc24d83515a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:38.000Z",
"modified": "2026-05-19T11:52:38.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7b335bb6-1bb6-5839-a592-d349adec8b96",
"target_ref": "location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d2a4044e-c123-52b8-8951-5b143cd4eec4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--967d688e-6caf-5968-9587-84bb1f73b05f",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d31f7c9d-b7e1-5f72-b13e-4700e3dbfdb2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--70655dea-9bb0-519e-9f28-321790b45d82",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d35ba6d5-a444-5244-9c0f-ba8b7267c844",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4e566d82-5702-595e-b147-bffdfa01f611",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d36a4fd9-8b5a-58c9-8ce5-ac752a8edcf2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"target_ref": "intrusion-set--ec4eb979-85fd-55ee-800e-32dc1224d900",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d382f02b-211b-5f3e-99d8-50cfda252f7d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--159cf81f-72ae-585e-8bae-f3cc7a3ddf82",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d3ef505a-ade7-510b-b11f-622401cd729a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d4ede8b2-5fbc-5bdb-926c-65f440aca133",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:42.000Z",
"modified": "2026-08-27T09:09:42.000Z",
"relationship_type": "targets",
"source_ref": "campaign--83feb463-c342-5c93-972f-f3e869671482",
"target_ref": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d50bcb22-5b7e-590a-b6e8-98e05f5ebf87",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--909acfdc-ad08-5692-907b-8593825245ea",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d531a5d7-62ae-52a4-9aa6-3beae6012c81",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--c8af1f11-afb3-5d3a-b913-0b2e84d9dc35",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d588169a-c266-53f1-8683-b88e791f6601",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--61a1fb22-b1b8-5366-a294-1deadd2c781e",
"target_ref": "location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d5ac3195-2878-5569-bf5d-6bcdc8cbc7e9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:33.000Z",
"modified": "2026-08-27T09:09:33.000Z",
"relationship_type": "uses",
"source_ref": "campaign--bbdc9c99-ff9b-5e5c-8d7a-ebf062dc836d",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d6595c2a-09d6-53c0-a9df-4c3a0ba6e778",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1d617535-bb3c-5be1-a1d1-726e286ab67e",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d66a8825-dbf2-57e4-a7ce-fcc84a3b15c0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ebaf6874-607f-5842-bf7f-0223331a77f2",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d7d4c054-9a77-54c2-ab5e-7d65b71d8042",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--6c99159e-9b8e-5bdd-8e61-219dbb198bb0",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d8576835-54e3-5cc9-b470-91c9672f5c80",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:09.000Z",
"modified": "2026-05-18T14:40:09.000Z",
"relationship_type": "targets",
"source_ref": "campaign--7eb37e4e-4c61-568a-ad65-2610945a467d",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d876debe-9714-5ecb-960a-5e3cb0dae070",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:44.000Z",
"modified": "2026-05-19T11:52:44.000Z",
"relationship_type": "uses",
"source_ref": "campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"target_ref": "attack-pattern--2295615a-89ad-4f5b-b8ed-e70245a6d209",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d8a10c3d-5497-53c3-8701-dc020a4dfdea",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ba7cfe96-dd89-5184-bda9-8e4b2bc23c25",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d8bfc133-5f94-5eee-b4d9-8b1c41c4c4b5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--814c80f7-a5e9-5c33-9f40-7dc4a99e9d0f",
"target_ref": "location--b1a8187e-287e-5825-bc8c-f81858867685",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d8c0ded7-9fe9-5ee8-a9e7-d782ad5344eb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4d56fd16-af11-5f98-bc43-c8bfd7486d0c",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d939a313-3a45-56bb-b8e6-1a834ff785d2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1a226633-8622-565d-b196-52fddc5f0b22",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--d9f475e0-9af5-5876-90ff-eece25b3beaf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--eb31fbb0-39b6-51d9-a28b-a2a0ba838a20",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--db28b692-bc5e-5654-84e5-fccfbffa24d5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ab3382a3-fda8-500e-9c6b-89ecba74b366",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--db478d85-dc45-57f1-89ec-f4bba3bed63f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:33.000Z",
"modified": "2026-08-27T09:09:33.000Z",
"relationship_type": "targets",
"source_ref": "campaign--bbdc9c99-ff9b-5e5c-8d7a-ebf062dc836d",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dc403e11-876f-5c8d-9aba-d04d1af845d2",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--64a9e4c6-ce8b-5f6b-9e40-9b7bb808fcb1",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dcacd8c4-3fb7-5f68-8d6f-67f0411713f7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--87d79067-c5a5-55aa-a0b4-d15e935f3597",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dda230cd-578c-5dcc-a90c-610e01606872",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--d2b8854d-5780-5a24-9cda-cd81b5022ef2",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dda91c57-a625-5e39-bcf6-c0bfa70f6f91",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:45.000Z",
"modified": "2026-08-27T09:09:45.000Z",
"relationship_type": "uses",
"source_ref": "campaign--485644b9-9fcb-562e-ad30-3d35d1ebe32d",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--de15b7d6-c4e7-55a1-ab0d-50b512da3ed4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--84c01a27-7b10-5318-9598-7b2d6fe73f5b",
"target_ref": "location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--df1a37ec-14cb-5924-81c5-67c89d1a304c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--2c3becc7-3c5a-5799-9814-83457c076b8b",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e1d155bb-8465-51bc-9b6a-b970df521f1c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a2657c9c-f52f-5b7f-81b1-2c36f51f442d",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e203a283-ed17-56a8-9cf0-07241c20247f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--442ad461-7bcf-5989-83d5-150654c6b9c2",
"target_ref": "intrusion-set--8f83b7c1-ead2-5024-a6be-cb02351df72f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e2741930-4f98-5a29-b180-8d79147de9db",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ab42cd0c-483e-57d3-9fba-8c29fb8e3da0",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e29c1ba6-4b8b-5b03-9e16-60fbb4ecbca0",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:31.000Z",
"modified": "2026-08-27T09:09:31.000Z",
"relationship_type": "uses",
"source_ref": "campaign--20ea8a25-b7e9-513b-b46a-95c7fba401d6",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e3c5e68b-cf48-5028-96de-d368f224e19e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:10.000Z",
"modified": "2026-05-18T14:40:10.000Z",
"relationship_type": "uses",
"source_ref": "campaign--50645af8-3650-5919-9ddd-e476e554c78a",
"target_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e450ff6d-4da4-5541-a151-1c8b5685817f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ca4ee82c-8832-51e5-a867-b5109bcf8c62",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e4937a3d-cdea-5592-9d6c-15244d054320",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--fcb31455-7c4f-5c56-ac14-5ae155ed6a34",
"target_ref": "intrusion-set--b25bd9af-9285-59d8-9f0f-b89be7a655c4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e4d6e53a-9c33-5915-b9f7-6018cf05d1a6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7a4b7fde-d889-54dd-8127-e33e04024032",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e57b12a6-92a0-55a4-b6e6-cc1a3aa2aadd",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:22.000Z",
"modified": "2026-08-27T09:09:22.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0f0c4a29-e46b-526f-89f2-a7b005506d09",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e5b49a4b-e44c-5fa2-a23b-1f68bce8716a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ee5b8b09-783a-54ca-ba76-8b8332dd49f2",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e5b9ad03-bb55-5d64-9cb6-9ae7264a5bbc",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:07.000Z",
"modified": "2026-05-18T14:40:07.000Z",
"relationship_type": "uses",
"source_ref": "campaign--37ca1f0a-46cd-5efd-aab5-2043967f382f",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e67ccfdd-1bdd-53e6-b7a5-fe2bdd3b624b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--eb31fbb0-39b6-51d9-a28b-a2a0ba838a20",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e682f8a6-4520-5b02-8c5f-7182847db20e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--9078eb70-433b-5f24-8da2-170d8f75ecef",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e6af732a-65ec-578c-b957-03ec9cfdb248",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--19b9a6c6-dedd-5b57-9134-244bfd79b192",
"target_ref": "location--8116ecca-9f0c-5cd0-b40a-b3cfb8ff776b",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e6d2d8e0-6c52-56f9-b342-18df3b1ef282",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--49cb9404-16a5-5f98-9f91-1491f957346a",
"target_ref": "location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e718b317-ca81-5200-9d0d-6b99e1eaf09c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ea1f7502-8c62-5154-9368-864ba0b2080e",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e72b36eb-b59d-5806-a3e8-5d245f805700",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e7ea6e4b-6150-5a08-93d1-36fd53537606",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--ffb0f3ab-2d9f-5ca2-b9dc-d30341c13c19",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e8082b8e-6743-5313-a0f5-24498a383f68",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-25T00:00:00.000Z",
"modified": "2026-08-25T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--084094f2-cc4d-5205-a8b2-79dc3be9789e",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e8ec3e46-2f81-5278-9d6a-ceb51fbf063a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--e8bf6d43-442e-5d7d-96ea-1ea7231f8eef",
"target_ref": "location--36f1d41c-6121-5809-9eee-3dcb27e26244",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e8f051c9-eba1-5dac-9a01-2a59bbbd4376",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:27.000Z",
"modified": "2026-08-27T09:09:27.000Z",
"relationship_type": "targets",
"source_ref": "campaign--2a2fe8ba-cc0c-59d1-a252-827324873737",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e919ca3b-8ce7-54b7-a679-cf68317140f8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6b49a745-8142-5614-afed-b6ae8dbdd38a",
"target_ref": "location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e962f6c1-3b40-59a3-a4d6-52ed62542f6f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--7936b64c-c041-5bf1-975e-16a5b290130d",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e99516ce-57a1-56c5-8239-1b68fa001c30",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4c7184d1-210e-5c5b-8920-c03eef9b7643",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e9aa32ef-ac6d-5ff2-a675-0eef9e7a439a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:24.000Z",
"modified": "2026-08-27T09:09:24.000Z",
"relationship_type": "uses",
"source_ref": "campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"target_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e9e52f76-8680-50c3-9b64-037d94d1da8f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--f73558d9-46c9-501d-97f9-f26bbe1f0c88",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e9f31fbe-736f-50a6-ac3a-ddae11f349c1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--11961338-04ec-5eb6-b0b4-4fdd2327284a",
"target_ref": "location--36f1d41c-6121-5809-9eee-3dcb27e26244",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ea038e5a-6b42-5399-83f3-68c09dafcfe1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8d533773-30f4-586e-809d-d17190065133",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ea061e58-e850-5d48-a221-f85c8e36bc24",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--91d429ed-a39a-5da7-9531-0f13d9a2576e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ea105a14-c292-5f86-8793-d347b1b1e128",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--bd180ef6-9c16-52af-a670-b57bf0fe04e3",
"target_ref": "location--5222cce1-00c5-569e-a944-437c7dcab236",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--eb610092-673a-513a-98c5-94860665d2f6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--442ad461-7bcf-5989-83d5-150654c6b9c2",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--eb669c65-bca5-563a-8b9d-f0bd6b99d40c",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--64a9e4c6-ce8b-5f6b-9e40-9b7bb808fcb1",
"target_ref": "intrusion-set--524df0a9-1742-5d3e-9538-c7dac6beec33",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ebce98cc-211c-5fb0-8d8f-72706e504308",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4a2d346b-e42e-5203-a109-89a1ecafe9bd",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ec36d7ae-ebba-5324-8861-577c3be85c84",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"target_ref": "attack-pattern--2295615a-89ad-4f5b-b8ed-e70245a6d209",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ed47bd48-b8bf-51ff-b126-6bb2b1ff4983",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--8b655e96-6a26-5321-a578-84d0e700e1eb",
"target_ref": "location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ed4ab441-1aa8-50f0-9917-2e36335846f4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--4cf59072-3bbd-5f24-9441-a6dd98ecdce2",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--eda5058e-5c7d-5fd3-ada4-79537e68572b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--e5990cf5-ff4c-549c-934b-892f634c7386",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--edab3879-f3cd-53ef-b51d-2092a3d8be9e",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d2b8854d-5780-5a24-9cda-cd81b5022ef2",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ef24c395-a038-5483-a933-497c034f7cdf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-26T23:18:54.000Z",
"modified": "2026-08-26T23:18:54.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ef849191-6b78-58e4-83bf-b42b5a0b0cab",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0d154eb2-3ed6-53fb-b3ad-d9faa3e04b3d",
"target_ref": "attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--efef5175-58ba-50c0-8a27-98d7dba22121",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--0801eaa6-b154-5493-9d46-41819163d992",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f0a5f5fd-ab70-509a-ae6d-36229b0a4aeb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:33.000Z",
"modified": "2026-08-27T09:09:33.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--bbdc9c99-ff9b-5e5c-8d7a-ebf062dc836d",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f0b40202-8ee1-5b6c-9a8a-f77f09a45689",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--0d154eb2-3ed6-53fb-b3ad-d9faa3e04b3d",
"target_ref": "location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f417283d-b717-52a0-ab22-d23ba16c0234",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--0dcb50ec-7cb3-5e83-9d1b-2f7c8bb12c79",
"target_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f42b9432-2bd3-50b8-b9b9-1d4316c4d2cb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--d6c187f3-3cab-506f-8fdc-095ef21a21e7",
"target_ref": "location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f52a1e6c-20a3-5e5c-bc27-3aa773a4ba71",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a3717f80-81cb-55a0-aa23-49131910567f",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f57d941c-c4cf-529b-bc56-e9e6247a89e4",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--680e1ac9-00ec-53ec-bc0b-9fe8567dc8e5",
"target_ref": "location--74be65f3-a92d-5c17-b866-420156ca322c",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f63b2aab-dcb6-52bb-ac53-ab67d5d05fe7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f714b105-2eea-51f1-b62a-ede7fa7d80c3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"target_ref": "location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f7545833-34d6-54c3-b1e4-6eb50d700d4d",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:36.000Z",
"modified": "2026-08-27T09:09:36.000Z",
"relationship_type": "targets",
"source_ref": "campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"target_ref": "location--0b0525e7-0456-5f78-9dfd-a54b131f9d5e",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f7bcef3a-0bd6-56ea-8400-1551eeafa500",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--a98c3768-d3ab-53da-bd9a-aa146befdd08",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f857720d-c0e5-54b2-8098-3c51a11df949",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--ba7cfe96-dd89-5184-bda9-8e4b2bc23c25",
"target_ref": "attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f9923837-47e3-55c4-af7f-e1500b9bf7a9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:45.000Z",
"modified": "2026-08-27T09:09:45.000Z",
"relationship_type": "uses",
"source_ref": "campaign--485644b9-9fcb-562e-ad30-3d35d1ebe32d",
"target_ref": "attack-pattern--696cbb0b-74f4-4937-9758-3fe56e4b9535",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fac890b0-4e47-5840-ad47-8f19369d37b8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "uses",
"source_ref": "campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"target_ref": "attack-pattern--696cbb0b-74f4-4937-9758-3fe56e4b9535",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "Mapped by Undertow from the publisher's description (DISARM rule table)"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fadaf99f-bcbf-5942-9dfe-2715d86d1fe3",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--223f4672-562e-5bef-82d4-156537858ccb",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fb29fb6b-8e7d-58fc-b671-1b5447d8c230",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b515a3cd-f1a5-54cd-8644-4031b9a21ec3",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fb4ab093-305e-5b27-a57b-ceb156282b9f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--9c79fd42-dd73-54d9-af9f-111182ace1cb",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fb9472e3-644f-5b9b-b6c5-ca948b594ff5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--450be43a-161b-5e75-93c5-fc7c5f2c9575",
"target_ref": "location--8605a628-1249-532f-8293-4eb9be796709",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fbd364df-5e17-5659-ae89-18bce55d4780",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--3246d9c7-6635-5d88-bfb0-2914e24f6912",
"target_ref": "location--bf22e52f-4055-58c6-9661-f8a1049a72dd",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fc0c2194-01d7-5f5c-8ed3-89c77b3a4aae",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--edafa58f-3d89-5729-b2b2-8d951a79cecc",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fc6c511f-87e6-55c8-8cd1-560522f15ec8",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--054b8550-ca46-5176-b1ca-5c1f30a97b34",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fca907be-3bc3-5b34-8b32-a71c16ba4b02",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"target_ref": "location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fcd2f9af-513c-59b3-b559-d13b644d5118",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--6f103d69-5e6d-580b-bc9f-b3fba943f2af",
"target_ref": "location--edbabf65-5bf7-5fd7-839c-f5f96ea38f7f",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fd90af61-1e03-541e-836c-30cc643863b9",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "targets",
"source_ref": "campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"target_ref": "location--238f9802-6ea4-5732-acfa-4fd479ecfc2a",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fe556712-ab51-5ee1-9bd3-9c1f8b4589e6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b047f7cc-0e8c-5aaa-8116-9526a1a02420",
"target_ref": "location--2c0010f6-7dba-5211-8c99-a3e2cb7b1ce6",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--febdd1a6-9072-566a-a63a-d32379ab0021",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--92e666b0-1271-5652-a030-27147369851f",
"target_ref": "location--309c0940-ec30-5293-becf-577b59073faa",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fed024a5-365a-5a44-8e4e-a10dc58ca2bb",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--1aca2a4c-69e4-5815-a81d-a26477ba5aba",
"target_ref": "location--69465cf1-bbec-5a4c-a160-267e74315cad",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fee5660a-8d5b-5b3e-9d2f-d6df1e05d2cf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--72a14e2a-9370-5ccf-99b9-f75a812f01f2",
"target_ref": "location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ff02f563-6ea1-535d-a285-199c54de61ac",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--967d688e-6caf-5968-9587-84bb1f73b05f",
"target_ref": "location--73d55a0f-d489-5839-a741-4017e82b75c9",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ffb883bd-a56c-517c-92eb-98d9d1eed1e5",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--614a0e15-1ea0-5a2f-8d3d-c75967f11354",
"target_ref": "location--5010936f-7f92-5c31-81b2-27bb091067b5",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ffbbd463-dc34-5c60-ba30-2c191481f63f",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"relationship_type": "attributed-to",
"source_ref": "campaign--3f3ca979-c388-5502-a2d3-82dabdf1c924",
"target_ref": "intrusion-set--d909dd5d-be9b-52b5-9c21-15c5ef627fb2",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
],
"description": "The publisher names this operation."
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ffbe6f18-7311-5554-b09e-648828f5e3cf",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"relationship_type": "originates-from",
"source_ref": "campaign--b09873d8-d3de-5662-9fb5-da049b2940c3",
"target_ref": "location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
],
"description": "Origin as the publisher states it; not a finding of sponsorship."
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--048c57f5-1f3f-5f99-9efc-e6b7fa7f757a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-30T10:00:00.000Z",
"modified": "2024-05-30T10:00:00.000Z",
"name": "OpenAI threat reporting, 2024-05-30",
"report_types": [
"threat-report"
],
"published": "2024-05-30T10:00:00.000Z",
"object_refs": [
"campaign--afb69189-8475-5c09-96a3-11a9204e2a33"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-deceptive-uses-of-ai-by-covert-influence-operations"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--11be77b5-7600-5d07-8b58-b25fc77ce34a",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-10-01T00:00:00.000Z",
"modified": "2025-10-01T00:00:00.000Z",
"name": "OpenAI threat reporting, 2025-10-01",
"report_types": [
"threat-report"
],
"published": "2025-10-01T00:00:00.000Z",
"object_refs": [
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"campaign--08ad801c-84c1-5176-835b-7b2ee2660018",
"campaign--5a2fdc86-c155-5a3e-ade8-697e4109e733",
"campaign--d80544ca-c265-529f-87b5-30d6c2181fdd",
"intrusion-set--168f723d-64b0-581d-9873-bcf9157396c3",
"intrusion-set--fd46a43e-be19-54ec-92d7-29324ecb6a0c",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"relationship--2448524a-2f48-5572-87de-77adf8351c80",
"relationship--2b9c236c-dbb8-58e0-8fd5-eb1ec8269327",
"relationship--41591bba-1517-5d23-b2ea-f5bbd3a53957",
"relationship--4c73848a-abea-591d-be3d-45a95d7896b7",
"relationship--89ff1843-d362-5608-b488-457d57337239",
"relationship--8cd30586-4b6d-5371-a882-3dacf3ef7777",
"relationship--9d2aaa3f-92e9-5c38-8258-a425951a3733"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-stop-news-2025"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--268ad036-9d4a-52b2-841d-bb7ee0d12c27",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-12T00:00:00.000Z",
"modified": "2026-03-12T00:00:00.000Z",
"name": "4th EEAS Report on Foreign Information Manipulation and Interference Threats",
"report_types": [
"threat-report"
],
"published": "2026-03-12T00:00:00.000Z",
"object_refs": [
"attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"attack-pattern--2295615a-89ad-4f5b-b8ed-e70245a6d209",
"attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"attack-pattern--696cbb0b-74f4-4937-9758-3fe56e4b9535",
"attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2",
"attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5",
"attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea",
"attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"campaign--17ebe0c0-97f2-5b1e-9f36-a38d642cac12",
"campaign--1caf82ae-ba36-509d-8afc-38e0fdc3d027",
"campaign--2e587788-b913-5418-9a5a-004023ab2ef1",
"campaign--3f3ca979-c388-5502-a2d3-82dabdf1c924",
"campaign--4aa183be-41fd-5a90-8e87-6d01afb6747f",
"campaign--65cdf8c8-1bb8-57b0-a377-eea6ec5a8e07",
"campaign--a327beff-ffda-574e-b04a-88913315ae8f",
"campaign--ba7cfe96-dd89-5184-bda9-8e4b2bc23c25",
"campaign--c2428639-63b6-581d-a81d-9ef953e1dfeb",
"intrusion-set--02e03f8a-de21-5ea5-b7c2-ed566d40859d",
"intrusion-set--0b140f5e-c89a-5eb3-961b-eb466a6e64b4",
"intrusion-set--0bc341f2-5887-5e11-b8ee-cf73be1bdc68",
"intrusion-set--1b21142b-536c-5dec-90e5-1e73343b4299",
"intrusion-set--8dc293c8-f4f7-5b5f-b197-2c9ed120446f",
"intrusion-set--d909dd5d-be9b-52b5-9c21-15c5ef627fb2",
"intrusion-set--ec4eb979-85fd-55ee-800e-32dc1224d900",
"intrusion-set--ef8f1e00-5db1-55fe-967d-74408ec4a102",
"intrusion-set--fce43469-60a5-55b3-8378-ac3340ab3ca6",
"location--155f9eac-3bf3-5aae-8893-c68693915381",
"location--238f9802-6ea4-5732-acfa-4fd479ecfc2a",
"location--3396a3a3-8e7c-51d0-aab8-31b4faa47771",
"location--46166d72-af7b-5d51-918b-93d521a25c9d",
"location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"location--f7e7b770-0145-5dd0-a2da-07aae35cb4b2",
"location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"location--f9d89657-cc44-5483-94ca-564d2fc36ec2",
"relationship--053e5a13-49bf-55fb-8e27-aa5d9c7507f7",
"relationship--0df2ef5d-807d-5acf-8231-2f60d40c291d",
"relationship--111ec9a9-f2d0-5d10-b35f-8e95c80d3e2d",
"relationship--1f946c52-4d04-5a5a-a10a-df52defc902e",
"relationship--205d365b-b85f-5dac-a6e8-7724f008a256",
"relationship--213bf5d1-aadf-5b92-9fd5-4578e0e73a7f",
"relationship--2762dad4-b5cb-560e-ae46-365e69c3892d",
"relationship--288933ae-d065-569e-a807-fadcfe61316f",
"relationship--2a55a8d9-33af-560d-b0b5-cce59840321e",
"relationship--2b90e7a8-d20d-544b-ac1d-720fbaf12f2d",
"relationship--2e612b56-01ec-5a45-a3ab-f7c339e182d9",
"relationship--32ba949f-94d2-5d0f-9a82-86c86eb4be1f",
"relationship--3331c61b-753d-579e-befb-9501947f6119",
"relationship--41913b83-dfbb-5d0d-bb22-40d2675d2de2",
"relationship--4db5bae7-0a23-5fed-984b-f3bbc9ddba14",
"relationship--5b7ad41c-4cc4-5104-9eae-c57678c262d3",
"relationship--5c6018d9-cc28-503e-8478-5f7ab26319ca",
"relationship--6134bf69-f8a6-5716-93cd-305dd3e8ddc4",
"relationship--6399d386-8c27-5b60-8122-854cb8000669",
"relationship--63b0df77-b2d1-5416-bd34-f6b059cd8194",
"relationship--6715a083-2425-536d-9869-3fa024738a32",
"relationship--734fe7e2-5b17-5a9f-afbb-74847f5bb691",
"relationship--86be0aea-222e-5df3-81a0-e17515096411",
"relationship--871ead48-4046-5bc5-8083-5dd533187900",
"relationship--8907a1e2-c69b-5761-b551-94a85d2c002c",
"relationship--8f433276-d4ef-59e8-942f-4b6879d266de",
"relationship--909799ac-e2d9-553d-942e-5a5f1dce356b",
"relationship--914f1643-5377-59bf-aadd-8dd0e019c067",
"relationship--9ca83367-cf7a-5cbe-84b8-0d4184da7577",
"relationship--9d67be47-fd3b-5537-b3d2-86db72c1046c",
"relationship--9e63d761-9b80-5948-8ed6-3c45e3e6e61a",
"relationship--a02e309c-f0f1-5c57-a868-b0a36300c191",
"relationship--a050045e-5d03-5f1e-8592-ecca4baf19fb",
"relationship--a4576dc7-479f-52e4-aeaa-3436b0c84aea",
"relationship--a73b0a7d-bd78-5817-a9bf-d0667bc66e91",
"relationship--afdb5b66-808d-5166-a6e7-d43210e3396e",
"relationship--b19db638-dc29-56af-80a4-488fd695a003",
"relationship--b3d7de31-2be1-5e13-a8e8-6a02a97ed5f5",
"relationship--b8f794c9-7418-54f7-82cc-c67622db6fca",
"relationship--bcf6250e-a950-522f-bcd1-3627acbfd22e",
"relationship--d36a4fd9-8b5a-58c9-8ce5-ac752a8edcf2",
"relationship--d8a10c3d-5497-53c3-8701-dc020a4dfdea",
"relationship--ec36d7ae-ebba-5324-8861-577c3be85c84",
"relationship--f714b105-2eea-51f1-b62a-ede7fa7d80c3",
"relationship--f857720d-c0e5-54b2-8098-3c51a11df949",
"relationship--fac890b0-4e47-5840-ad47-8f19369d37b8",
"relationship--fca907be-3bc3-5b34-8b32-a71c16ba4b02",
"relationship--fd90af61-1e03-541e-836c-30cc643863b9",
"relationship--ffbbd463-dc34-5c60-ba30-2c191481f63f"
],
"external_references": [
{
"source_name": "European External Action Service (EEAS)",
"url": "https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bff5f3d8-a8eb-5a80-8725-8f3a61efc8c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--2a9c1ab6-0fe6-562e-994a-08966e1f8238",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-05-01T00:00:00.000Z",
"modified": "2024-05-01T00:00:00.000Z",
"name": "OpenAI threat reporting, 2024-05-01",
"report_types": [
"threat-report"
],
"published": "2024-05-01T00:00:00.000Z",
"object_refs": [
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"campaign--0dcb50ec-7cb3-5e83-9d1b-2f7c8bb12c79",
"campaign--6f71b733-c697-566e-a6a9-81bfc2078fef",
"campaign--b3e482e0-32b9-57e5-86d0-d8bc95d0710b",
"campaign--fcb31455-7c4f-5c56-ac14-5ae155ed6a34",
"intrusion-set--0bc341f2-5887-5e11-b8ee-cf73be1bdc68",
"intrusion-set--524df0a9-1742-5d3e-9538-c7dac6beec33",
"intrusion-set--b25bd9af-9285-59d8-9f0f-b89be7a655c4",
"intrusion-set--ec4eb979-85fd-55ee-800e-32dc1224d900",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--5222cce1-00c5-569e-a944-437c7dcab236",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"relationship--152e0e67-baf0-5cfe-9c2b-6455e785f8b5",
"relationship--153a97b6-a5a5-5146-9d49-5fe46e799afa",
"relationship--2b27a163-0f8b-5218-889e-b94926d0a224",
"relationship--2d7cc578-9d94-5a61-ab37-15434ee9c7f7",
"relationship--98751be0-ed01-5897-8373-0658bdcca60a",
"relationship--b70dc638-a80a-5ddc-afb4-e4af198966c7",
"relationship--b7b04bff-c272-5dfe-94dc-c32c7ef2a907",
"relationship--c096ab1a-781e-538c-94f0-533917d9dd4d",
"relationship--c3b68062-df60-5d6b-8cdd-ce41ada1dde7",
"relationship--e4937a3d-cdea-5592-9d6c-15244d054320",
"relationship--f417283d-b717-52a0-ab22-d23ba16c0234"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-spamouflage"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--2f38fbb8-1d35-5455-938d-8e6b641227de",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-19T11:52:38.000Z",
"modified": "2026-05-19T11:52:38.000Z",
"name": "Meta Adversarial Threat Report H2 2025",
"report_types": [
"threat-report"
],
"published": "2026-05-19T11:52:38.000Z",
"object_refs": [
"attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"attack-pattern--2295615a-89ad-4f5b-b8ed-e70245a6d209",
"attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"campaign--13411a27-b176-5c9e-9cee-1075626c93e0",
"campaign--39dd5ce9-f53d-50b0-b88b-247857c6861d",
"campaign--7b335bb6-1bb6-5839-a592-d349adec8b96",
"campaign--8830144c-c6d1-5e8e-bd2b-4ccecff3a7c0",
"campaign--9855f44e-e138-58b9-876d-21019adf6e85",
"campaign--caf5f64f-e449-5f47-a22e-29b47f6c1b22",
"intrusion-set--524df0a9-1742-5d3e-9538-c7dac6beec33",
"intrusion-set--f5c9ec70-e432-5751-b58a-cdb6c48e639c",
"location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--5222cce1-00c5-569e-a944-437c7dcab236",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"relationship--18f72db1-e4d2-51ad-b4b3-e9caef14a135",
"relationship--2f93312b-e626-59c2-9ecc-d71db09abcf9",
"relationship--31046b47-1467-5063-96bb-3a65fc3c74c7",
"relationship--396cc829-3107-5389-b002-1a97e123a802",
"relationship--57b8b5ec-36fb-55c0-84df-fd486887a52e",
"relationship--5cd8e988-2ea2-583d-aaba-64de0d3ef53c",
"relationship--63101bc0-1231-50f2-8bc6-72c9ab0ad62a",
"relationship--6533af3a-583c-5dd7-97ed-ff5e864d7834",
"relationship--6f11955d-4084-5db1-9c55-215974508056",
"relationship--6fe0d8b1-c3f0-5fb0-b8eb-71fa42536d9d",
"relationship--71c31b36-8170-5513-bea6-008a0dcf73ec",
"relationship--78d9a037-8895-56f8-b31e-ddf272ce565c",
"relationship--839c2fd4-49c5-546c-8eb2-d16c3a0e818c",
"relationship--8e49f656-adc2-557e-a693-28e2991463a3",
"relationship--8fe5881b-15c2-5717-8a2b-146b968a48e4",
"relationship--9eb481ef-e437-5a54-ad20-21bb5874c56e",
"relationship--abcc6e19-affb-587d-8ee0-311300244364",
"relationship--b0190900-73a0-5e18-a640-888c18fd325b",
"relationship--b8b106c4-e3da-5f49-b881-dfeb107b8b6d",
"relationship--bababb46-5eba-5828-aef5-58ee9efe2937",
"relationship--bd8dfabc-20ac-5638-a420-b1f86b3755e1",
"relationship--be2dd012-cf9b-56c3-9e73-3b2c1b4e8ef9",
"relationship--d1e83434-3506-597d-9bda-cfc24d83515a",
"relationship--d876debe-9714-5ecb-960a-5e3cb0dae070"
],
"external_references": [
{
"source_name": "Meta",
"url": "https://transparency.meta.com/metasecurity/threat-reporting/"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--41d83404-489b-52e1-b754-56f6ea1be6d1",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-02-01T00:00:00.000Z",
"modified": "2025-02-01T00:00:00.000Z",
"name": "OpenAI threat reporting, 2025-02-01",
"report_types": [
"threat-report"
],
"published": "2025-02-01T00:00:00.000Z",
"object_refs": [
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"campaign--64a9e4c6-ce8b-5f6b-9e40-9b7bb808fcb1",
"campaign--967d688e-6caf-5968-9587-84bb1f73b05f",
"campaign--a3a0105a-a28c-5091-8f86-e9bab2c597e1",
"intrusion-set--524df0a9-1742-5d3e-9538-c7dac6beec33",
"intrusion-set--a5313399-16a8-5f18-aa5b-eadf6e2e2073",
"intrusion-set--bd055bb4-ecb8-5bf6-9689-7af9b0bddcfb",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"relationship--094c08ae-9633-56ba-a97c-2cfbe7f13a1c",
"relationship--64481493-3338-5ac1-8b0b-9f74d5c60fd1",
"relationship--785463aa-e58c-50af-a26f-5e2cc49e2e6a",
"relationship--813a7e1d-3534-5d65-ad7e-1baf94a986b5",
"relationship--d2a4044e-c123-52b8-8951-5b143cd4eec4",
"relationship--dc403e11-876f-5c8d-9aba-d04d1af845d2",
"relationship--eb669c65-bca5-563a-8b9d-f0bd6b99d40c",
"relationship--ff02f563-6ea1-535d-a285-199c54de61ac"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-sponsored-discontent"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--468db4f5-7c93-5184-9b8b-c19356939554",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-05-18T14:40:03.000Z",
"modified": "2026-05-18T14:40:03.000Z",
"name": "Meta Adversarial Threat Report H1 2026",
"report_types": [
"threat-report"
],
"published": "2026-05-18T14:40:03.000Z",
"object_refs": [
"attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"attack-pattern--e6a5397a-9515-4ba6-80e5-8f1fe273b7a5",
"campaign--17be4d6a-fd71-56d8-8336-6075460a425b",
"campaign--37ca1f0a-46cd-5efd-aab5-2043967f382f",
"campaign--50645af8-3650-5919-9ddd-e476e554c78a",
"campaign--58aed277-5ef0-55af-b5c6-53a9178ecfa9",
"campaign--7eb37e4e-4c61-568a-ad65-2610945a467d",
"campaign--d5a7ebd1-8f7a-5eab-9f80-519b014443f0",
"location--2ad681b0-997b-5849-b736-854e2eb5a7c1",
"location--309c0940-ec30-5293-becf-577b59073faa",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--5a16ad21-ba07-5839-86e3-722295e17a92",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"relationship--03fa2237-e717-53ef-b379-bdacf453c01c",
"relationship--0b625699-3032-59bd-911e-940cfeb74649",
"relationship--0f12af48-3ceb-58b9-9c0b-81b006ba4b0a",
"relationship--23d98fc6-8159-57d6-9f8c-b11d41b70600",
"relationship--29db335b-0c7d-5d82-8bb1-0670a050b7c9",
"relationship--328db685-a1ea-5810-840b-9b812ac6a6e4",
"relationship--39beb8de-b947-5873-9066-c9acaca41a40",
"relationship--3a52bfa9-3d30-5e53-b411-ac8d3c0fecb0",
"relationship--691de309-1f58-59c4-998c-3369d4402922",
"relationship--7dd24441-2be1-571c-8908-ac301352582c",
"relationship--8823b535-dbc9-5368-a33f-b24e1f892cc8",
"relationship--99edc313-1cae-5745-aa6b-ec08ed96e83c",
"relationship--a55d541c-fac9-5fd0-81a0-9148869c430c",
"relationship--a5bcc8a2-2e5b-5f61-b4b3-ec92bc3f18f6",
"relationship--a65f7460-941b-55d8-b714-1c6f27f53340",
"relationship--a87f4015-2ee0-5c04-9d0d-f2fe3254fe11",
"relationship--b2f9685e-dbb2-5876-ba2b-7b1541aee58e",
"relationship--be64b425-50e9-5638-9fc9-d76410c44863",
"relationship--c1f2d98b-ce6f-573c-90e7-55d2fd7eb6c1",
"relationship--d8576835-54e3-5cc9-b470-91c9672f5c80",
"relationship--e3c5e68b-cf48-5028-96de-d368f224e19e",
"relationship--e5b9ad03-bb55-5d64-9cb6-9ae7264a5bbc"
],
"external_references": [
{
"source_name": "Meta",
"url": "https://transparency.meta.com/metasecurity/threat-reporting/"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5de787b5-2908-599a-93da-959919e28811",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-30T00:00:00.000Z",
"modified": "2026-03-30T00:00:00.000Z",
"name": "TikTok, Code of Conduct on Disinformation report: March 2026",
"report_types": [
"threat-report"
],
"published": "2026-03-30T00:00:00.000Z",
"object_refs": [
"attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"campaign--1b8a39b5-e575-5b41-b5fd-ff546f6e0be4",
"campaign--1ba23e28-f78b-588f-8ff8-c0dda94ac064",
"campaign--90b38da1-626e-5a86-8914-be1679afbc11",
"campaign--aaf9c88e-9fef-5fc7-bacd-fb1cb4a21bd4",
"campaign--bd180ef6-9c16-52af-a670-b57bf0fe04e3",
"campaign--e4b7e110-e480-5876-b934-b647619dabd1",
"campaign--eaa61271-90b3-5bbd-9421-42f3cb0c48e1",
"campaign--edafa58f-3d89-5729-b2b2-8d951a79cecc",
"location--33aa280f-dc5e-50cb-a7fa-ae9d407c781f",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--5222cce1-00c5-569e-a944-437c7dcab236",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"relationship--04804226-0ace-5cb6-ab35-1ac7512ec729",
"relationship--0651d867-35cf-5f43-a57e-ba4881ce8047",
"relationship--14123ed5-6b64-5d48-8ef1-2becadd67336",
"relationship--153bd6b9-27e1-5bed-b1d8-b179903d7ef0",
"relationship--19b53372-8169-530f-a223-d73e8952cb38",
"relationship--2dde0ec2-5182-5583-ba9b-7ff6cb8eab63",
"relationship--540e1c1c-da65-5ac2-9f9f-579b3df39f2a",
"relationship--636e8483-c8d0-5adc-bbbd-0df7086fe7e4",
"relationship--6866d9f9-163e-583a-88b1-dbb1431c095f",
"relationship--83e10c9e-b137-5ebc-b1ce-b541d5aa2f49",
"relationship--8924a751-649e-597b-825a-47471e47e4e3",
"relationship--97d8cd49-8ef6-55fd-8e8f-5eeece71e7e5",
"relationship--a4c32273-1082-5882-8aed-397ce9e0851b",
"relationship--cb4ce661-52ca-5dc9-b920-123fad125589",
"relationship--d0f96ba2-a934-5024-9167-33a6ac774929",
"relationship--ea105a14-c292-5f86-8793-d347b1b1e128",
"relationship--fc0c2194-01d7-5f5c-8ed3-89c77b3a4aae"
],
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/8"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--6189988d-eeab-50ca-9b8c-12510201a68b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-01T00:00:00.000Z",
"modified": "2026-06-01T00:00:00.000Z",
"name": "OpenAI threat reporting, 2026-06-01",
"report_types": [
"threat-report"
],
"published": "2026-06-01T00:00:00.000Z",
"object_refs": [
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"campaign--6e9a408b-dce6-5031-82cb-ffdfdcb9f92d",
"campaign--cefba062-1b37-5216-b842-39403ad0ded3",
"intrusion-set--552d82c7-f319-5eb0-864f-f3712e1cd370",
"intrusion-set--765fe3fc-719b-58a5-beab-598678ddcf1d",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"relationship--2189d283-538a-59f4-82fb-4052b8cd2138",
"relationship--21903cfd-83a7-5a30-ba86-31af1cdaf0ad",
"relationship--28bf0ee1-fc58-56b8-867d-a6bfefe0c04c",
"relationship--72a9557b-8dc2-51d5-895c-524efae7a8db",
"relationship--87c5c4bb-4e87-5d9e-b9b8-eed310202a20",
"relationship--8ab461d9-e3f5-55f4-bc45-adb0995d6b48",
"relationship--bbcc5626-e7b3-5198-ac95-404759bb4b27"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-data-center-bandwagon"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--806fbbe3-1156-50e1-8f74-2046dd7d4397",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-06-30T00:00:00.000Z",
"modified": "2026-06-30T00:00:00.000Z",
"name": "Google Influence Operations Bulletin Q2 2026",
"report_types": [
"threat-report"
],
"published": "2026-06-30T00:00:00.000Z",
"object_refs": [
"campaign--00bd91a0-5823-55b8-8962-bc7f6b3f00cc",
"campaign--00fb3f51-679a-510d-9d0b-fa84ff2a805b",
"campaign--01aa5693-526c-54e8-8c3c-52e18a6de416",
"campaign--0239b746-2dc5-5e07-a4c3-d6908d4cece9",
"campaign--035f0dbf-da94-5da6-b8a1-3076cef6bc94",
"campaign--03d28809-93cd-5b8f-b894-e24758af1f36",
"campaign--04eebc45-ca0a-5123-a4e9-6d6c1e8fb747",
"campaign--0547ac36-a0a9-57d8-b175-73776edf474d",
"campaign--06a7f974-ecb4-57f6-b854-87252f5b57be",
"campaign--09fc0a98-1edc-5571-af76-df6ff3e7e877",
"campaign--0be13aac-14dd-5cde-8e6e-cd608ac25d09",
"campaign--0d4346db-c168-5f4f-9c41-716f68b3f23c",
"campaign--0ea6193c-1bb0-5ea5-857d-11bd71fc8161",
"campaign--10e47f6a-418c-530f-95a0-5eef3a26dd67",
"campaign--11961338-04ec-5eb6-b0b4-4fdd2327284a",
"campaign--11992697-6ac8-5825-9489-f77c8614c3ca",
"campaign--1501538f-adab-5068-b351-aee5f514be9b",
"campaign--156cd610-6794-51ee-9ee3-96f18dc1cb74",
"campaign--1573e75d-f6ba-5a05-9b6c-a17790fe171c",
"campaign--17e1ef75-4c27-58e3-803c-306137743fe0",
"campaign--181905e4-aa74-5f43-93cc-6e45ebae3f53",
"campaign--18374284-1854-5a2e-9f65-1ff492a6972e",
"campaign--198affbe-4d43-5c55-8d4d-c176cf99e976",
"campaign--1a53fcfe-246d-5a68-ae52-de65565cd614",
"campaign--1adb7954-d113-58a6-a992-4fe2d5ecfcbf",
"campaign--1affdc3c-3fd2-5db5-a3ce-3d2a162055e7",
"campaign--1baca941-e4b0-56a1-afe1-62950205edbb",
"campaign--1e336b64-511c-5b28-bc23-d53bb5fe5564",
"campaign--1e676f6e-7685-5b9b-8052-b494ca643419",
"campaign--1f1f5110-e1f4-53e7-97cd-587158611bad",
"campaign--1f7d9e0d-724b-5d44-8ea1-c9abbbf84b65",
"campaign--1f993479-04ba-5eaf-b329-ea1cbc5a2e41",
"campaign--2163f8f0-d27d-503b-a242-804269f78edf",
"campaign--2189182b-be5c-5056-b8bb-8957f61afdb0",
"campaign--223f4672-562e-5bef-82d4-156537858ccb",
"campaign--24f4a7ba-e086-5806-9900-1556e5080efd",
"campaign--25221259-6bbd-599e-a19c-62e7e74874bd",
"campaign--26691b51-ac83-567b-8628-77af816aa667",
"campaign--29619cdf-5fb8-54e2-a319-32fe7ff27418",
"campaign--29b920e6-002f-523f-8ccc-7c4eb1c9d76b",
"campaign--29f428ce-22ff-585b-822a-fd481e6b9215",
"campaign--2d9a30bc-cb9d-5727-a30d-9489085f0f5d",
"campaign--2e6b0439-ad4a-50ce-8bd6-6f547410035b",
"campaign--2f3cc963-b0ae-5490-a288-7b65c4a2f0a7",
"campaign--30b8bd79-3679-55fc-bc70-81e77fd96a08",
"campaign--3125b23f-50d6-5f52-925e-1c3a4815aeea",
"campaign--337a011d-1532-5825-9c1e-692c346365c8",
"campaign--34797274-be28-55e7-a3b0-d06b06664bb3",
"campaign--39e4c4c6-b983-5996-94cc-a91a7c3200cf",
"campaign--3cee8fc4-9eef-5342-a48e-732edd5ec614",
"campaign--3faba592-a634-5c12-a2ea-c8d2f667c291",
"campaign--440af0dc-29c2-5125-bfb6-239b6bac9d38",
"campaign--453f1eaf-a9f3-5d0a-bf2e-8cc4aeacecaf",
"campaign--4944da77-466f-588b-95f3-1ad03db6e996",
"campaign--4a2d346b-e42e-5203-a109-89a1ecafe9bd",
"campaign--4e566d82-5702-595e-b147-bffdfa01f611",
"campaign--52264298-1b8e-5500-bd0d-4665dbde537e",
"campaign--5c9940c2-d2ab-594d-a60c-388bf39e9b9a",
"campaign--5cc48d82-6fee-5fc0-82e6-47817011d95b",
"campaign--5e66d119-68af-5613-a933-a134fe9ef845",
"campaign--5ebe163a-dbb6-585c-9e71-29b13e4d45b9",
"campaign--61a1fb22-b1b8-5366-a294-1deadd2c781e",
"campaign--637cc5f2-9973-5ef4-9ea5-4520044f5464",
"campaign--63e611e0-fac9-58df-ae6b-459aac6d971b",
"campaign--6450fe50-566f-5b5e-9d43-38ae79379ef7",
"campaign--666b8e5c-17eb-5928-aa89-9cade1ecfde0",
"campaign--6732479f-0bd0-50c4-9335-1d471421f3ed",
"campaign--6e1dd9d9-ba39-53d8-8310-2caa3945e047",
"campaign--70514dd8-6dd7-5f63-9506-1495eb6383b0",
"campaign--72a14e2a-9370-5ccf-99b9-f75a812f01f2",
"campaign--7395de65-e37c-5f8a-9846-9333f98c36f0",
"campaign--74dd4414-cc05-5f31-9078-5515c0eaf6aa",
"campaign--7520889b-d375-5647-bbc2-c6c26d067c3c",
"campaign--765194d7-2360-5a49-a1e6-ca13cf859b5c",
"campaign--78b8ec0a-39e7-5413-97fa-8493b2a288fb",
"campaign--78cdb621-e5ce-5eff-8b6e-1e88f5a13efa",
"campaign--7936b64c-c041-5bf1-975e-16a5b290130d",
"campaign--794940be-8e56-5de4-8d47-f1178d2ca844",
"campaign--7950f540-0cdf-5a71-8ffb-90b962227220",
"campaign--7df6d402-a5d0-5008-ba7f-e1d4be0bc07b",
"campaign--814c80f7-a5e9-5c33-9f40-7dc4a99e9d0f",
"campaign--8182853f-fc46-5f77-8dd2-4296567eacd2",
"campaign--81af31cb-4fd3-5e51-bc28-a5ee297ce3e0",
"campaign--8445c1c7-18fe-57e5-b018-98ec4c3f18ab",
"campaign--84c01a27-7b10-5318-9598-7b2d6fe73f5b",
"campaign--850d0cbc-f049-5053-a2c7-bcb3277bdc85",
"campaign--8ab087ee-6b93-522c-b55f-6122995b633b",
"campaign--8b6f9871-2991-586e-a4ba-8613487aa6d1",
"campaign--8c47b602-60d0-514f-bbef-e1b22a743430",
"campaign--8d533773-30f4-586e-809d-d17190065133",
"campaign--8d916bb2-630c-5c6c-bd91-5e0108cb055f",
"campaign--8ebd5a82-4a24-5f71-bae5-a1b75e9b2ec2",
"campaign--8ecd8e1b-f3a3-59a8-aee8-63d2685cf19a",
"campaign--8ed1d456-17bc-5a8e-bc44-c7beb06455f2",
"campaign--8ededc09-af87-509e-bb37-cfe188d654c8",
"campaign--8f31493a-3cf1-5bcf-8627-0b714a8b8dd1",
"campaign--9078eb70-433b-5f24-8da2-170d8f75ecef",
"campaign--909acfdc-ad08-5692-907b-8593825245ea",
"campaign--90f740da-2a51-52fc-a922-4a298491a33e",
"campaign--9536187e-55d8-5854-9a4f-c82fb8150890",
"campaign--97dc979b-333e-5a70-aa34-6b647fcf7b39",
"campaign--982be462-0bed-5a98-a69b-8cb1a3cbb182",
"campaign--9e93f690-2c32-554d-a7a4-1f75ca29c606",
"campaign--a2657c9c-f52f-5b7f-81b1-2c36f51f442d",
"campaign--a3e1808d-98fe-50b1-af07-dfc31cf52c02",
"campaign--ab40d9ec-1efc-51df-a1db-4c9478f95fea",
"campaign--ad29a057-cbbf-57d9-823e-50934ab4cf9f",
"campaign--adefa0f0-3488-51bb-8eca-71bb9ad29596",
"campaign--ae1984a9-966d-59ca-9f74-53e144e72f8f",
"campaign--ae6009e9-9c78-5e96-958a-047d2439ca8d",
"campaign--b026d544-3e64-5871-a6e6-5307441a89e4",
"campaign--b047f7cc-0e8c-5aaa-8116-9526a1a02420",
"campaign--b0b8b0d2-fee4-5025-a64d-a4f562f440e2",
"campaign--b20ca440-eb46-5ca5-946a-2ef4fe37b35b",
"campaign--b515a3cd-f1a5-54cd-8644-4031b9a21ec3",
"campaign--ba18eb99-c6a6-51b8-84ba-ffb7e3554ef6",
"campaign--bb8115f9-a07a-56cc-af03-db306f31287b",
"campaign--bba71f8c-0c64-5a7b-90d8-e210580351dc",
"campaign--be5cf859-d954-57a0-8c50-243d098f32bd",
"campaign--bf7fb8d1-7240-53f1-9147-4a8fd5a5bd35",
"campaign--c00113ee-162b-53a6-a7fc-e0334edc5a29",
"campaign--c03540e4-bc5c-5d45-93b0-f364f4c4cd84",
"campaign--c6fcc5e8-6f6a-5eb6-ab97-40b0292717ec",
"campaign--c7ae0cc5-c9d4-52cb-b671-814fbe76a4c6",
"campaign--cb1a4799-f5c6-5fd3-b9cc-4b87b589127f",
"campaign--cfb884b6-5974-5c2e-bb5c-53f632c2e3fe",
"campaign--d00200c2-9bc6-5f65-b4b6-482a783947c4",
"campaign--d1a4ab1f-75a1-5e9f-bea7-c34716efa860",
"campaign--d1c0a571-fa0a-554a-be56-532a61f3a3d4",
"campaign--d5e55889-716a-5a7c-87ab-4c974c3db1b2",
"campaign--d62f7c1a-1179-579e-9b8f-234e9e2227fe",
"campaign--dc3a6df0-3953-52ef-8eed-ce7d43fa0870",
"campaign--dc9262d2-2851-592c-b79d-92d0ce899519",
"campaign--deb02afa-2f53-565a-9249-b22dedf8fe5c",
"campaign--df08c384-1475-502a-a2ad-9b016752499b",
"campaign--df27dd13-1805-54e8-8ac8-9a8af811e1e6",
"campaign--e028fc68-7a99-5cf2-b235-31082d6516a3",
"campaign--e18836df-b3f2-55be-9f7c-80e06032685d",
"campaign--e1f6348c-7681-5766-b9ac-6859ecd4ed45",
"campaign--e2e234d3-3651-5d14-a6d0-c8537eac5a75",
"campaign--e2e78893-3ac5-51d5-a1bb-fa86f8b9a50a",
"campaign--e5570b7c-4a18-555b-bdef-4a5122ad7274",
"campaign--e7115b92-ef60-51ba-a7e7-78a64f774656",
"campaign--e75dc771-0fe6-517f-becf-fc8d83f2f84f",
"campaign--eaace7ae-d136-5a81-89cd-71d650bce75f",
"campaign--ebaf6874-607f-5842-bf7f-0223331a77f2",
"campaign--eca3e9f9-0e96-594b-8461-b9797804385c",
"campaign--ee0984bb-a1b1-5d5f-85a6-5397ad7206b7",
"campaign--f0913e3e-4a6b-59b8-9cc0-443eb508fbde",
"campaign--f1d5026c-7bb2-5ae5-8cab-2b6707656605",
"campaign--f220e4c7-4713-5abb-a9d4-1fbe4d3973b9",
"campaign--f37f2596-e843-5067-8f65-4643093d7b93",
"campaign--f473192e-f929-5126-842e-1b3390c9f000",
"campaign--f88e9b12-df8c-5346-a669-6829a41e3899",
"campaign--f8cddb9b-b725-5008-81e4-7c6317871c7b",
"campaign--faf24c00-8424-595a-93bc-ab304f60a25f",
"campaign--fb98b45d-8197-5f2c-88b1-e327e9a6d205",
"campaign--feb01977-e309-5711-9f4a-6d809446bcf6",
"location--2c0010f6-7dba-5211-8c99-a3e2cb7b1ce6",
"location--2df297bc-6e93-59f1-b681-26fcd9e4fcac",
"location--309c0940-ec30-5293-becf-577b59073faa",
"location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"location--3396a3a3-8e7c-51d0-aab8-31b4faa47771",
"location--36f1d41c-6121-5809-9eee-3dcb27e26244",
"location--4d355485-0f91-5833-ac43-e3cd5d005b64",
"location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"location--74be65f3-a92d-5c17-b866-420156ca322c",
"location--98733b8c-1f55-564d-ba69-9a69db59bfd4",
"location--a180d9cb-90b3-5125-ae14-78f233837847",
"location--b1a8187e-287e-5825-bc8c-f81858867685",
"location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"location--f16cd89c-095e-5121-984b-4700a3ed6d8b",
"location--f7e7b770-0145-5dd0-a2da-07aae35cb4b2",
"relationship--0f4db630-212f-530e-a8f7-7a219039246b",
"relationship--11638a91-285c-513f-816c-d23a98663571",
"relationship--162ae139-119a-5796-84c1-40c575522f54",
"relationship--1ce49ed5-568d-5999-8be5-2f93333998f1",
"relationship--2041c606-faa3-5f17-a252-ef12e7760e04",
"relationship--21f6755f-9002-5cde-bbbc-1a19dc20f0d6",
"relationship--253d9d99-27ad-5489-8289-0e612887b3cd",
"relationship--2558fafc-0336-5901-8882-8ef4f4025364",
"relationship--275028e7-b1cf-52c7-a97f-2fd53aec4f45",
"relationship--2bfaae88-788e-5285-b9da-8ffec0123b73",
"relationship--2d97ca3f-011c-5bab-8319-74d85938bfd2",
"relationship--343d575e-6025-58d2-b844-b121e74b8f83",
"relationship--344f4dba-394b-56a3-874c-e43055ccd746",
"relationship--36a05feb-0432-5931-ab94-67dfc6a3d0b7",
"relationship--3ba06534-0a8f-5a78-a86d-e5b6c2e1d031",
"relationship--3c0d5598-7f1d-520a-9594-c1ccefc8fec6",
"relationship--4237b0b8-1271-5813-bcc0-93d7b5e4bd30",
"relationship--433c192e-d4ab-55cb-8298-cbadc305b6bf",
"relationship--4425f17d-c171-5944-8fb3-92c990fe1ccd",
"relationship--4440215c-cb49-5cd0-9a7c-eb8c66dccf19",
"relationship--48394a41-4cf0-50a8-9326-f119aa4f92d2",
"relationship--4c071e6c-0f6e-5490-9a01-deef898cc5de",
"relationship--555da556-2977-562c-8543-6a9635180e5a",
"relationship--55c59446-07e5-53c9-8f89-038755ecdb64",
"relationship--58070cf5-f17d-5086-9d06-17341b03b316",
"relationship--595156aa-a743-53dc-b6ee-8324871239bf",
"relationship--5bc24784-f947-5854-8b07-16a2f3be98f3",
"relationship--5d4071f6-2706-5c17-89bd-60af6388aa4f",
"relationship--626b8a09-b1a5-52c6-ab95-4472ad3ca712",
"relationship--632d8f6f-a833-5a3e-a57b-0f09bf368733",
"relationship--653786c9-73d6-5ace-85f6-8a57df799b28",
"relationship--6745e8e2-96a4-5612-8ea6-bfb3de852fa0",
"relationship--6b4d2530-964a-5f39-b93c-867fe8ac23c4",
"relationship--70ab2fa3-352c-577f-a527-b72465c28729",
"relationship--76468000-8fd8-5b1b-9b14-b748b9c8cf15",
"relationship--77a96499-8926-5389-8f0b-f111421c384f",
"relationship--7b154437-03f7-5fa6-808c-230436439b2c",
"relationship--80355ea0-2bd5-53cc-9fae-bc621dd19194",
"relationship--9362988e-6c2f-5440-8935-f6b87dfe2591",
"relationship--93afb623-166c-50a4-9918-416cb701a327",
"relationship--96f29996-4b9d-5348-ac94-e41e7a81096a",
"relationship--984bb356-3691-5842-a7dc-67fe5b220e72",
"relationship--99b19417-5bc9-5d00-a1dc-11e91d01fea8",
"relationship--9a5db5cb-4a8c-532e-8311-434535dddd0b",
"relationship--9be56f7e-ff0d-55e4-b46f-c6d9249ffe72",
"relationship--9ede3252-f857-559c-af26-36a13c1fbc0e",
"relationship--9f60524e-feb3-5b59-860b-befa514f2117",
"relationship--a70494ff-f145-5e98-a1fd-1a536024236f",
"relationship--a7a0ea5f-fc31-5c2e-a983-30ff91aabfc6",
"relationship--a9b85dbb-c7a7-5a5e-af37-47309dbc8967",
"relationship--aa5a39a4-fff7-5386-9371-90d5149ebb58",
"relationship--ad333783-b8b3-574b-9757-b7b6c4526cbb",
"relationship--b23fc5f5-ae57-5df7-9ad8-155320f54bb3",
"relationship--b3124f69-bf7e-5df6-97cc-bc9ef127e57d",
"relationship--b94a3201-41f5-53c6-9f81-0eb45e449e08",
"relationship--bb338d42-c14c-59a6-ad06-3bc09dff1956",
"relationship--bb47e75e-0085-572a-8c31-094fcd766453",
"relationship--bbf3c3fb-297a-5385-897c-14eeb82db640",
"relationship--c09e3acd-683c-57e6-a529-6891cf0d4bfd",
"relationship--c1900c9a-e9dd-5b5a-b1b1-1fcd5aed310e",
"relationship--c67496e0-462b-5230-9f77-946b7068cc8f",
"relationship--c797cb2f-d6e4-5424-b16b-6fb47d5f490f",
"relationship--cac0db8c-6f7c-5436-9e64-540648579024",
"relationship--d35ba6d5-a444-5244-9c0f-ba8b7267c844",
"relationship--d50bcb22-5b7e-590a-b6e8-98e05f5ebf87",
"relationship--d588169a-c266-53f1-8683-b88e791f6601",
"relationship--d66a8825-dbf2-57e4-a7ce-fcc84a3b15c0",
"relationship--d8bfc133-5f94-5eee-b4d9-8b1c41c4c4b5",
"relationship--de15b7d6-c4e7-55a1-ab0d-50b512da3ed4",
"relationship--e1d155bb-8465-51bc-9b6a-b970df521f1c",
"relationship--e682f8a6-4520-5b02-8c5f-7182847db20e",
"relationship--e962f6c1-3b40-59a3-a4d6-52ed62542f6f",
"relationship--e9f31fbe-736f-50a6-ac3a-ddae11f349c1",
"relationship--ea038e5a-6b42-5399-83f3-68c09dafcfe1",
"relationship--ebce98cc-211c-5fb0-8d8f-72706e504308",
"relationship--fadaf99f-bcbf-5942-9dfe-2715d86d1fe3",
"relationship--fb29fb6b-8e7d-58fc-b671-1b5447d8c230",
"relationship--fe556712-ab51-5ee1-9bd3-9c1f8b4589e6",
"relationship--fee5660a-8d5b-5b3e-9d2f-d6df1e05d2cf"
],
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q2-2026/"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--8e4f6b79-b8e5-5ce9-91ee-015ca40c4752",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-25T00:00:00.000Z",
"modified": "2026-08-25T00:00:00.000Z",
"name": "OpenAI threat reporting, 2026-08-25",
"report_types": [
"threat-report"
],
"published": "2026-08-25T00:00:00.000Z",
"object_refs": [
"attack-pattern--758f2786-68fa-4c9e-bce3-0b09ea00978f",
"campaign--084094f2-cc4d-5205-a8b2-79dc3be9789e",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"relationship--29e212a9-bddc-5900-9a9c-4d237fedf699",
"relationship--e8082b8e-6743-5313-a0f5-24498a383f68"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-influence-campaign-russia"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--9d87d0cb-8611-5197-b296-6a9cca4f4211",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-09-24T10:00:00.000Z",
"modified": "2026-09-24T10:00:00.000Z",
"name": "TikTok, Code of Conduct on Disinformation report: September 2026",
"report_types": [
"threat-report"
],
"published": "2026-09-24T10:00:00.000Z",
"object_refs": [
"attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"attack-pattern--d6be7b47-6d49-4859-b741-e1547538c079",
"attack-pattern--e6a5397a-9515-4ba6-80e5-8f1fe273b7a5",
"attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"campaign--0d154eb2-3ed6-53fb-b3ad-d9faa3e04b3d",
"campaign--0f88c402-60d2-58da-a0fd-a0b712b8de93",
"campaign--1de08901-c78d-5692-be20-3c7c026f5f5d",
"campaign--450be43a-161b-5e75-93c5-fc7c5f2c9575",
"campaign--49cb9404-16a5-5f98-9f91-1491f957346a",
"campaign--4c8c1659-e567-5af4-889e-7c85f404ed1b",
"campaign--511111d9-5950-5683-ad7e-9f10fb20f05e",
"campaign--67550555-c2ba-576e-b511-0deee51bbeab",
"campaign--6b49a745-8142-5614-afed-b6ae8dbdd38a",
"campaign--70655dea-9bb0-519e-9f28-321790b45d82",
"campaign--76cec045-9f0a-57af-a9f0-6640455f4c44",
"campaign--885c8a1c-c2e6-5689-9477-9acf6c41aa57",
"campaign--adc89117-68bb-5590-a3b8-5e125f6c500e",
"campaign--c8beb4ee-eea1-55d6-bc07-e72dfac80023",
"campaign--d71f2309-c4e6-5855-8098-ece7bf841029",
"campaign--ea1f7502-8c62-5154-9368-864ba0b2080e",
"campaign--eb31fbb0-39b6-51d9-a28b-a2a0ba838a20",
"location--0ad6240a-6a8c-5e1a-9ca0-3ee577b93ab3",
"location--309c0940-ec30-5293-becf-577b59073faa",
"location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--5222cce1-00c5-569e-a944-437c7dcab236",
"location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"location--8116ecca-9f0c-5cd0-b40a-b3cfb8ff776b",
"location--8605a628-1249-532f-8293-4eb9be796709",
"location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"relationship--0326d616-0b0a-5a72-b304-530657ef528a",
"relationship--0d8de4f1-a677-5d5d-86fc-72882f5e7b96",
"relationship--0ecd1771-b4ba-583c-80ad-9a45b2c622ed",
"relationship--1bfed2e4-94f1-5fc8-ad7b-659c1e9592f8",
"relationship--22214be4-39ad-5e2c-98f1-c2e2307c14f1",
"relationship--2459063a-e163-5894-8865-6cd7e5196b0b",
"relationship--2ca9b806-a9de-5ee8-96c4-fbad0610109f",
"relationship--35295ca9-9382-5919-b046-d4dcff4c501a",
"relationship--38ae6258-a05a-50be-8546-8799fcb0fd8f",
"relationship--396fa75f-bf0e-5d27-9b04-4e91e4b1cf3f",
"relationship--3d7d1d86-8582-5f2b-93c3-378b9a212ca2",
"relationship--3eeaa4ec-a4f7-58ca-8549-4e64b72120ce",
"relationship--42d4e57a-8c73-58ec-bcc9-d4057e0f460a",
"relationship--440cb2c8-279b-577a-96fd-398511f803fc",
"relationship--4996ddb7-a5a3-5783-9094-b79ef9886573",
"relationship--49e5c94d-0ee7-5b39-b69a-b767b550aae7",
"relationship--4c3e8725-1b27-572d-96e8-0783b605b0a8",
"relationship--65637eee-99a5-5e55-8d85-ba99d7b30a22",
"relationship--663150cc-5836-544f-85ee-b776ae42a0fc",
"relationship--6ebc0257-4596-5f77-8a3b-77afed60a088",
"relationship--73256bf6-d2ad-5dc2-beb3-8d645a9b3268",
"relationship--7461639c-c978-5a83-9937-03b4d6058a05",
"relationship--75515dd6-cfb1-583a-9d83-fd34675b93bd",
"relationship--86a19ab7-02c0-57f4-8d16-4f3c811ece18",
"relationship--90c157ca-099c-5231-8d48-6c5387c0111c",
"relationship--9a3087f5-d64d-5544-98ba-24809c456360",
"relationship--9de2eb13-3e32-5d33-bc63-9a29ad48dcca",
"relationship--a5bb45b7-41ba-50c7-877e-836f638033f4",
"relationship--aaa69c4e-0ab0-5ada-9bb4-c23615c913be",
"relationship--b132b387-b8d9-5dfe-9e12-8e25d3e34de3",
"relationship--b59a6969-9bd8-509b-814d-2319ea281fae",
"relationship--ba236953-51b2-530f-9438-9d73a6a8d1a2",
"relationship--bd82954e-1d83-54aa-9aef-956e58c9c818",
"relationship--c14af99e-4f63-5899-9d97-d20f02209b35",
"relationship--c667b606-45af-5636-89f6-915bb34fb620",
"relationship--c6fb6b7a-a6d3-5e31-98b9-e1dd37818c9d",
"relationship--d31f7c9d-b7e1-5f72-b13e-4700e3dbfdb2",
"relationship--d9f475e0-9af5-5876-90ff-eece25b3beaf",
"relationship--e67ccfdd-1bdd-53e6-b7a5-fe2bdd3b624b",
"relationship--e6d2d8e0-6c52-56f9-b342-18df3b1ef282",
"relationship--e718b317-ca81-5200-9d0d-6b99e1eaf09c",
"relationship--e919ca3b-8ce7-54b7-a679-cf68317140f8",
"relationship--ef849191-6b78-58e4-83bf-b42b5a0b0cab",
"relationship--f0b40202-8ee1-5b6c-9a8a-f77f09a45689",
"relationship--fb9472e3-644f-5b9b-b6c5-ca948b594ff5"
],
"external_references": [
{
"source_name": "TikTok, via the EU Code of Conduct Transparency Centre",
"url": "https://disinfocode.eu/reports/tiktok/9"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--6df8bdb5-aead-5d1a-ade6-0c7c07eb9eb3"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--acc2870e-f2f8-52f5-a8fd-ba4c7ef62fee",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-02-01T00:00:00.000Z",
"modified": "2026-02-01T00:00:00.000Z",
"name": "OpenAI threat reporting, 2026-02-01",
"report_types": [
"threat-report"
],
"published": "2026-02-01T00:00:00.000Z",
"object_refs": [
"attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"campaign--442ad461-7bcf-5989-83d5-150654c6b9c2",
"campaign--6c99159e-9b8e-5bdd-8e61-219dbb198bb0",
"campaign--a1839976-d703-523c-9ffd-a2621f736f45",
"intrusion-set--0f66d5b4-0697-5b82-98d2-3b6b2f13021c",
"intrusion-set--8f83b7c1-ead2-5024-a6be-cb02351df72f",
"intrusion-set--fc39b5ba-b9e5-5891-b322-727a5494087f",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"relationship--1564cb96-52f9-5c1f-9f90-68debd1de2e7",
"relationship--3a278ad8-f6ed-5778-a32c-dd65a054d332",
"relationship--3b7f34d8-52f0-5f4c-9ecc-ebd9a37663ac",
"relationship--481ed58a-bd60-5354-9978-402a94f77557",
"relationship--63cfeffd-d6e4-559f-beb3-d0f97f63a074",
"relationship--9551272b-6f8b-5e18-8dec-aea021271478",
"relationship--d7d4c054-9a77-54c2-ab5e-7d65b71d8042",
"relationship--e203a283-ed17-56a8-9cf0-07241c20247f",
"relationship--eb610092-673a-513a-98c5-94860665d2f6"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-cyber-special-operations"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--afe0bf4e-f050-56d0-961d-df1f61ddc3b6",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-30T00:00:00.000Z",
"modified": "2026-10-30T00:00:00.000Z",
"name": "Google Influence Operations Bulletin Q3 2026",
"report_types": [
"threat-report"
],
"published": "2026-10-30T00:00:00.000Z",
"object_refs": [
"campaign--031c32ef-bc4d-5f3c-a280-3701e3d5623d",
"campaign--040b8407-b7de-504a-a6e1-540fa213821b",
"campaign--067e3e1e-c34f-562f-a68e-13134eb4627f",
"campaign--0801eaa6-b154-5493-9d46-41819163d992",
"campaign--0c2280f5-30fa-5a9d-9854-76d39854ee32",
"campaign--0e228e95-3f42-519b-bc19-58bfd09fa17f",
"campaign--1493f118-83fb-58a1-a37a-9213f5bba9ab",
"campaign--1539d6ee-fa29-567d-b06b-6c4e63908925",
"campaign--159cf81f-72ae-585e-8bae-f3cc7a3ddf82",
"campaign--17afe927-1209-5278-8a85-db38a8148a58",
"campaign--183b73eb-d2b8-5896-ab9f-976a1a100d89",
"campaign--1dd6916f-dcc0-5c90-8587-682257dc94d2",
"campaign--1f48336b-7de8-5e42-9a07-ff419347895c",
"campaign--1f67d854-7779-51b3-ba25-5c9da14026bb",
"campaign--2234ebb3-0a76-5a15-9ef5-1fcc59f00183",
"campaign--26dd38f3-7ac6-5258-a78f-6f35adeb70a9",
"campaign--29e10eed-4b94-57dc-a06f-71f701a7262a",
"campaign--2bac5e13-e7a7-5a6f-9752-64a8c45026c7",
"campaign--31a33830-83eb-53cd-9c70-debcabd9e49b",
"campaign--31c80d24-b1b7-580f-869a-09418fcd4784",
"campaign--31d26223-b76b-547b-b4b6-a65be8af617f",
"campaign--33942079-14cc-59ef-8a42-907f6890a7e4",
"campaign--3415c078-7550-566a-a362-7eaf930748e5",
"campaign--36decfd8-cdc6-598d-a6cb-5b6fc886f2dc",
"campaign--390d981f-469e-5e73-bcd7-731b9bcf70ba",
"campaign--3d9a4f91-a2f1-5295-a2d7-7f262814151e",
"campaign--3d9dc53f-07d9-5670-aeca-352ba7fb3d1e",
"campaign--42bf4083-84b9-5700-b88b-a51e374084c8",
"campaign--432270d1-6ea2-50f1-b626-f0305d3d9f1a",
"campaign--4751d1dc-6f7a-58c8-a52f-8bc8d416a0e0",
"campaign--4c7184d1-210e-5c5b-8920-c03eef9b7643",
"campaign--4cf59072-3bbd-5f24-9441-a6dd98ecdce2",
"campaign--4d56fd16-af11-5f98-bc43-c8bfd7486d0c",
"campaign--4dcf74c2-1a92-56b4-91fd-db45f00b6f6d",
"campaign--4e6291c0-4696-5b0f-a38c-716e9983dd24",
"campaign--5030645f-be1d-5a54-b14f-7c92b279830e",
"campaign--5036771c-86d5-54f0-bac1-8584c7048521",
"campaign--57544b96-3d03-5f9e-ae00-6e9d8d108d53",
"campaign--5b364c78-75d7-5970-9058-69642dfd7b87",
"campaign--5ee28ef1-39ce-502c-bc91-3d37cd42347e",
"campaign--60432786-36b0-54f9-9952-6560c6b06478",
"campaign--62041f62-1c9d-5a8e-a695-62c8a25e9213",
"campaign--680e1ac9-00ec-53ec-bc0b-9fe8567dc8e5",
"campaign--6ae0f9e4-47ea-5069-b9c7-2fe2ef189459",
"campaign--7279514d-6819-5eb8-9e60-2085ec6d03eb",
"campaign--76cd6da8-e358-5d67-b799-37af8fd385b9",
"campaign--784b45b2-4ca1-5d96-a490-1db3565762c0",
"campaign--7ad2d38f-4849-576c-a467-f9ccd31cee66",
"campaign--7b8495bf-efbf-53f6-ac1e-761a1372d238",
"campaign--7bcd0c89-09c3-5bc0-b3fd-028407474d88",
"campaign--7d62e734-c557-5b0b-bedd-b47fa34d8264",
"campaign--8086d2f9-75a8-58a7-b73e-402354770117",
"campaign--830831b4-6799-5ae0-a077-ddfeb79aebef",
"campaign--889e0d0a-a93a-5aa4-b31f-edf29f2091d4",
"campaign--8beeb6ff-6aa2-5e20-a038-57758af2f328",
"campaign--8c284afc-2c67-5eed-911d-4e4f63f3d09e",
"campaign--8c5fed14-97af-5c33-a0c9-c09a81bbbb9e",
"campaign--8d969f9c-4ca7-53c8-ae28-09b1e8457995",
"campaign--92e666b0-1271-5652-a030-27147369851f",
"campaign--9a703a7d-1c2b-5fd9-b8f3-73a5c15daaff",
"campaign--9b34450f-1387-5916-bd01-65c7025b97f8",
"campaign--a4987d5c-e8c9-59dc-b2e6-0e33b658c1af",
"campaign--a6afbb10-3ac8-5133-bab3-e83393443dcc",
"campaign--a90a7028-83f1-587d-bbc1-625b8c00b4ba",
"campaign--aa152686-669d-556b-84d1-0afcf42c2777",
"campaign--acccc183-ad58-5547-9a16-aafe3c49d5b5",
"campaign--b286193a-c652-542b-9531-898c3c677d90",
"campaign--c62ab781-082a-5623-a497-0b2cc2baa4d3",
"campaign--c69a38f3-7826-50d8-bbeb-24cc8c1f4f66",
"campaign--c8ab141a-7742-5a6b-a2b2-8f116d86f236",
"campaign--ca4ee82c-8832-51e5-a867-b5109bcf8c62",
"campaign--cb39c69a-93b9-51ea-9e58-d2818880343e",
"campaign--cc7db5ac-d042-5659-ac94-e6be04d30b45",
"campaign--d01a842a-55ee-524b-8cb5-edceca3fbdd4",
"campaign--d30fd973-dc75-5d18-9b67-e7ce56e267d1",
"campaign--d3e5db65-8774-5efb-9d54-9d70ab1252f2",
"campaign--d6c187f3-3cab-506f-8fdc-095ef21a21e7",
"campaign--dcd786f5-712a-5a52-9c92-60143faaa85e",
"campaign--dd581ffc-088a-5b61-b8f8-17ca8e9d3b30",
"campaign--e09ae2a5-af83-56a1-8297-55022de55013",
"campaign--e5990cf5-ff4c-549c-934b-892f634c7386",
"campaign--e8718c8d-4337-5ddd-a5fe-996952c5f5c4",
"campaign--ed137401-2f33-5ac8-9dff-d8eac46b370e",
"campaign--ed94f134-53dc-5b9d-bf2c-dc2a16b040b5",
"campaign--ef08211d-194d-5e0f-8f73-03a6535ff05c",
"campaign--f3f6d9d2-d4a8-5995-a20c-62ec35463404",
"campaign--f5bbc44f-8238-53eb-96b6-f0037589151b",
"campaign--f6fc1113-7504-50fb-b8b1-76f7836f0b44",
"campaign--fa1fead0-20d4-5596-a3f9-7efa84e09cae",
"campaign--fb805297-becb-526c-b3d6-b2b7be59a2b0",
"campaign--fd098c21-c1cb-5abf-90ca-fd85d2d9011f",
"campaign--fde21c03-3f30-52e0-800f-322f5578191b",
"campaign--ffb0f3ab-2d9f-5ca2-b9dc-d30341c13c19",
"location--08c97afe-2658-58f0-b757-c61ee4cc8e9e",
"location--2df297bc-6e93-59f1-b681-26fcd9e4fcac",
"location--309c0940-ec30-5293-becf-577b59073faa",
"location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--5222cce1-00c5-569e-a944-437c7dcab236",
"location--5a16ad21-ba07-5839-86e3-722295e17a92",
"location--623d4362-7695-5c21-84e9-3e330de7266a",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"location--74be65f3-a92d-5c17-b866-420156ca322c",
"location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"location--f1c00926-5352-51c2-9fa1-baaa81648068",
"relationship--03ffddf7-beb4-5fc3-8a12-2ae797d9d9f1",
"relationship--057b4391-7fde-5073-a551-e2fb3912c0db",
"relationship--09b3299f-f1aa-5476-bf4b-abbbffbcd3a9",
"relationship--0b8993c7-0772-5cd5-8fd3-4a50deae762c",
"relationship--0c0bc991-2fcb-59d9-b710-dbf8f7a713b2",
"relationship--0d7a48d3-96a6-5f4e-b925-7e207bef533e",
"relationship--0d81b093-287b-5cc7-bf98-425da9aa3520",
"relationship--0fae243f-9787-55de-b1e7-8080c065bd07",
"relationship--10be10ff-375c-5221-ba58-c69a89d1a342",
"relationship--129e993e-a1c1-5d40-94a0-088842e47bb7",
"relationship--1b786827-2938-5286-9a76-e30315996e34",
"relationship--1e1cc3bb-4c2f-50c9-9486-7b82b3e1df59",
"relationship--1ee445d2-ec2c-5bf6-a2a9-c5f779c89fd3",
"relationship--2494e260-01cf-597c-9d93-f9b1a4902060",
"relationship--25ed6d29-da37-54f8-af5b-542b4f97521e",
"relationship--297e5739-3b85-5461-8273-5b8b8272bc04",
"relationship--2acbf825-6f85-5731-beac-cc660582cf51",
"relationship--2e871a18-1b4f-5872-9c3b-ad33a239c428",
"relationship--3850a472-1ad3-5d20-b4d0-4ebea94fde4e",
"relationship--3926e0d6-d697-522f-91d8-84af92b17763",
"relationship--431ebec7-d564-52cb-9fda-c22c25ec5314",
"relationship--497b31ed-0edf-57b7-bf90-91811f20e0cd",
"relationship--5331e8b2-e131-5888-890d-2ba321628735",
"relationship--5814f0cd-ef4c-572a-95cd-db513e86ccfd",
"relationship--5a337d56-01da-59c8-80ea-f176ea304ecf",
"relationship--5aea479b-bc7b-5133-9557-edd2a42c70e0",
"relationship--5b184b8a-17bc-568e-9857-b09fa44736e2",
"relationship--5f72656d-e992-5b0d-bd25-bf9d4006ba26",
"relationship--630791ef-295e-5104-8dc8-93908ecbbf87",
"relationship--638d2c2e-a39b-5b49-92f7-a31c7a55432b",
"relationship--675b901b-6469-5fe0-9fe5-f97885fe6a31",
"relationship--67612e3b-5a5a-5972-ab06-70d6bbcd4701",
"relationship--6c26dd31-4c54-5a05-8d0b-23356291f665",
"relationship--6dcc440b-3dda-512f-89dc-c98067a0580e",
"relationship--71e06a82-f713-5f4b-a0ff-b164798beb12",
"relationship--76b4b7ff-04f7-5e08-81c2-d99388c39b25",
"relationship--779badb2-af90-58e3-88d6-fec331f568e0",
"relationship--7d4c075e-0429-58da-9483-ae177c5ce275",
"relationship--8258d821-f09b-5746-b0a6-5ff54448f522",
"relationship--850c4a91-f5ca-5079-b7c2-a2b64feca0ed",
"relationship--8624ecb5-03c7-579d-942d-1a0846eeff5e",
"relationship--86eb1e02-b993-552e-9567-d68a566cb642",
"relationship--9137d783-ac59-5ff4-b460-ea73432c7d60",
"relationship--986ffce5-e665-57b7-80b2-9703924aa3d7",
"relationship--9e19fafc-9d5c-5194-89c9-d08fbe45f709",
"relationship--a01c74f2-c898-5855-9430-692484ce38a2",
"relationship--a13f9908-02b1-5d56-b4be-e3f2bdba666f",
"relationship--a5b38768-c41e-5a75-8715-53f545e9b6fc",
"relationship--ab77ed09-9c73-512d-8477-e540a2abccc9",
"relationship--b02a9b9e-2c2a-5098-8cc4-36eb278f569b",
"relationship--b02e96ff-2a0e-5743-9ade-a19ab13d9f51",
"relationship--b192b29a-14ce-51d8-a4d9-e53af315c254",
"relationship--b1e2714c-a8f5-56bd-ab45-59f9f1bd7f69",
"relationship--b35e5566-54d5-581f-9234-a4b61ccea8c0",
"relationship--b6a8bc6e-b144-51f9-85e3-c090b40d7124",
"relationship--b86f2816-3487-5869-a50e-10e87ebe3a52",
"relationship--bccdc05a-f18f-5225-907f-2d44607ef4b9",
"relationship--bfbac6c7-92ca-5e0d-a051-e712825ff254",
"relationship--c303bb88-6eea-5e01-9684-d0ac360be49f",
"relationship--c7b48b79-37b4-5cc8-b37f-0e076a76b42e",
"relationship--c8c093ed-593a-5dc7-a954-d79580e04b4c",
"relationship--cc5647fa-6ae3-53db-8717-451e28bb65f8",
"relationship--cf650958-3393-5ae3-9504-d276be301f03",
"relationship--d11acb93-8632-59e1-a42a-4bacbb0e7eae",
"relationship--d382f02b-211b-5f3e-99d8-50cfda252f7d",
"relationship--d8c0ded7-9fe9-5ee8-a9e7-d782ad5344eb",
"relationship--e450ff6d-4da4-5541-a151-1c8b5685817f",
"relationship--e7ea6e4b-6150-5a08-93d1-36fd53537606",
"relationship--e99516ce-57a1-56c5-8239-1b68fa001c30",
"relationship--ed4ab441-1aa8-50f0-9917-2e36335846f4",
"relationship--eda5058e-5c7d-5fd3-ada4-79537e68572b",
"relationship--efef5175-58ba-50c0-8a27-98d7dba22121",
"relationship--f42b9432-2bd3-50b8-b9b9-1d4316c4d2cb",
"relationship--f57d941c-c4cf-529b-bc56-e9e6247a89e4",
"relationship--febdd1a6-9072-566a-a63a-d32379ab0021"
],
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q3-2026/"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--b6925a16-d9cf-5415-a5f5-a40f14adcb7b",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-10-01T00:00:00.000Z",
"modified": "2024-10-01T00:00:00.000Z",
"name": "OpenAI threat reporting, 2024-10-01",
"report_types": [
"threat-report"
],
"published": "2024-10-01T00:00:00.000Z",
"object_refs": [
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"campaign--1b823e58-f436-52ae-b6c5-f48a28223e45",
"campaign--2815320e-0b34-593d-81fd-c3edbc558b06",
"campaign--a2ca4610-8bbd-5246-a218-03cd8cd82239",
"intrusion-set--bd055bb4-ecb8-5bf6-9689-7af9b0bddcfb",
"intrusion-set--fd46a43e-be19-54ec-92d7-29324ecb6a0c",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"relationship--0727994a-04a9-57bf-b230-fedccb8ae35e",
"relationship--4f5fb755-3044-5b55-9c53-ed81e5657f6f",
"relationship--984d77fc-9f39-5aea-a82f-5899839d6842",
"relationship--9909aa4c-e4fb-537c-aa4f-373000c18a72",
"relationship--9ef01404-70f3-52a0-bb66-1973a15069b4",
"relationship--a5890c00-921c-58c4-bf3a-c1d356c60365",
"relationship--b2776fe2-46c8-5da4-be9f-ef673d9bc4b2"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-a2z"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--be32315a-1f69-5d5a-ae7b-5b90be079bc7",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2025-06-01T00:00:00.000Z",
"modified": "2025-06-01T00:00:00.000Z",
"name": "OpenAI threat reporting, 2025-06-01",
"report_types": [
"threat-report"
],
"published": "2025-06-01T00:00:00.000Z",
"object_refs": [
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"campaign--0c1a648a-dca0-5d97-83d3-951d51e71a0f",
"campaign--4deb1947-2ad9-55fa-a4e1-0a4b1ad08d9f",
"campaign--6af87921-ff30-5a97-b16a-cc0c27c2fd5b",
"campaign--a6cd15a4-bb74-5fbf-aa4b-6e9e4fab862b",
"campaign--d2b8854d-5780-5a24-9cda-cd81b5022ef2",
"intrusion-set--9482f58f-8fc4-5b9e-842c-f159baf92e77",
"intrusion-set--b5fdce69-b4c6-5b00-bc0a-c4734138c1db",
"intrusion-set--bd055bb4-ecb8-5bf6-9689-7af9b0bddcfb",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"relationship--181c570e-57ee-5014-a18f-2308d3604717",
"relationship--3050d173-e824-505e-ae77-b9dac6f00d1c",
"relationship--6be9d7e8-c834-5788-873c-28919ff93128",
"relationship--83eabeb2-74f7-5356-8a28-2e1f7028361e",
"relationship--84746deb-22ca-5ea9-9817-45893421b0c0",
"relationship--9a868e67-5d46-58f7-b307-728d06d02229",
"relationship--a50ae457-c422-56b0-8a59-bb83cd09cb7d",
"relationship--ac46c28a-8898-543a-b383-2c0b35d98cc0",
"relationship--dda230cd-578c-5dcc-a90c-610e01606872",
"relationship--edab3879-f3cd-53ef-b51d-2092a3d8be9e"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-malicious-uses-of-ai-vague-focus"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--c08dc7ea-2e63-52ff-b720-8f9f29449726",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-03-31T00:00:00.000Z",
"modified": "2026-03-31T00:00:00.000Z",
"name": "Google Influence Operations Bulletin Q1 2026",
"report_types": [
"threat-report"
],
"published": "2026-03-31T00:00:00.000Z",
"object_refs": [
"campaign--054b8550-ca46-5176-b1ca-5c1f30a97b34",
"campaign--07b9cbf7-a224-5652-a193-7e89a472eaa6",
"campaign--09f7526b-9f9d-531a-8834-01aa44a17239",
"campaign--0b533052-2db0-5af8-bf83-ace5356d83cb",
"campaign--0dd5dbf1-6d0d-50dd-8c37-ba4abd26e156",
"campaign--11d5faf4-aa35-565e-b3d0-8aaac8a41b97",
"campaign--14215421-a93b-5a78-a2a4-33a91604b5b7",
"campaign--1837ea67-aa42-58f4-8702-2681eeaae445",
"campaign--1856c372-4204-56a4-8281-4c59387c1875",
"campaign--1978f732-7ee7-5466-89b4-3990ab6b483a",
"campaign--19b9a6c6-dedd-5b57-9134-244bfd79b192",
"campaign--1a226633-8622-565d-b196-52fddc5f0b22",
"campaign--1aca2a4c-69e4-5815-a81d-a26477ba5aba",
"campaign--1d617535-bb3c-5be1-a1d1-726e286ab67e",
"campaign--2044e595-730b-5fbf-a2d7-971354272a76",
"campaign--240a84ed-0221-5b02-afcd-e7ef01be346d",
"campaign--25b0de2b-a763-5d84-a934-61b949d28354",
"campaign--26c2f277-7cef-59c8-82bb-f2fd02828bf7",
"campaign--2c3becc7-3c5a-5799-9814-83457c076b8b",
"campaign--2de658ec-6228-5553-8526-3d2eec057542",
"campaign--2ef807e3-ad82-562a-8b01-cb533af6874a",
"campaign--31b3bf44-a770-5f3c-a7ed-0eba4f37a36d",
"campaign--3246d9c7-6635-5d88-bfb0-2914e24f6912",
"campaign--33e773b1-78ba-5f29-88bb-fb111a34f6e6",
"campaign--3d7da887-67e7-54f5-95eb-7551a2f33a33",
"campaign--3f454965-9736-5d74-b99c-718fa0b8e017",
"campaign--3f7e3aec-a69a-5a24-a458-8759d161b42d",
"campaign--460143f1-96f4-5093-924c-96ca9b7896e6",
"campaign--470461f0-2b0c-5d12-8b12-f58bc5d1d3fb",
"campaign--4c5f4b2b-32cc-5799-816f-1c878c429739",
"campaign--4fc8e48d-1e1e-5af4-9633-32d3daa2dcd0",
"campaign--50052f63-c2d2-5ec1-8722-82f8318a5bc8",
"campaign--54ad9c2e-ebae-5804-a38f-4429bfa9d437",
"campaign--570073e5-01b2-5b2a-8537-b7475258be20",
"campaign--5858061e-8fec-5674-927d-ff6446b2259e",
"campaign--59e8bbe5-f7ee-5437-8c3f-44ea811c53b6",
"campaign--5b0aff67-df3d-5b15-859e-7dfb8370c9fe",
"campaign--5e809180-ea9f-5196-8c09-da83278de6ba",
"campaign--5f7c1ce8-e8ee-50fc-95d6-fa5045eb0546",
"campaign--614a0e15-1ea0-5a2f-8d3d-c75967f11354",
"campaign--663d149d-c84e-5fe3-83d1-c787d22f14c0",
"campaign--67a19003-c93d-597a-b12f-655d7398a19f",
"campaign--6afef5ea-7c10-5eaf-88a9-cc4fc9ace350",
"campaign--6f103d69-5e6d-580b-bc9f-b3fba943f2af",
"campaign--6f6f193e-4c5d-53a1-8eba-d7db5843dc10",
"campaign--748d6353-860e-5951-9acb-f95abf942fa9",
"campaign--7a4b7fde-d889-54dd-8127-e33e04024032",
"campaign--7b83dfd9-5429-576a-8b35-6d28ffd41b3a",
"campaign--7bbd0046-9476-513c-9626-6f395d35b99d",
"campaign--87fdeca7-e56f-54da-b4fa-662137552141",
"campaign--8b655e96-6a26-5321-a578-84d0e700e1eb",
"campaign--8c9b5d0d-1b00-5cb5-bf56-3152a7735a96",
"campaign--8cfe82a4-f272-5e3d-8f03-5aec0335d961",
"campaign--8d49a139-8e16-5a7a-be1a-6e82672c6061",
"campaign--8ea2cf15-447d-5fa0-b16f-6c9583511f73",
"campaign--9437a1aa-cc58-591c-8d46-5d9b1d78021b",
"campaign--9794a326-99c6-51e5-889e-7911b5e2a92b",
"campaign--9c79fd42-dd73-54d9-af9f-111182ace1cb",
"campaign--a165671a-d648-503e-91d9-464184e2f1fe",
"campaign--a200330c-b1dc-5b7e-bd29-3aceae271bc8",
"campaign--a3717f80-81cb-55a0-aa23-49131910567f",
"campaign--a66c42a2-61e9-5e10-ae9b-d04cc6855658",
"campaign--a98c3768-d3ab-53da-bd9a-aa146befdd08",
"campaign--ab3382a3-fda8-500e-9c6b-89ecba74b366",
"campaign--ab42cd0c-483e-57d3-9fba-8c29fb8e3da0",
"campaign--abbcfc43-1080-5c91-bbed-9272456a0248",
"campaign--ad224067-923f-5727-9f72-1379977b1b2b",
"campaign--af0d37c7-74f2-5f55-9e61-a4f689bbea6a",
"campaign--b09873d8-d3de-5662-9fb5-da049b2940c3",
"campaign--b83632a5-537d-5e0d-ae82-e2cb6065d72a",
"campaign--b90999b7-bae4-5f97-8d6f-66150b1a3574",
"campaign--bb8b2970-1d82-5a8e-aec2-8574ea63a04b",
"campaign--c0b34262-b8d7-56a0-a513-f91a5dd0df19",
"campaign--c33ed9ff-760f-55e5-8d8f-266927469b36",
"campaign--c5e91a3f-74bc-59e4-b5be-3457cb16a2b5",
"campaign--c8af1f11-afb3-5d3a-b913-0b2e84d9dc35",
"campaign--c90c51a9-984b-5ddc-8435-61963449dff2",
"campaign--cac1ade0-72f4-5c95-96bf-4ab30310b4d0",
"campaign--d54e5983-73b5-5338-ab13-e6429b5a9832",
"campaign--d7948137-1dc7-5fc1-9a8e-8851c35d4338",
"campaign--ddd2d9e8-931e-5b6d-a599-7c4419f910c8",
"campaign--e78aa57c-e247-5e3f-a5d4-8605a8e68f6e",
"campaign--e8bf6d43-442e-5d7d-96ea-1ea7231f8eef",
"campaign--ea335bfb-bd03-5cfa-a011-385c1b19072b",
"campaign--ee5b8b09-783a-54ca-ba76-8b8332dd49f2",
"campaign--f172a157-80d7-5379-9694-27f16dc1f59d",
"campaign--f267733a-6a76-5812-916e-dbabde1cccbb",
"campaign--f645b673-d1a3-5c49-a216-06f24b6166b5",
"campaign--f73558d9-46c9-501d-97f9-f26bbe1f0c88",
"campaign--fc30c14b-83d1-552d-8314-d8cf8cd04a20",
"campaign--fe5b1c6a-9801-5a66-a940-2e8771a78967",
"location--08713524-c6f5-5947-8b2a-1c4aff6c4802",
"location--0d222f42-9155-5679-ba8a-d001ac9fac35",
"location--309c0940-ec30-5293-becf-577b59073faa",
"location--333c4a91-5a0f-530d-a684-6da199c11bf4",
"location--36f1d41c-6121-5809-9eee-3dcb27e26244",
"location--3b4782b9-a3d8-598e-94ce-2c71295da398",
"location--4fd9a21e-ce8e-5845-bad0-b5fe3c00084a",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--73d55a0f-d489-5839-a741-4017e82b75c9",
"location--74be65f3-a92d-5c17-b866-420156ca322c",
"location--8116ecca-9f0c-5cd0-b40a-b3cfb8ff776b",
"location--863c7db7-152a-5cce-a7a5-e511525c7be6",
"location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"location--98733b8c-1f55-564d-ba69-9a69db59bfd4",
"location--a03825d9-e942-537c-aa9d-55a029969d38",
"location--a66c14a2-24f2-549c-a75e-b854b015cb83",
"location--b49b6f1a-097f-51c6-94d1-9b85dfad789d",
"location--bf22e52f-4055-58c6-9661-f8a1049a72dd",
"location--c0e1c283-ea52-5076-a82c-97f1aac3faaa",
"location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"location--d040b199-acd4-57ef-b937-c6ad4f5ee4d5",
"location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"location--edbabf65-5bf7-5fd7-839c-f5f96ea38f7f",
"relationship--0081d93c-2978-5d83-bc88-28a9279643b3",
"relationship--059667b1-1713-5f63-bb18-c852458a3b4d",
"relationship--068c6eeb-5045-5d71-b1d3-fa8fcce8efa1",
"relationship--0c66273c-0acf-595b-a022-82712c9ad517",
"relationship--0dd6c4d3-03bd-5ec4-9489-ad55fbd06903",
"relationship--1573f3e7-a047-589a-adc0-a4fd99431d37",
"relationship--17e88237-f0a6-5edc-8de8-89753a8a3d3d",
"relationship--182f0003-10f9-5b14-a20d-d88dc425bc5f",
"relationship--18a02531-ce1e-50fa-9776-7202778f4203",
"relationship--1aff40d6-0f74-5678-bcbf-2cda2386b646",
"relationship--1d2c7d44-0196-5a1d-bf3b-3995ade0cf72",
"relationship--1dd7cdc2-5c36-54dd-ab59-d612e19f579d",
"relationship--1e156e33-4f09-507b-80e2-9ffa2852eab2",
"relationship--2517a5b7-9fd1-5d44-b59b-e5b570b3b9ce",
"relationship--2af0b7a6-167a-5481-a7e4-e036d05353e9",
"relationship--2af45db9-6c13-5f9e-87d4-e16b780eb00e",
"relationship--33694ab5-5034-5363-90aa-33737033e2d9",
"relationship--4775bfbd-ea0e-5490-938a-3616f2e469f4",
"relationship--4a3b1cb4-e64a-588e-9a02-6b304f01bbe9",
"relationship--4b6d462c-3978-59d7-ad87-5711ca1fc2e4",
"relationship--4c32bf19-326a-565c-9cc9-c4a4a74e92e1",
"relationship--4ca2f697-a055-5ab7-8ba9-093579c22891",
"relationship--4ce0cca6-aa39-5e0c-84e7-2d6280296d03",
"relationship--5023c529-f9e6-5217-9644-7043d3c9f164",
"relationship--51af489a-b7ad-5b38-b3a4-3385451ac272",
"relationship--51b1a722-7725-5bd3-8e2a-37005c0cbd57",
"relationship--5365230c-c387-5f57-8bad-c7b9b9e45840",
"relationship--563701d3-c5be-582e-abea-9f7ec11eab7a",
"relationship--5a983a46-31a5-5fd2-bf6b-7d43e6ef7598",
"relationship--5d756285-51e1-52e2-81db-a079433fcd4a",
"relationship--5e217e2e-6322-584a-add1-a15b027ece1e",
"relationship--6334da1f-e419-5878-b5db-13d5c31d1cef",
"relationship--63c90b3f-5730-5df5-90fd-ce15298b11a1",
"relationship--65bfdd04-2139-5215-9c8f-d0696f7a3249",
"relationship--672f044b-28bf-56fd-8110-5f4b90e36b86",
"relationship--6748b20a-ad6e-5718-8bd4-6d80d3845d92",
"relationship--6a3d8088-bac8-5b5f-95fd-d4524ab7f9e6",
"relationship--6d105d9d-e94d-5683-9f04-84efc42ff4c6",
"relationship--72f54e4d-d9c6-5853-8372-0c7cf31e00b6",
"relationship--75072552-1b02-5f55-afd5-ca76bbe460f0",
"relationship--75f7a4ca-29e5-5f22-8ff8-4b4f62c28ad3",
"relationship--77a09179-fb41-5b58-ae46-def465bf24e3",
"relationship--827c3b6b-d38c-5124-a643-75ad7412057d",
"relationship--83981305-2e5f-5f19-8f76-38f90f3affd6",
"relationship--83d13fff-5645-508a-8572-e8d9fd3ce1dc",
"relationship--87ba1cbb-716e-5852-9643-1f16ba792a66",
"relationship--893afcb6-aee3-5281-a3da-98a794dd1561",
"relationship--89a5bcbc-7877-56da-b729-ec39e786c6f5",
"relationship--8a4d5159-071e-561e-83c3-e5d5994d08a1",
"relationship--915961e9-a1e0-5e4d-9b36-870b564d4809",
"relationship--a283f978-f784-5b49-9dae-8035625e76e9",
"relationship--a6dedca0-7e2f-5272-b016-130b74150817",
"relationship--a83a006f-1c2f-54e1-af35-bbe1a106cd92",
"relationship--b16bcfcf-b039-5a3f-b1c9-083456dec5f6",
"relationship--b57bf6c9-57b9-5743-8784-e8e7edae6eb7",
"relationship--b8ee98d4-14bb-57ab-8b6b-dac8b4cf1a31",
"relationship--bb6bb384-fe8e-510e-864d-128da0755aa0",
"relationship--bdbd3b5f-7c55-5dcd-9908-f7886d3ca165",
"relationship--c0486a60-7fcb-51c4-ab50-d84cf0e62bb4",
"relationship--c276aff1-d4a4-5269-9ca3-3412354fa552",
"relationship--c3bb3f1f-eb66-5514-b6c3-23c54c97d8ce",
"relationship--d531a5d7-62ae-52a4-9aa6-3beae6012c81",
"relationship--d6595c2a-09d6-53c0-a9df-4c3a0ba6e778",
"relationship--d939a313-3a45-56bb-b8e6-1a834ff785d2",
"relationship--db28b692-bc5e-5654-84e5-fccfbffa24d5",
"relationship--df1a37ec-14cb-5924-81c5-67c89d1a304c",
"relationship--e2741930-4f98-5a29-b180-8d79147de9db",
"relationship--e4d6e53a-9c33-5915-b9f7-6018cf05d1a6",
"relationship--e5b49a4b-e44c-5fa2-a23b-1f68bce8716a",
"relationship--e6af732a-65ec-578c-b957-03ec9cfdb248",
"relationship--e8ec3e46-2f81-5278-9d6a-ceb51fbf063a",
"relationship--e9e52f76-8680-50c3-9b64-037d94d1da8f",
"relationship--ed47bd48-b8bf-51ff-b126-6bb2b1ff4983",
"relationship--f52a1e6c-20a3-5e5c-bc27-3aa773a4ba71",
"relationship--f7bcef3a-0bd6-56ea-8400-1551eeafa500",
"relationship--fb4ab093-305e-5b27-a57b-ceb156282b9f",
"relationship--fbd364df-5e17-5659-ae89-18bce55d4780",
"relationship--fc6c511f-87e6-55c8-8cd1-560522f15ec8",
"relationship--fcd2f9af-513c-59b3-b559-d13b644d5118",
"relationship--fed024a5-365a-5a44-8e4e-a10dc58ca2bb",
"relationship--ffb883bd-a56c-517c-92eb-98d9d1eed1e5",
"relationship--ffbe6f18-7311-5554-b09e-648828f5e3cf"
],
"external_references": [
{
"source_name": "Google",
"url": "https://blog.google/security/influence-operations-bulletin-q1-2026/"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--5857f419-12dd-5ce9-87ce-fdfaa99e2569"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--d3b4589f-428f-57a5-bee3-6a7a2c889936",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-10-08T00:00:00.000Z",
"modified": "2026-10-08T00:00:00.000Z",
"name": "OpenAI threat reporting, 2026-10-08",
"report_types": [
"threat-report"
],
"published": "2026-10-08T00:00:00.000Z",
"object_refs": [
"attack-pattern--0cc5110d-f7a1-49f7-8667-ae454698f11d",
"attack-pattern--758f2786-68fa-4c9e-bce3-0b09ea00978f",
"campaign--21a9e08b-7d24-5d18-89a0-32e35b8a28de",
"relationship--4325b289-8e22-546d-a992-b950c6d8a459",
"relationship--7f3cfc8c-6fc0-5960-bdd7-f584210f3fbb"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-ai-enabled-false-front-operations"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--def36749-af1f-5437-9bb7-457d6a987e32",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2024-08-16T11:00:00.000Z",
"modified": "2024-08-16T11:00:00.000Z",
"name": "OpenAI threat reporting, 2024-08-16",
"report_types": [
"threat-report"
],
"published": "2024-08-16T11:00:00.000Z",
"object_refs": [
"campaign--55358f9c-a01c-56e9-9791-bd053a083b07",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"relationship--57dfb26a-9ccf-55a2-b1a0-8ac74db52a1a"
],
"external_references": [
{
"source_name": "OpenAI",
"url": "https://openai.com/index/disrupting-a-covert-iranian-influence-operation"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--bd7a8a59-e226-5d36-81d0-27f261b2c2c2"
]
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--f4c72e29-8ed9-509c-b767-4cf6d3474582",
"created_by_ref": "identity--b45d9bda-82a5-5ae9-a97d-42cf175dc058",
"created": "2026-08-27T09:09:22.000Z",
"modified": "2026-08-27T09:09:22.000Z",
"name": "Meta Adversarial Threat Report H2 2026",
"report_types": [
"threat-report"
],
"published": "2026-08-27T09:09:22.000Z",
"object_refs": [
"attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"attack-pattern--0cc5110d-f7a1-49f7-8667-ae454698f11d",
"attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
"attack-pattern--54d8019d-4687-46f5-a4c9-1b9414b80d35",
"attack-pattern--696cbb0b-74f4-4937-9758-3fe56e4b9535",
"attack-pattern--75d11cd8-2f92-4d73-97c5-27356c8a2758",
"attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3",
"attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea",
"attack-pattern--f5ce482b-547c-4776-b8ec-acd96c2322d3",
"campaign--0742750e-8c55-5e25-b45f-4522887a1ea5",
"campaign--0f0c4a29-e46b-526f-89f2-a7b005506d09",
"campaign--20ea8a25-b7e9-513b-b46a-95c7fba401d6",
"campaign--2a2fe8ba-cc0c-59d1-a252-827324873737",
"campaign--485644b9-9fcb-562e-ad30-3d35d1ebe32d",
"campaign--5c1c8851-8d71-54d2-8b72-a52ec8afcd09",
"campaign--83feb463-c342-5c93-972f-f3e869671482",
"campaign--a5f9d576-1ac2-5a2d-9ece-a926eb1469d3",
"campaign--bbdc9c99-ff9b-5e5c-8d7a-ebf062dc836d",
"campaign--fba28e92-ed1e-5b10-bbd5-e7459d135d48",
"intrusion-set--0bc341f2-5887-5e11-b8ee-cf73be1bdc68",
"location--0b0525e7-0456-5f78-9dfd-a54b131f9d5e",
"location--309c0940-ec30-5293-becf-577b59073faa",
"location--3396a3a3-8e7c-51d0-aab8-31b4faa47771",
"location--35d84834-709e-52fd-9de8-0bd6f7a19b3d",
"location--3cea18d5-5dc6-5601-84a3-2a1c325fd12e",
"location--46166d72-af7b-5d51-918b-93d521a25c9d",
"location--5010936f-7f92-5c31-81b2-27bb091067b5",
"location--5222cce1-00c5-569e-a944-437c7dcab236",
"location--55946fed-5d6c-5526-b148-42a1d53ef8f8",
"location--683242b3-110d-57d2-afb1-4d36ef3c0a11",
"location--68ebfdf0-8e61-50b8-9f16-00ecf3bb70ec",
"location--69465cf1-bbec-5a4c-a160-267e74315cad",
"location--6f4a1f82-fe4f-556d-a69b-ab947cafcd6a",
"location--87d79067-c5a5-55aa-a0b4-d15e935f3597",
"location--8f8ed59e-711f-5e78-a1df-0cee87e58869",
"location--91d429ed-a39a-5da7-9531-0f13d9a2576e",
"location--b24c1ba9-0eec-5b61-a93b-126fc4ac30b0",
"location--b778cc0c-cfa5-5581-bc2f-519fe0eb3768",
"location--c1b8fa18-b779-5765-a3d4-2a0b198b5f83",
"location--c2d377c2-d276-5cbd-98e3-452fb9ef5d2d",
"location--c312ded0-74c8-5aab-b687-6ef1f0b0218e",
"location--c7b38d14-1faf-5e54-a7a8-7a201b73dea4",
"location--dd43a0e5-6cdc-51ad-8158-cf7c595e918e",
"location--ddae6574-00e5-51a7-96dc-515c944e9519",
"location--e53db3a6-e1bb-5fdb-90c9-831f30385e05",
"location--e55973ad-2ae8-51d0-81ab-792a289b0658",
"location--f961e2da-6bb4-53af-9382-c0b1194f027f",
"location--f9d89657-cc44-5483-94ca-564d2fc36ec2",
"relationship--0079ef6a-7328-5922-9d85-1fc383ccd64e",
"relationship--07c881e8-abc1-5475-bc13-d52502145bd8",
"relationship--0960a6a3-1bc8-5d16-99c5-d94b34bb7cf7",
"relationship--0b78ad16-09a9-595f-98fc-47902d1492e9",
"relationship--117240f7-25d0-50b7-94a0-35b34e710a22",
"relationship--171ace84-6293-52ec-b572-4575dadd7bc3",
"relationship--1f8055cd-4d3e-593a-a3d5-80baccf5c69d",
"relationship--1fd375d0-dfbc-5729-98c1-f5a82d6d135f",
"relationship--217fa720-69df-59d5-8818-4b8def40540f",
"relationship--236978c2-ce3e-588d-9d6b-1a2572218ea8",
"relationship--243e1ab3-fc31-512b-bebf-de9219dd00bf",
"relationship--28062521-49ca-5e76-93e1-6cc4cb5e87cb",
"relationship--2d0cadeb-1e3a-5d9e-a3bf-cb9c01b83f90",
"relationship--33ce4d4b-f408-51c5-b13b-feb25f542951",
"relationship--344e61b2-6474-5dd4-bdb4-2768e1869b21",
"relationship--36edfd33-34d3-5a40-bfb6-79d6ef9c948e",
"relationship--36fa2c08-d710-57fe-b794-7caf730f6cc6",
"relationship--37a5f3f6-6361-5591-b888-cda024d28223",
"relationship--3c84ca50-e2d1-50ff-a392-8e16b5950025",
"relationship--4186d2a5-c993-5bf6-b78d-8411c16053fd",
"relationship--44fd0fae-9041-55dc-b75d-06575bc1f206",
"relationship--4b0361ec-e7d3-521c-b56d-bfb3dccc8035",
"relationship--4e1f3030-6ad9-5380-b3ea-ed5d1f9708b3",
"relationship--514999de-9431-599d-bb04-d51b32ef7dc9",
"relationship--520da56b-b51a-5162-9abf-0d81e07cc6b3",
"relationship--526102ee-fd2a-53ab-9e6d-adb76d7c09db",
"relationship--52d3fa90-e3c8-5171-a3b2-c3ccdbecd870",
"relationship--5505fcd2-c63f-5d32-80c6-32676a671f98",
"relationship--5b6b26f8-2b69-5d2f-beb8-5af3bd71eb3a",
"relationship--61585f84-0810-5b8d-ae1d-b007134345c2",
"relationship--6e51deb4-6ab7-551a-ae9b-a79e3f335265",
"relationship--6f6ac447-1d27-5861-b5c6-186d25162971",
"relationship--70fb9cfe-9429-5db0-b070-b302f55566dc",
"relationship--71ed6a9d-d73d-59ec-8780-6c13cd654e2e",
"relationship--724ded95-47e5-5067-b1a9-656986b1edfb",
"relationship--7776bb84-f2a4-531a-a2ec-5e5b681d0b59",
"relationship--7b1b68bb-4432-5100-8770-f18ef2f4e9c5",
"relationship--8caad1e7-a274-5c60-b991-758d5f04bf24",
"relationship--967e00c9-6780-5a87-9ea8-c909149ef7b9",
"relationship--9ff66bb0-8365-51b0-9230-600ed1eb4a0a",
"relationship--a2f3dfce-71c6-5937-9bd9-b9af436d86a2",
"relationship--ab3f070d-8b64-5945-93d2-16a47bb6daef",
"relationship--b2297ea7-3cee-5ed8-a399-89ee7827dd73",
"relationship--b9dacbea-b7c8-52d4-82d0-ee9656fca846",
"relationship--bbbd956e-a0a8-5ad7-9a66-bf9835f883f5",
"relationship--c1ffb695-3448-5cd2-bcc3-458e96448686",
"relationship--c5e967a0-50af-5091-a92d-4f9d618ddbee",
"relationship--c89a6110-4c2a-519c-9069-7e6e11c685f7",
"relationship--cab82ed2-4484-5902-bcf0-fed2c23485e3",
"relationship--cbbac130-35b2-5b2d-9fac-bc85d27d8608",
"relationship--d3ef505a-ade7-510b-b11f-622401cd729a",
"relationship--d4ede8b2-5fbc-5bdb-926c-65f440aca133",
"relationship--d5ac3195-2878-5569-bf5d-6bcdc8cbc7e9",
"relationship--db478d85-dc45-57f1-89ec-f4bba3bed63f",
"relationship--dcacd8c4-3fb7-5f68-8d6f-67f0411713f7",
"relationship--dda91c57-a625-5e39-bcf6-c0bfa70f6f91",
"relationship--e29c1ba6-4b8b-5b03-9e16-60fbb4ecbca0",
"relationship--e57b12a6-92a0-55a4-b6e6-cc1a3aa2aadd",
"relationship--e72b36eb-b59d-5806-a3e8-5d245f805700",
"relationship--e8f051c9-eba1-5dac-9a01-2a59bbbd4376",
"relationship--e9aa32ef-ac6d-5ff2-a675-0eef9e7a439a",
"relationship--ea061e58-e850-5d48-a221-f85c8e36bc24",
"relationship--ef24c395-a038-5483-a933-497c034f7cdf",
"relationship--f0a5f5fd-ab70-509a-ae6d-36229b0a4aeb",
"relationship--f63b2aab-dcb6-52bb-ac53-ab67d5d05fe7",
"relationship--f7545833-34d6-54c3-b1e4-6eb50d700d4d",
"relationship--f9923837-47e3-55c4-af7f-e1500b9bf7a9"
],
"external_references": [
{
"source_name": "Meta",
"url": "https://transparency.meta.com/metasecurity/threat-reporting/"
}
],
"object_marking_refs": [
"marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487",
"marking-definition--1b5403b2-2eca-59f0-9fd4-39c1cf21a4e9"
]
}
]
}