Full Report
An overview of coordinated influence operation campaigns terminated on our platforms in Q4 2025.
Analysis Summary
The provided text describes multiple, distinct coordinated influence operation campaigns terminated in Q4 2025, originating from several different countries (Russia, Pakistan, Indonesia, UK-based actors, Israel, Myanmar, Belarus, Bangladesh, Azerbaijan, and the PRC). Since the prompt requires summarizing **a** threat actor and the article provides vignettes grouped only by the country of origin (Russia is mentioned dozens of times with varying specific operation details), I will summarize the information regarding the multiple distinct Russian-linked operations, as they form the largest and most detailed set of activities described.
# Threat Actor: Various Russia-Linked Influence Operations (Q4 2025)
## Attribution & Identity
The campaigns are attributed broadly to actors linked to **Russia**. Specific entities mentioned include:
* **Internet Research Agency (IRA)**
* **An unnamed Russian consulting firm**
## Activity Summary
During Q4 2025 (October/November/December), numerous influence operations linked to Russia were terminated across YouTube and Google properties. These campaigns exhibited diverse targeting and narrative aims across multiple languages. A significant portion of activity focused on:
1. Supporting Russia's geopolitical stance and criticizing the West, NATO, Ukraine, Armenia, and Israel.
2. Targeting and influencing narrative around Moldovan elections and domestic politics.
3. Domestic political support within Germany (supporting one political party and criticizing the EU).
Specific large-scale operations involved terminating over 1,000 YouTube channels linked to a Russian consulting firm, and multiple operations linked to the IRA.
## Tactics, Techniques & Procedures
* **Platform Manipulation:** Primarily focused on content dissemination via YouTube channel termination and blocking domains from Google News/Discover surfaces.
* **Content Creation/Sharing:** Spreading politically charged narratives across various languages.
* **Specific TTPs Mentioned:**
* Termination of 8 YouTube channels (IRA-linked, supporting Russia/criticizing Moldova).
* Termination of 1,054 and 1,256 YouTube channels (Consulting firm-linked, supporting Russia/criticizing NATO, Ukraine, the West).
## Targeting
The targeting was extensive and multifaceted:
* **Sectors:** Geopolitical affairs, international alliances (NATO), domestic politics (Moldova, Germany).
* **Geography:** Content disseminated in Romanian, Russian, English, French, German, Spanish, Arabic, Croatian, Italian, Japanese, and Macedonian.
* Specific countries/entities targeted by criticism: **Armenia, Israel, Moldova, Ukraine, the West, EU, NATO**.
* **Victims:** Specific organizations were not named, but content specifically targeted **Moldova’s elections** and sought to influence narratives regarding **NATO, Ukraine**, and **Armenia**.
## Tools & Infrastructure
* **Malware Families Used:** None explicitly mentioned; the activity focused on influence operations rather than traditional malware deployment.
* **Infrastructure (C2, domains, IPs):**
* **Platforms:** 8, 5, 29, 26, 4, 1, 1, 1, 1, 1, 1,256 YouTube Channels terminated across various campaigns.
* **Domains:** 22 domains blocked from Google News/Discover surfaces.
* **Ad Accounts:** 2 Ads accounts terminated.
## Implications
The sustained, high-volume, and geographically diverse coordinated influence campaigns originating from Russian-linked entities highlight a persistent, sophisticated effort to undermine Western alliances (NATO, EU), interfere in the domestic politics of neighboring states (Moldova, Armenia), and promote Russian state narratives globally across at least nine languages during Q4 2025.
## Mitigations
* Continuous monitoring and takedown of large coordinated networks on video sharing platforms (YouTube).
* Domain blocking mechanisms across news and discovery surfaces to prevent amplification of influence content.
* Language-specific detection to track narratives propagating across diverse linguistic communities (e.g., Romanian, Armenian, German, Arabic).