Covert Influence Operations

About this report

Authenticity is the foundation of our community at TikTok, and we strive to foster an environment where genuine interactions and content thrive. As part of that effort, we continuously work to detect and disrupt covert influence operations that attempt to establish themselves on TikTok and undermine the integrity of our platform. You can learn more about how we do this work here.

In this report, we disclose information about the covert influence operations we disrupt to promote transparency and share learnings with our industry. For information about covert influence networks disrupted before January 2024, please see our quarterly Community Guidelines Enforcement reports. Starting in May 2024, we will be updating this page with new networks on a regular basis.

Terminology

Networks operated from: Indicates geographic location of network operation based on technical and behavioral evidence from proprietary and open sources; TikTok may not be able to attribute networks to specific entities, individuals, or groups.
Detection source: Denoted as internal when presence of activity is identified solely through an internally driven investigation; external detection refers to investigations that originated through an external report which then led to an investigation.
Followers of network: Cumulative number of accounts that were following any account within a network when it was removed.
Ongoing enforcement of recidivist behavior : Details ongoing enforcement actions of accounts where enforcement is either (a) significantly technically-linked to a previously disrupted network or (b) bears a high degree of behavioral similarity to a previously disrupted network.

Covert influence operations disrupted:

April 2024

This report contains information about the covert influence operations disrupted between April 1-30, 2024. In addition to these new network disruptions, we removed 3,263 accounts associated with previously disrupted networks attempting to re-establish their presence within this reporting period.

Detection source	Accounts in network	Followers of network	Description
Internal	580	148,627	Accounts targeting political discourse in Indonesia We assess that this network operated from Indonesia and targeted an Indonesian audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in the Indonesian language favorable to a specific presidential candidate, manipulating Indonesian elections discourse. The network was found to commonly use images of Indonesian politicians as account profile pictures.
Internal	521	38,428	Accounts targeting political discourse in Venezuela We assess that this network operated from Venezuela and targeted a Venezuelan audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Spanish language favorable to the current Venezuelan Government and manipulate discourse on the Esquibo territorial dispute. The operation repurposed content by posting the same videos on multiple accounts.
Internal	116	5,568	Accounts targeting political discourse in Indonesia We assess that this network operated from Indonesia and targeted an Indonesian audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Indonesian language favorable to a specific presidential candidate, manipulating Indonesian elections discourse. The network was found to repurpose content by recycling and amplifying the same videos repeatedly.
Internal	83	227,154	Accounts targeting political discourse in Venezuela We assess that this network operated from Chile and targeted a Venezuelan audience, including the Venezuelan diaspora in Chile. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Spanish language in support of a Venezuelan opposition politician, manipulating Venezuelan elections discourse. On occasion, the network was found to alternate between posting content depicting the beauty of Venezuela and political content.
Internal	26	1,186	Accounts targeting political discourse in Ecuador We assess that this network operated from Ecuador and targeted an Ecuadorian audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in the Spanish language, which were critical of a leftist political movement in Ecuador and of Colombia’s current government. The network was found to initially focus its content on Ecuadorian politics before later shifting its focus to Colombian politics.

March 2024

This report contains information about the covert influence operations disrupted between March 1-31, 2024. In addition to these new network disruptions, we removed 168 accounts associated with previously disrupted networks attempting to re-establish their presence within this reporting period.

etection source	Accounts in network	Followers of network	Description
Internal	59	31,503	Accounts targeting political discourse in Indonesia We assess that this network operated from Indonesia and targeted an Indonesian audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Indonesian language favorable to a specific presidential candidate, attempting to manipulate Indonesian elections discourse. The network was found to utilize numerous fictitious personas with stock or stolen imagery as Profile Pictures.
Internal	52	2,624,189	Accounts targeting war between Russia and Ukraine We assess that this network operated from Ukraine and targeted a Ukrainian audience. The individuals behind this network created inauthentic accounts and posted content in Ukrainian at scale in order to artificially amplify pro-Ukrainian narratives and generate off-platform traffic, thereby attempting to manipulate discourse about the ongoing war between Russia and Ukraine. The network was observed to be using ‘clickbait’ tactics, using grabbing sticker text without showing the full details of the video in order to create engagement and attention.

February 2024

This report contains information about the covert influence operations disrupted between February 1 – 29, 2024. In addition to these new network disruptions, we removed 12,127 accounts associated with previously disrupted networks attempting to re-establish their presence within this reporting period.

Detection source	Accounts in network	Followers of network	Description
Internal	757	59,404	Accounts targeting political discourse in Serbia We assess that this network operated from Serbia and targeted a Serbian audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Serbian language favorable to Serbia Against Violence coalition (SPN – Srbija Protiv Nasilja) and critical of the Serbian Progressive Party (SNS – Srpska Napredna Stranka), attempting to manipulate Serbian elections discourse. In addition to its politically focused accounts, the network created fan/hate pages for Serbian top creators in order to generate further user engagement.
Internal	266	5,302	Accounts targeting political discourse in Guatemala We assess that this network operated from Guatemala and targeted a Guatemalan audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Spanish language critical of the Seed Movement Party (Movimiento Semilla) and in support of a rival politician, attempting to manipulate Guatemalan elections discourse. The network was found to utilize numerous fictitious personas with stock or stolen imagery as Profile Pictures.
Internal	261	448,152	Accounts targeting political discourse in Iraq We assess that this network operated from Iraq and targeted an Iraqi audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Arabic language favorable to Popular Mobilization Forces, PMF militia and critical of America and Israel, attempting to manipulate discourse on Iraq’s domestic politics. The network was found to create ‘news’ accounts in an attempt to appear as a more reputable information source.
Internal	132	4,128	Accounts targeting political discourse in Guatemala We assess that this network operated from Guatemala and targeted a Guatemalan audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Spanish language favorable to the National Unity of Hope party and critical of politicians in rival parties, attempting to manipulate Guatemalan elections discourse. The network was found to utilize numerous fictitious personas with stock or stolen imagery as avatars.
Internal	65	116,612	Accounts amplifying pro-Iranian narratives We assess this network operated from Iran and targeted audiences in the US and UK. Prior to October 2023, the individuals behind this network created inauthentic identities and used inauthentic means to gain user engagement on narratives surrounding UK domestic policy discourse. After October 2023, the network operator used the same inauthentic accounts to target the war between Hamas and Israel and artificially amplify pro-Iranian narratives and narratives critical of the US and Israel. The accounts in the network initially posted content associated with travel and tourism in order to build an audience, before switching to political topics.
Internal	46	12,837	Accounts targeting political discourse in Germany We assess that this network operated from Germany and targeted a German audience. The individuals behind this network created opaque entities in order to artificially amplify narratives in German language favorable to the AfD (Alternative für Deutschland) political party, promoting Christianity and criticizing Islam, attempting to manipulate Germany’s domestic politics. We assess that accounts within this network were posing as former Muslims in order to insert divisive rhetoric about Islam into spaces on TikTok where Islam-related hashtags were being searched.
Internal	16	110,161	Accounts promoting Chinese policy and culture We assess this network operated from China and targeted a US audience. The individuals behind this network created inauthentic accounts in order to artificially amplify positive narratives of China, including support for the People’s Republic of China (PRC) policy decisions and strategic objectives, as well as general promotion of Chinese culture. This network utilized accounts impersonating high-profile US creators and celebrities in an attempt to build an audience.

January 2024

This report contains information about the covert influence operations disrupted January 1 – 31, 2024. In addition to these new network disruptions, we removed 2,358 accounts associated with previously disrupted networks attempting to re-establish their presence within this reporting period.

Detection source	Accounts in network	Followers of network	Description
Internal	21	61,026	Accounts targeting political discourse in Bangladesh We assess that this network operated from Bangladesh and targeted a Bangladeshi audience. The individuals behind this network created inauthentic accounts in order to artificially amplify narratives in Bengali language favorable to another political party, attempting to manipulate Bangladesh elections discourse. Accounts within the network were found to create fictitious personas by cycling through different avatars showing different people on the same accounts.

Was this helpful?

Yes