Russian and Chinese malign influence actors are working smarter in the age of Al
Two Six’s Biannual Manipulation Reports combine the best of Al-enabled tools with human expertise to illuminate adversaria! manipulation of the information environment (IE), empowering 10 actors to plan and execute countermeasures.
For this edition, our analysis centers on how the widespread adaptation of Al has shifted the dynamics of inauthentic behavior used to amplify pro-Russia and pro-China narratives on social media over the last two years. The rise of Al has fueled concerns that adversarias are rapidly using these technologies to flood the IE with automated content, but our data suggests that adversarias have not significantly increased overall post volume. lnstead, they are focusing on exploiting Al to enhance their messaging through imagery and translations. Al-enabled bot detection is also likely motivating malign accounts to behave more like humans than before.
This report also provides recommendations for 10 planners to counter foreign malign influence in the Al era, emphasizing the use of Al to generate visual assets and speed up the creation of PSYOP and public affairs campaigns.
To request a customized briefing on these findings, please reach out to your Two Six Technologies contact or email [email protected]. These recommendations are meant to be a starting point for 10 planning. The Two Six team would be happy to expand upon any of the proposals in this report and assist partners with implementing them.
Executive Summary.
Data Overview.
Al likely drove changes in Chinese and Russian malign influence TTPs:
lnauthentic accounts are probably using Al to enhance content quality of content rather than to increase content volume:
Pro-Russia actors likely prefer to repurpose old accounts rather than use Al to create new accounts for specialized narratives and target audiences, like election interference.
lnauthentic accounts are using Al to add visual appeal to their content and probably to reach broader audiences.
More inauthentic accounts are behaving more like humans.
lnauthentic accounts receive negligible engagement across ali three years.
Recommendations for countering foreign malign influence in the age of Al: Page 15 Russian TTPs and narratives:
Pro-Russia actors cultivate high-follower, high-engagement inauthentic accounts as central nodes in their networks.
Pro-Russia malign actors are linguistically nimble: they can operate in many languages and shift target audiences as political priorities changes.
lnauthentic accounts have shifted narratives about the US radically, from supporting President Trump in 2024 and 2025 to criticizing him in 2026.
Recommendations for countering Russian inauthentic influence.
Chinese narratives: lnauthentic, pro-China accounts primarily followed Beijing’s anti-US propaganda lines, with accounts focusing more on anti-Japan content and China’s Al strength under US pressure over the years
Methodology.
Al is changing foreign malign influence tactics-but not the way you might expect. lnstead of enabling adversarias to generate more content and accounts, Al is enabling and motivating adversarias to craft better content and more human-like accounts. In an information environment flooded by Al slop and moderated by social media platforms’ Al-enabled anti-bot tools, Russia and China are adapting with accounts that behave more like humans. They are also using Al to enrich their posts with visual content and to reach new audiences with translated material.
Our team developed a new methodology to train machine learning models to identify with high confidence unattributed malign influence accounts on X. We applied this methodology to analyze data from pro-Russia and pro-China accounts in 2024, 2025, and 2026. This work enabled us to draw statistically rigorous conclusions across actors and over time. We found:
We also used LLM-enabled methodologies to identify key shifts in US-related narratives over the past two years. We found that the US faces a barrage of criticism from pro-Russia and pro-China accounts’ narratives:
Two Six’s Sentr-the command center for the narrative battlefield-can address this evolving threat landscape by:
For this report, we created a new methodology that combines machine learning with human expertise to identify pro-China and pro-Russia unattributed malign influence accounts on X in 2024, 2025, and 2026. We used the same new methodology for both kinds of actors and all three years to train six machine learning models-one for each actor-year combination-to identify inauthentic accounts. This process-same methodology, independent models-allowed us to assess change confidently over time.
We define unattributed foreign malign influence accounts-which we call “inauthentic” accounts throughout the report-as accounts that meet all three of the below behaviors and characteristics:
The methodology identifies a specific kind of inauthentic account, namely one that at least sometimes shares explicitly pro-China or pro-Russia content and that persists over time. Our models are very accurate at identifying this kind of account. The average precision 1 was 86% across the six models and guaranteed to be no lower than 79% for any model. The average recall2 was 83% across the six models and guaranteed to be no lower than 77% for any model.
However, our methodology does not capture the following kinds of malign influence due to the limitation of identifying them through use of pro-China or pro-Russia hashtags:
¹The percent of accounts labeled as inauthentic that are actually inauthentic
²The percent of accounts that are actually inauthentic that our model labeled as inauthentic
We attribute these inauthentic accounts to China or Russia only at the level of “state encouraged,” according to Jason Healey’s Spectrum of State Responsibility framework for evaluating cyber attacks, as applied to influence operations by NATO.3 That means we do not attribute the operation of the campaigns directly to the Chinese or Russian governments. The campaigns may be carried out by a variety of pro-China or pro-Russia actors with informal ties to the state, such as Chinese state-owned companies or Russian oligarch networks, with or without direct orders from or coordination with the government. In fact, we intentionally captured a broad spectrum of inauthentic accounts, not limited to any particular known and attributed network like Storm 1516 or Spamoflauge. This ensures that our findings throughout the report are not driven by the idiosyncrasies of any particular actor or network.
We rely on the following evidence for our assessment that the accounts are, at minimum, “state encouraged:”
Scoping our analysis to one platform, X, allowed us to focus on change over time rather than cross-platform variables. Accounts behave differently on different platforms, and therefore each additional platform to be assessed would have required training different models. We have previously developed capabilities to detect malign accounts on Weibo for
³
https://stratcomcoe.org/pdfjs/?file=/publications/download/Attribution_Russian_lnformation_lnfluence.p df?zoom=page-fit
China and on Facebook and Telegram for Russia; please contact us if you are interested in learning more.
For the full details of how we identified accounts and trained our models, please see the Methodology section at the end of this report.
lnauthentic accounts are probably using Al to enhance content quality rather than to increase content volume
Malign actors using inauthentic accounts are choosing to forgo flooding the information environment with easily generated Al content in favor of using Al to make their online influence more subtle and sophisticated. As Al slop becomes more prevalent across the internet and as Al helps social media platforms improve bot detection capabilities, inauthentic accounts may have to improve their quality to avoid being drowned out or banned.
During 2026, we observed a statistically significant decrease in post volume for both pro-Russia and pro-China inauthentic accounts on X, despite the increasing ease with which accounts and content for those accounts can now be generated. (see Figure 1).
⁴ Our estimate is a minimum, but we assess that we likely captured the majority of this kind of inauthentic account, meaning the true number is likely not more than double our estimate. The first week in April
Failure to exploit Al are that malign actors lack the skills to deploy Al agents for this purpose, that the X platform is sufficiently protected against Al agents, or that Al agents are instead being deployed to create accounts to promote specialized narratives-though the latter explanation is less likely (see Box 1 ).
lnauthentic, pro-PRC and pro-Russia accounts pushed less content over the years
The median number of posts per day for detected inauthentic accounts, 2024-2026
Figure 1
The number of inauthentic accounts active on X remains on the scale of thousands across all three years
The median number of posts per day for detected inauthentic accounts, 2024-2026
Figure 2
Box 1: Pro-Russia actors likely prefer to repurpose old accounts rather than use Al to create new accounts for specialized narratives and target audiences, like election inteñerence
We have observed cases in which pro-Russia actors prefer to use reuse accounts for specialized messaging rather than create new accounts. For example, from 15-21 May we observed a network of likely Kremlin-backed accounts5 spreading Al-generated videos about Armenian Prime Minister Nikol Pashinyan ahead of Armenia’s 7 June parliamentary elections. However, these accounts were not specifically created for the Armenian election; many of them otherwise target US audiences. Sorne of the accounts involved may be inauthentic accounts originally deployed and operated by pro-Russia actors to target the US, and sorne may be real US influencers that have been paid by Russia to spread these narratives.
⁵ We assess these accounts are part of the Storm 1516 operation because of behavioral and network indicators.
TwoSix shares or discloses personal information when necessary to provide our Services or conduct our business operations as described below. When we share personal information, we do so in accordance with data privacy and security requirements. Below are the parties with whom we may share personal information and why.
TwoSix does not share the personal information it collects to third parties for their direct marketing use.
While your personal information is in our possession, we will protect it using the same administrative, physical, and technology safeguards to protect against accidental loss and unauthorized access, use, destruction, or disclosure of data that we use to protect our own highly confidential information.
However, no method of electronic transmission or storage is 100% secure, and we cannot ensure the security of any information you transmit to us, or guarantee that this information will not be accessed, disclosed, altered, or destroyed. We will make any legally required disclosures in the event of any compromise of personal information. You also play a role in protecting your Personal Information. Please safeguard your username and password for your Account and do not share them with others. If we receive instructions using your Account login information, we will consider that you have authorized the instructions. You agree to notify us immediately of any unauthorized use of your Account or any other breach of security related to the Services. We reserve the right, in our sole discretion, to refuse to provide the Services, terminate your Account, and to remove or edit content.
TwoSix has policies and rules relating to the retention of personal information. Our Records Retention Schedule is based upon a classification scheme consisting of Business Functions, Record Classes, and Record Types. In determining data retention periods, TwoSix takes into consideration local laws, contractual obligations, and the expectations and requirements of our customers. When we no longer need personal information, we securely delete or destroy it.
We offer you certain choices about what information we collect from you, how we use and disclose the information, and how we communicate with you.
Under the California Consumer Privacy Act (CCPA), California residents have new rights with respect to their personal information. If you are a California resident and you would like to exercise your rights under CCPA, you should contact TwoSix either by calling (703) 543-9662 or emailing us at [email protected]. For full information on CCPA, please read the following notice here.
We do not transfer personal information for monetary consideration. If you would like to tell us not to sell your information in the future, please email us at [email protected] with your name, postal address, telephone number, and email address with “Nevada do not sell” in the subject line.
Our Services are controlled and operated by us from the United States, are made available to residents of the United States, and are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than those of the United States. Any information you provide through use of the Services may be stored and processed, transferred between and accessed from the United States and other countries which may not guarantee the same level of protection of personal information as the one in which you reside. If you do not want your personal information to leave your country, please do not provide such information to Two Six Technologies and do not use our website. By providing personal information to TwoSix, you explicitly consent to the transfer of your information to the United States.
Two Six Technologies or its service providers may also transfer your personal information from the European Economic Area (EEA) to other countries, some of which have not yet been determined by the European Commission to offer an adequate level of data protection according to EEA standards. For transfers to countries not requiring a level of data protection that meets EEA standards, TwoSix uses a variety of legal mechanisms to protect your personal information, including contractual provisions and written assurances from service providers.
We will handle your personal information in accordance with this Privacy Policy regardless of where your personal information is stored or accessed.
Our website may contain links to, and may be used by you in conjunction with, third-party applications, services, tools, and websites that are not affiliated with, controlled, or managed by us. Examples include Facebook, LinkedIn, YouTube, Twitter, and third-party applications like voice software and readers.
Users of our Services wishing to provide links to third party applications, services, tools, or websites in content that they post must obtain our prior permission to do so.
The privacy practices of a third party will be governed by that party’s Privacy Statement. We do not endorse and are not responsible for the security or privacy of any information collected by these third parties. You should review the privacy statements or policies applicable to these third-party services.
Our website and the nature of our business are not intended for children. Children under the age of 13 should not register for services or provide any personal information, including name, address, telephone number, or email address to TwoSix through its websites or online services. We do not knowingly collect personal data from children under the age of 13 on our Services. If you have reason to believe that a child under the age of 13 has provided personal information to us through our Services, please contact us, and we will endeavor to delete that information from our systems. In the event that we learn that we have collected personal information from a child under age 13 without parental consent, we will endeavor to delete that information as quickly as possible. If you believe that we might have any information from or about a child under 13, please contact us as directed below.
For further questions or concerns about this Statement or our privacy practices, please feel free to contact us at the following:
Two Six Technologies
901 N. Stuart Street, Suite 1000
Arlington, VA 2220
USA
(703) 543-9662
[email protected]
TwoSix reserves the right to amend this Privacy Policy at any time, for any reason, without notice, other than posting of the amended Privacy Policy at this Website with an updated Effective Date. TwoSix suggests you check this page regularly to see our most up-to-date Privacy Policy. Changes are effective on the date TwoSix posts the revised Privacy Policy to its website and supersede all previous versions of the Privacy Policy. The Policy in effect at the time you use the website or the Service governs how we may use your information.
