Disinformation-as-a-Service: The Emerging High-Risk Criminal Networks of Influence Operators

Abstract

Disinformation is no longer confined to state propaganda or isolated online actors, it has become a commodified criminal service. Networks of influence operators now offer Disinformation-as-a-Service (DaaS), executing campaigns for paying clients, including state actors and private entities, in the same manner as cybercrime-for-hire schemes. This convergence of disinformation, cybercrime, and organised criminal structures constitutes a major internal security threat. These hybrid operations blur the distinction between state-backed activity and criminal enterprise, complicating attribution, disruption, and prosecution. In effect, disinformation has become an underworld commodity, one that exploits the reach of global digital infrastructure to manipulate public opinion at scale. This study examines DaaS through a multi-layered methodology combining three lines of evidence. First, a case study of the Doppelgänger campaign shows how state-linked operators assembled and maintained a large-scale disinformation network using cloned media sites, ad-tracking software, and bulletproof hosting. Second, a market-based supply analysis of over 25 light-web and 15 dark-web marketplaces identifies the retail ecosystem behind influence-for-hire, documenting the sale of engagement, narrative amplification, and targeting services. Third, a macro-level analysis of the wider landscape of foreign information manipulation and interference (FIMI) within the context of elections. We map actor trends, attack patterns, and evolving tactics. Findings reveal an emerging criminal ecosystem where influence operations are traded as modular services, supported by technical infrastructure borrowed from cybercrime markets. The article concludes by assessing the implications for European law enforcement and highlighting ongoing research through European Horizon projects.