Social networks as a phenomenon create their impact on real life every day. Certain social phenomena and processes started on social networks have their consequences on life outside cyberspace. Many social movements had their beginnings precisely on social networks, many initiatives and political demands were first initiated on social networks. This is evidenced by online petitions, calls for protests and demonstrations, pointing to existing and "existing" social contradictions. What we discuss in this paper is how certain discourses and opinions are spontaneous on social networks, and how much they are the result of coordinated actions that have clearly defined short-term and long-term goals. Are individuals, interest groups and state institutions behind such activities? What is particularly important for our analysis is what the activities with states behind them look like. What methods can be used in time to detect such a source of danger as an occurrence and a process. What techniques are available to us that can unequivocally establish that a certain state is behind a certain activity. In this context, the so-called "attribution", i.e. making accusations that carry political responsibility, is of special importance. Due to all of the above, it is very profitable to perform such operations at the present time. The literature recognizes such actions as "influence operations". However, in order to understand this security phenomenon, it is important to use competent tools that allow us to understand the very training ground where the action takes place - social networks, but also to understand the wider context that makes a certain action more or less successful. In this paper, we are going to look at the new reality of human society and why influence operations are more successful, dynamic and economical today than they were 50 years ago. The paper tries to analyze hybrid threats, i.e. influence operations, in a "narrow" domain of social networks. The possibilities of performing influence operations are very challenging. However, not every disinformation or social media campaign is an influence operation. We are going to focus on influence operations as informational and psychological operations that pose a security threat to modern states.