Skip to content

Hide Navigation Hide TOC

Edit

Misinformation Pattern

AM!TT Technique

Authors
Authors and/or Contributors
misinfosecproject

5Ds (dismiss, distort, distract, dismay, divide)

Nimmo's "4Ds of propaganda": dismiss, distort, distract, dismay (MisinfosecWG added divide in 2019). Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible.

Internal MISP references

UUID 16556f68-fe4f-43c8-a8a4-6fc205d80251 which can be used as unique global reference for 5Ds (dismiss, distort, distract, dismay, divide) in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0001
kill_chain ['misinformation-tactics:Strategic Planning']

Facilitate State Propaganda

Organize citizens around pro-state messaging. Paid or volunteer groups coordinated to push state propaganda (examples include 2016 Diba Facebook Expedition, coordinated to overcome China’s Great Firewall to flood the Facebook pages of Taiwanese politicians and news agencies with a pro-PRC message).

Internal MISP references

UUID 35f79572-d306-4df1-92e7-84e4d2242baf which can be used as unique global reference for Facilitate State Propaganda in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0002
kill_chain ['misinformation-tactics:Strategic Planning']

Leverage Existing Narratives

Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices. Examples include midwesterners are generous, Russia is under attack from outside.

Internal MISP references

UUID 05f58511-8d22-45d5-b889-47a07b9be00d which can be used as unique global reference for Leverage Existing Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0003
kill_chain ['misinformation-tactics:Strategic Planning']

Competing Narratives

Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. MH17 (example) "Russian Foreign Ministry again claimed that “absolutely groundless accusations are put forward against the Russian side, which are aimed at discrediting Russia in the eyes of the international community" (deny); "The Dutch MH17 investigation is biased, anti-Russian and factually inaccurate" (dismiss).

Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on.

These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the "firehose of misinformation" approach.

Internal MISP references

UUID 8960c6c3-ab73-41b3-b661-901f4e4ed5e6 which can be used as unique global reference for Competing Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0004
kill_chain ['misinformation-tactics:Strategic Planning']

Center of Gravity Analysis

Recon/research to identify "the source of power that provides moral or physical strength, freedom of action, or will to act." Thus, the center of gravity is usually seen as the "source of strength". Includes demographic and network analysis of communities

Internal MISP references

UUID a6de0798-4de8-4aa8-90c4-fd6d88f850f3 which can be used as unique global reference for Center of Gravity Analysis in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0005
kill_chain ['misinformation-tactics:Objective Planning']

Create Master Narratives

The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a "whole of society" perpective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion consitutes an ongoing tactical struggle carried out at a whole-of-society level.

By way of example, major powers are promoting master narratives such as: * "Huawei is detetmined to build trustworthy networks" * "Russia is the victim of bullying by NATO powers" * "USA is guided by its founding principles of liberty and egalitarianism"

Tactically, their promotion covers a broad spectrum of activities both on- and offline.

Internal MISP references

UUID 73c4fe48-8d25-47ce-8295-33db463b0e85 which can be used as unique global reference for Create Master Narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0006
kill_chain ['misinformation-tactics:Objective Planning']

Create fake Social Media Profiles / Pages / Groups

Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets.

Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.

Examples: Ukraine elections (2019) circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages. EU Elections (2019) Avaaz reported more than 500 suspicious pages and groups to Facebook related to the three-month investigation of Facebook disinformation networks in Europe. Mueller report (2016) The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami.

Internal MISP references

UUID 14394d02-9f8f-4999-8e3d-c51b6f25076b which can be used as unique global reference for Create fake Social Media Profiles / Pages / Groups in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0007
kill_chain ['misinformation-tactics:Develop People']

Create fake or imposter news sites

Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details. A prominent case from the 2016 era was the Denver Guardian, which purported to be a local newspaper in Colorado and specialized in negative stories about Hillary Clinton.

Internal MISP references

UUID dd3f7b62-a99c-40d6-baeb-cd36601cc524 which can be used as unique global reference for Create fake or imposter news sites in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0008
kill_chain ['misinformation-tactics:Develop People']

Create fake experts

Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. For example, in the Jade Helm conspiracy theory promoted by SVR in 2015, a pair of experts--one of them naming himself a “Military Intelligence Analyst / Russian Regional CME” and the other a “Geopolitical Strategist, Journalist & Author”--pushed the story heavily on LinkedIn.

Internal MISP references

UUID 0253d5f6-cc08-4f46-b00a-628926020d2c which can be used as unique global reference for Create fake experts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0009
kill_chain ['misinformation-tactics:Develop People']

Cultivate useful idiots

Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents".

Internal MISP references

UUID 784cfb1f-c6f5-44a3-8b60-272c64aac4ea which can be used as unique global reference for Cultivate useful idiots in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0010
kill_chain ['misinformation-tactics:Develop Networks']

Hijack legitimate account

Hack or take over legimate accounts to distribute misinformation or damaging content. Examples include Syrian Electronic Army (2013) series of false tweets from a hijacked Associated Press Twitter account claiming that President Barack Obama had been injured in a series of explosions near the White House. The false report caused a temporary plunge of 143 points on the Dow Jones Industrial Average.

Internal MISP references

UUID 79e9410b-c325-44fd-9b1b-8c9c53c8ecdd which can be used as unique global reference for Hijack legitimate account in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0011
kill_chain ['misinformation-tactics:Develop Networks']

Use concealment

Use anonymous social media profiles. Examples include page or group administrators, masked "whois" website directory data, no bylines connected to news article, no masthead connect to news websites.

Example is 2016 @TEN_GOP profile where the actual Tennessee Republican Party tried unsuccessfully for months to get Twitter to shut it down, and 2019 Endless Mayfly is an Iran-aligned network of inauthentic personas and social media accounts that spreads falsehoods and amplifies narratives critical of Saudi Arabia, the United States, and Israel.

Internal MISP references

UUID 40c0ba05-ecb4-42c1-af78-4c7cf586f547 which can be used as unique global reference for Use concealment in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0012
kill_chain ['misinformation-tactics:Develop Networks']

Create fake websites

Internal MISP references

UUID 81d35c37-da96-423b-9ec1-e2831a6f413d which can be used as unique global reference for Create fake websites in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0013
kill_chain ['misinformation-tactics:Develop Networks']

Create funding campaigns

Generate revenue through online funding campaigns. e.g. Gather data, advance credible persona via Gofundme; Patreon; or via fake website connecting via PayPal or Stripe. (Example 2016) #VaccinateUS Gofundme campaigns to pay for Targetted facebook ads (Larry Cook, targetting Washington State mothers, $1,776 to boost posts over 9 months).

Internal MISP references

UUID 06ff0cd0-08a4-486b-ab81-57c50bc2253e which can be used as unique global reference for Create funding campaigns in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0014
kill_chain ['misinformation-tactics:Develop Networks']

Create hashtag

Many incident-based campaigns will create a hashtag to promote their fabricated event (e.g. #ColumbianChemicals to promote a fake story about a chemical spill in Louisiana).

Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only "real" events would be discussed in a hashtag. After all, the event has a name! 2. Publicize the story more widely through trending lists and search behavior

Asset needed to direct/control/manage "conversation" connected to launching new incident/campaign with new hashtag for applicable social media sites ie: Twitter, LinkedIn)

Internal MISP references

UUID 80c68f29-1c22-4277-93c0-e19f97bd56ee which can be used as unique global reference for Create hashtag in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0015
kill_chain ['misinformation-tactics:Develop Networks']

Clickbait

Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. (example 2016) “Pope Francis shocks world, endorses Donald Trump for president.” (example 2016) "FBI director received millions from Clinton Foundation, his brother’s law firm does Clinton’s taxes”. This is a key asset

Internal MISP references

UUID 7193e229-e122-4f50-818b-e2b047b18a9a which can be used as unique global reference for Clickbait in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0016
kill_chain ['misinformation-tactics:Microtargeting']

Promote online funding

Drive traffic/engagement to funding campaign sites; helps provide measurable metrics to assess conversion rates

Internal MISP references

UUID 3a540119-0ede-4ac5-968c-de11ac477cb3 which can be used as unique global reference for Promote online funding in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0017
kill_chain ['misinformation-tactics:Microtargeting']

Create or fund advertisements targeted at specific populations

Internal MISP references

UUID 97ce4b61-b888-4a76-98f6-a32dc1df1a1a which can be used as unique global reference for Paid targeted ads in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0018
kill_chain ['misinformation-tactics:Microtargeting']

Generate information pollution

Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. "Nothing is true, but everything is possible." Akin to astroturfing campaign.

Internal MISP references

UUID 7bdc0b07-63db-406b-8602-1b8a1faa387f which can be used as unique global reference for Generate information pollution in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0019
kill_chain ['misinformation-tactics:Develop Content']

Trial content

Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates

Internal MISP references

UUID 5bd83398-8273-49b8-8bc2-9435bda603ed which can be used as unique global reference for Trial content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0020
kill_chain ['misinformation-tactics:Develop Content']

Memes

Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.

Internal MISP references

UUID fa6e62ca-16c3-4fdd-93ff-b1e1da4cfad8 which can be used as unique global reference for Memes in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0021
kill_chain ['misinformation-tactics:Develop Content']

Conspiracy narratives

"Conspiracy narratives appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalized or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the ""firehose of falsehoods"" model.

Example: QAnon: conspiracy theory is an explanation of an event or situation that invokes a conspiracy by sinister and powerful actors, often political in motivation, when other explanations are more probable "

Internal MISP references

UUID 5a832f09-0b39-4734-b7a1-9a4592bdb57e which can be used as unique global reference for Conspiracy narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0022
kill_chain ['misinformation-tactics:Develop Content']

Distort facts

Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content

Internal MISP references

UUID 01c4d71e-47ef-4cad-abda-ad1abd42cae7 which can be used as unique global reference for Distort facts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0023
kill_chain ['misinformation-tactics:Develop Content']

Create fake videos and images

Create fake videos and/or images by manipulating existing content or generating new content (e.g. deepfakes). Examples include Pelosi video (making her appear drunk) and photoshoped shark on flooded streets of Houston TX.

Internal MISP references

UUID 79a57ba1-9d29-4cd6-8669-ce9728bc33d7 which can be used as unique global reference for Create fake videos and images in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0024
kill_chain ['misinformation-tactics:Develop Content']

Leak altered documents

Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources.

Example (2019) DFRLab report "Secondary Infektion” highlights incident with key asset being a forged “letter” created by the operation to provide ammunition for far-right forces in Europe ahead of the election.

Internal MISP references

UUID 01f8720b-d254-4744-a4eb-a28efc8c3528 which can be used as unique global reference for Leak altered documents in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0025
kill_chain ['misinformation-tactics:Develop Content']

Create fake research

Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx

Internal MISP references

UUID 032ea639-87e3-413b-925d-e556b472216b which can be used as unique global reference for Create fake research in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0026
kill_chain ['misinformation-tactics:Develop Content']

Adapt existing narratives

Adapting existing narratives to current operational goals is the tactical sweet-spot for an effective misinformation campaign. Leveraging existing narratives is not only more effective, it requires substantially less resourcing, as the promotion of new master narratives operates on a much larger scale, both time and scope. Fluid, dynamic & often interchangable key master narratives can be ("The morally corrupt West") adapted to divisive (LGBT proganda) or to distort (individuals working as CIA operatives). For Western audiences, different but equally powerful framings are available, such as "USA has a fraught history in race relations, espically in crimincal justice areas."

Internal MISP references

UUID c30bfa00-2da6-4443-aa05-5342ad9ea2cc which can be used as unique global reference for Adapt existing narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0027
kill_chain ['misinformation-tactics:Develop Content']

Create competing narratives

"Misinformation promotes an agenda by advancing narratives supportive of that agenda. This is most effective when the advanced narrative pre-dates the revelation of the specific misinformation content. But this is often not possible.

Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centered on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on.

These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the ""firehose of misinformation"" approach."

Internal MISP references

UUID c84a5389-92a0-41f1-bed1-b85a4720ffa5 which can be used as unique global reference for Create competing narratives in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0028
kill_chain ['misinformation-tactics:Develop Content']

Manipulate online polls

Create fake online polls, or manipulate existing online polls. Examples: flooding FCC with comments; creating fake engagement metrics of Twitter/Facebook polls to manipulate perception of given issue. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well

Internal MISP references

UUID d7175e98-579d-4675-aff1-3fc24a18e003 which can be used as unique global reference for Manipulate online polls in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0029
kill_chain ['misinformation-tactics:Channel Selection']

Backstop personas

Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability

Internal MISP references

UUID 88fad613-42bb-46b0-8ef7-dafde53d2b72 which can be used as unique global reference for Backstop personas in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0030
kill_chain ['misinformation-tactics:Channel Selection']

YouTube

Use YouTube as a narrative dissemination channel

Internal MISP references

UUID 18a024a0-b0c8-4091-bd22-9d167c0ada16 which can be used as unique global reference for YouTube in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0031
kill_chain ['misinformation-tactics:Channel Selection']

Reddit

Use Reddit as a narrative dissemination channel

Internal MISP references

UUID 0cf0ecdb-fc07-41b0-9fa1-8c7eb40a8116 which can be used as unique global reference for Reddit in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0032
kill_chain ['misinformation-tactics:Channel Selection']

Instagram

Use Instagram as a narrative dissemination channel

Internal MISP references

UUID 3ad77fc0-970b-4a6a-bfd9-db122e375812 which can be used as unique global reference for Instagram in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0033
kill_chain ['misinformation-tactics:Channel Selection']

LinkedIn

Use LinkedIn as a narrative dissemination channel

Internal MISP references

UUID 9a440d3e-eba9-4d8f-ba93-d691a9121a68 which can be used as unique global reference for LinkedIn in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0034
kill_chain ['misinformation-tactics:Channel Selection']

Pinterest

Use Pinterest as a narrative dissemination channel

Internal MISP references

UUID ba998ea4-b39d-4d66-b3ba-d90e2e0abc8c which can be used as unique global reference for Pinterest in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0035
kill_chain ['misinformation-tactics:Channel Selection']

WhatsApp

Use WhatsApp as a narrative dissemination channel

Internal MISP references

UUID 231e17e7-3268-4316-ae25-ba4e978a043a which can be used as unique global reference for WhatsApp in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0036
kill_chain ['misinformation-tactics:Channel Selection']

Facebook

Use Facebook as a narrative dissemination channel

Internal MISP references

UUID 70086088-dfd6-4fd7-9f28-bf61c7f77dbb which can be used as unique global reference for Facebook in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0037
kill_chain ['misinformation-tactics:Channel Selection']

Twitter

Use Twitter as a narrative dissemination channel

Internal MISP references

UUID c2463ebc-2156-4597-b8e8-cad15954cab4 which can be used as unique global reference for Twitter in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0038
kill_chain ['misinformation-tactics:Channel Selection']

Bait legitimate influencers

Internal MISP references

UUID f1145ebe-da32-471b-9ce5-4ba5c1393bb3 which can be used as unique global reference for Bait legitimate influencers in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0039
kill_chain ['misinformation-tactics:Pump Priming']

Demand unsurmountable proof

Internal MISP references

UUID 6134c516-1521-40ee-9cdd-48d5f034289a which can be used as unique global reference for Demand unsurmountable proof in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0040
kill_chain ['misinformation-tactics:Pump Priming']

Deny involvement

Internal MISP references

UUID 90e5c8f1-55b4-48f3-99df-07a1b15621b7 which can be used as unique global reference for Deny involvement in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0041
kill_chain ['misinformation-tactics:Pump Priming']

Kernel of Truth

Internal MISP references

UUID c4820314-22b3-4143-b197-0ef49faa6132 which can be used as unique global reference for Kernel of Truth in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0042
kill_chain ['misinformation-tactics:Pump Priming']

Use SMS/ WhatsApp/ Chat apps

Internal MISP references

UUID f89d4b1d-34a3-41fc-9fcb-5c17faf4d928 which can be used as unique global reference for Use SMS/ WhatsApp/ Chat apps in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0043
kill_chain ['misinformation-tactics:Pump Priming']

Seed distortions

Internal MISP references

UUID 04946fbc-9bfc-4078-8dec-d3554233494b which can be used as unique global reference for Seed distortions in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0044
kill_chain ['misinformation-tactics:Pump Priming']

Use fake experts

Use the fake experts that were set up in T0009. Pseudo-experts are disposable assets that often appear once and then disappear. Give "credility" to misinformation. Take advantage of credential bias

Internal MISP references

UUID 6284e088-837a-4dbe-8f81-249559069625 which can be used as unique global reference for Use fake experts in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0045
kill_chain ['misinformation-tactics:Pump Priming']

Search Engine Optimization

Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka "Black-hat SEO"

Internal MISP references

UUID 1a51094b-5965-4ddb-9833-11e14ac1fd98 which can be used as unique global reference for Search Engine Optimization in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0046
kill_chain ['misinformation-tactics:Pump Priming']

Muzzle social media as a political force

Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports. (Example 20190 Singapore Protection from Online Falsehoods and Manipulation Bill would make it illegal to spread "false statements of fact" in Singapore, where that information is "prejudicial" to Singapore's security or "public tranquility." Or India/New Delhi has cut off services to Facebook and Twitter in Kashmir 28 times in the past five years, and in 2016, access was blocked for five months -- on the grounds that these platforms were being used for anti-social and "anti-national" purposes.

Internal MISP references

UUID 6e13aaa2-8452-4f4f-b5ca-56291dcbb351 which can be used as unique global reference for Muzzle social media as a political force in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0047
kill_chain ['misinformation-tactics:Exposure']

Cow online opinion leaders

Intimidate, coerce, threaten critics/dissidents/journalists via trolling, doxing. Phillipines (example) Maria Ressa and Rappler journalists targeted Duterte regime, lawsuits, trollings, banned from the presidential palace where press briefings take place. 2017 Bot attack on five ProPublica Journalists.

Internal MISP references

UUID cf50c811-8d01-4c0b-bb0c-c7d84ac620b4 which can be used as unique global reference for Cow online opinion leaders in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0048
kill_chain ['misinformation-tactics:Exposure']

Flooding

Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.

Example (2018): bots flood social media promoting messages which support Saudi Arabia with intent to cast doubt on allegations that the kingdom was involved in Khashoggi’s death.

Internal MISP references

UUID 01b27791-6daf-4819-a218-256377282135 which can be used as unique global reference for Flooding in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0049
kill_chain ['misinformation-tactics:Exposure']

Cheerleading domestic social media ops

Deploy state-coordinated social media commenters and astroturfers. Both internal/domestic and external social media influence operations, popularized by China (50cent Army manage message inside the "Great Firewall") but also technique used by Chinese English-language social media influence operations are seeded by state-run media, which overwhelmingly present a positive, benign, and cooperative image of China.

Internal MISP references

UUID b1744176-7e69-4d2a-bd26-3994dd1ade79 which can be used as unique global reference for Cheerleading domestic social media ops in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0050
kill_chain ['misinformation-tactics:Exposure']

Fabricate social media comment

Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums. (2017 example) the FCC was inundated with nearly 22 million public comments on net neutrality (many from fake accounts)

Internal MISP references

UUID a9d7894e-abc8-407f-8f90-62d3b2cff277 which can be used as unique global reference for Fabricate social media comment in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0051
kill_chain ['misinformation-tactics:Exposure']

Tertiary sites amplify news

Create content/news/opinion web-sites to cross-post stories. Tertiary sites circulate and amplify narratives. Often these sites have no masthead, bylines or attribution.

Examples of tertiary sites inculde Russia Insider, The Duran, geopolitica.ru, Mint Press News, Oriental Review, globalresearch.ca.

Example (2019, Domestic news): Snopes reveals Star News Digital Media, Inc. may look like a media company that produces local news, but operates via undisclosed connections to political activism.

Example (2018) FireEye reports on Iranian campaign that created between April 2018 and March 2019 sites used to spread inauthentic content from websites such as Liberty Front Press (LFP), US Journal, and Real Progressive Front during the US mid-terms.

Internal MISP references

UUID bb0c643e-c83b-474e-9eb6-21ba51d20efe which can be used as unique global reference for Tertiary sites amplify news in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0052
kill_chain ['misinformation-tactics:Exposure']

Twitter trolls amplify and manipulate

Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized) e.g. BlackLivesMatter or MeToo

Internal MISP references

UUID 9feff36b-887c-4cb8-9224-a0694b003d57 which can be used as unique global reference for Twitter trolls amplify and manipulate in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0053
kill_chain ['misinformation-tactics:Exposure']

Twitter bots amplify

Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more "popular" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.(example 2019) #TrudeauMustGo

Internal MISP references

UUID 10f072e1-02cd-4b6e-8a4e-c1c35cf9e166 which can be used as unique global reference for Twitter bots amplify in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0054
kill_chain ['misinformation-tactics:Exposure']

Use hashtag

Use the dedicated hashtag for the incident (e.g. #PhosphorusDisaster)

Internal MISP references

UUID 0f490149-34b2-4316-b19b-7b43423522b3 which can be used as unique global reference for Use hashtag in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0055
kill_chain ['misinformation-tactics:Exposure']

Dedicated channels disseminate information pollution

Output information pollution (e.g. articles on an unreported false story/event) through channels controlled by or related to the incident creator. Examples include RT/Sputnik or antivax websites seeding stories.

Internal MISP references

UUID 4a3a83d1-fb95-47ac-91fe-cd2682eb4637 which can be used as unique global reference for Dedicated channels disseminate information pollution in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0056
kill_chain ['misinformation-tactics:Exposure']

Organise remote rallies and events

Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives. Example: Facebook groups/pages coordinate/more divisive/polarizing groups and actvities into the public space. (Example) Mueller's report, highlights, the IRA organized political rallies in the U.S. using social media starting in 2015 and continued to coordinate rallies after the 2016 election

Internal MISP references

UUID 37a150a4-abb9-475d-820b-132336b25491 which can be used as unique global reference for Organise remote rallies and events in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0057
kill_chain ['misinformation-tactics:Go Physical']

Legacy web content

Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.

Internal MISP references

UUID c7366126-f01d-435d-91d5-e77d26082c1a which can be used as unique global reference for Legacy web content in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0058
kill_chain ['misinformation-tactics:Persistence']

Play the long game

Internal MISP references

UUID 12a75c2e-495d-43da-bf13-d89f448cefc0 which can be used as unique global reference for Play the long game in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0059
kill_chain ['misinformation-tactics:Persistence']

Continue to amplify

Internal MISP references

UUID cface37a-cbb9-4554-96f0-d3088f7131ed which can be used as unique global reference for Continue to amplify in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0060
kill_chain ['misinformation-tactics:Persistence']

Sell merchandising

Sell hats, t-shirts, flags and other branded content that's designed to be seen in the real world

Internal MISP references

UUID 3b312e50-6420-48b7-9a94-c4d84f29ad1c which can be used as unique global reference for Sell merchandising in MISP communities and other software using the MISP galaxy

External references
Associated metadata
Metadata key Value
external_id T0061
kill_chain ['misinformation-tactics:Go Physical']