# DISARM Red framework

# DISARM

P01 Plan | P01 Plan | P02 Prepare | P02 Prepare | P02 Prepare | P03 Execute | P03 Execute | P03 Execute | P03 Execute | P04 Assess | P01 Plan | P02 Prepare | P02 Prepare | P02 Prepare | P03 Execute | P03 Execute

TA01 Plan Strategy

TA02 Plan Objectives

TA05 Microtarget

TA06 Develop Content

TA07 Select Channels and Affordances

TA08 Conduct Pump Priming

TA09 Deliver Content

TA10 Drive Offline Activity

TA11 Persist in the Information Environment

TA12 Assess Effectiveness

TA13 Target Audience Analysis

TA14 Develop Narratives

TA15 Establish Assets

TA16 Establish Legitimacy

TA17 Maximise Exposure

TA18 Drive Online Harms

T0073 Determine Target Audiences

T0002 Facilitate State Propaganda

T0016 Create Clickbait

T0015 Create Hashtags and Search Artefacts

T0029 Online Polls

T0020 Trial Content

T0114 Deliver Ads

T0017 Conduct Fundraising

T0059 Play the Long Game

T0132 Measure Performance

T0072 Segment Audiences

T0003 Leverage Existing Narratives

T0007 Create Inauthentic Social Media Pages and Groups

T0009 Create Fake Experts

T0039 Bait Influencer

T0047 Censor Social Media as a Political Force

T0074 Determine Strategic Ends

T0066 Degrade Adversary

T0018 Purchase Targeted Advertisements

T0023 Distort Facts

T0043 Chat Apps

T0042 Seed Kernel of Truth

T0114.001 Social Media

T0017.001 Conduct Crowdfunding Campaigns

T0060 Continue to Amplify

T0132.001 People Focused

T0072.001 Geographic Segmentation

T0004 Develop Competing Narratives

T0010 Cultivate Ignorant Agents

T0009.001 Utilise Academic/Pseudoscientific Justifications

T0049 Flood Information Space

T0048 Harass

T0074.001 Geopolitical Advantage

T0075 Dismiss

T0101 Create Localised Content

T0023.001 Reframe Context

T0043.001 Use Encrypted Chat Apps

T0044 Seed Distortions

T0114.002 Traditional Media

T0057 Organise Events

T0128 Conceal Information Assets

T0132.002 Content Focused

T0072.002 Demographic Segmentation

T0022 Leverage Conspiracy Theory Narratives

T0013 Create Inauthentic Websites

T0097 Create Personas

T0049.001 Trolls Amplify and Manipulate

T0048.001 Boycott/"Cancel" Opponents

T0074.002 Domestic Political Advantage

T0075.001 Discredit Credible Sources

T0102 Leverage Echo Chambers/Filter Bubbles

T0023.002 Edit Open-Source Content

T0043.002 Use Unencrypted Chats Apps

T0045 Use Fake Experts

T0115 Post Content

T0057.001 Pay for Physical Action

T0128.001 Use Pseudonyms

T0132.003 View Focused

T0072.003 Economic Segmentation

T0022.001 Amplify Existing Conspiracy Theory Narratives

T0014 Prepare Fundraising Campaigns

T0097.001 Produce Evidence for Persona

T0049.002 Flood Existing Hashtag

T0048.002 Harass People Based on Identities

T0074.003 Economic Advantage

T0076 Distort

T0102.001 Use Existing Echo Chambers/Filter Bubbles

T0084 Reuse Existing Content

T0103 Livestream

T0046 Use Search Engine Optimisation

T0115.001 Share Memes

T0057.002 Conduct Symbolic Action

T0128.002 Conceal Network Identity

T0133 Measure Effectiveness

T0072.004 Psychographic Segmentation

T0022.002 Develop Original Conspiracy Theory Narratives

T0014.001 Raise Funds from Malign Actors

T0098 Establish Inauthentic News Sites

T0049.003 Bots Amplify via Automated Forwarding and Reposting

T0048.003 Threaten to Dox

T0074.004 Ideological Advantage

T0077 Distract

T0102.002 Create Echo Chambers/Filter Bubbles

T0084.001 Use Copypasta

T0103.001 Video Livestream

T0115.002 Post Violative Content to Provoke Takedown and Backlash

T0061 Sell Merchandise

T0128.003 Distance Reputable Individuals from Operation

T0133.001 Behaviour Changes

T0072.005 Political Segmentation

T0040 Demand Insurmountable Proof

T0014.002 Raise Funds from Ignorant Agents

T0098.001 Create Inauthentic News Sites

T0049.004 Utilise Spamoflauge

T0048.004 Dox

T0078 Dismay

T0102.003 Exploit Data Voids

T0084.002 Plagiarise Content

T0103.002 Audio Livestream

T0115.003 One-Way Direct Posting

T0126 Encourage Attendance at Events

T0128.004 Launder Information Assets

T0133.002 Content

T0080 Map Target Audience Information Environment

T0068 Respond to Breaking News Event or Active Crisis

T0065 Prepare Physical Broadcast Capabilities

T0098.002 Leverage Existing Inauthentic News Sites

T0049.005 Conduct Swarming

T0123 Control Information Environment through Offensive Cyberspace Operations

T0079 Divide

T0084.003 Deceptively Labelled or Translated

T0104 Social Networks

T0116 Comment or Reply on Content

T0126.001 Call to Action to Attend

T0128.005 Change Names of Information Assets

T0133.003 Awareness

T0080.001 Monitor Social Media Analytics

T0082 Develop New Narratives

T0090 Create Inauthentic Accounts

T0099 Impersonate Existing Entity

T0049.006 Conduct Keyword Squatting

T0123.001 Delete Opposing Content

T0135 Undermine

T0084.004 Appropriate Content

T0104.001 Mainstream Social Networks

T0116.001 Post Inauthentic Social Media Comment

T0126.002 Facilitate Logistics or Support for Attendance

T0129 Conceal Operational Activity

T0133.004 Knowledge

T0080.002 Evaluate Media Surveys

T0083 Integrate Target Audience Vulnerabilities into Narrative

T0090.001 Create Anonymous Accounts

T0099.002 Spoof/Parody Account/Site

T0049.007 Inauthentic Sites Amplify News and Narratives

T0123.002 Block Content

T0135.001 Smear

T0085 Develop Text-Based Content

T0104.002 Dating App

T0117 Attract Traditional Media

T0127 Physical Violence

T0129.001 Conceal Network Identity

T0133.005 Action/Attitude

T0080.003 Identify Trending Topics/Hashtags

T0090.002 Create Cyborg Accounts

T0099.003 Impersonate Existing Organisation

T0049.008 Generate Information Pollution

T0123.003 Destroy Information Generation Capabilities

T0135.002 Thwart

T0085.001 Develop AI-Generated Text

T0104.003 Private/Closed Social Networks

T0127.001 Conduct Physical Violence

T0129.002 Generate Content Unrelated to Narrative

T0134 Measure Effectiveness Indicators (or KPIs)

T0080.004 Conduct Web Traffic Analysis

T0090.003 Create Bot Accounts

T0099.004 Impersonate Existing Media Outlet

T0118 Amplify Existing Narrative

T0123.004 Conduct Server Redirect

| T0135.003 Subvert |  | T0085.003 Develop Inauthentic News Articles | T0104.004 Interest-Based Networks |  |  | T0127.002 Encourage Physical Violence | T0129.003 Break Association with Content | T0134.001 Message Reach | T0080.005 Assess Degree/Type of Media Access |  | T0090.004 Create Sockpuppet Accounts | T0099.005 Impersonate Existing Official | T0119 Cross-Posting | T0124 Suppress Opposition
| T0135.004 Polarise |  | T0085.004 Develop Document | T0104.005 Use Hashtags |  |  |  | T0129.004 Delete URLs | T0134.002 Social Media Engagement | T0081 Identify Social and Technical Vulnerabilities |  | T0091 Recruit Malign Actors | T0099.006 Impersonate Existing Influencer | T0119.001 Post across Groups | T0124.001 Report Non-Violative Opposing Content
| T0136 Cultivate Support |  | T0085.005 Develop Book | T0104.006 Create Dedicated Hashtag |  |  |  | T0129.005 Coordinate on Encrypted/Closed Networks |  | T0081.001 Find Echo Chambers |  | T0091.001 Recruit Contractors | T0100 Co-Opt Trusted Sources | T0119.002 Post across Platform | T0124.002 Goad People into Harmful Action (Stop Hitting Yourself)
| T0136.001 Defend Reputaton |  | T0085.006 Develop Opinion Article | T0105 Media Sharing Networks |  |  |  | T0129.006 Deny Involvement |  | T0081.002 Identify Data Voids |  | T0091.002 Recruit Partisans | T0100.001 Co-Opt Trusted Individuals | T0119.003 Post across Disciplines | T0124.003 Exploit Platform TOS/Content Moderation
| T0136.002 Justify Action |  | T0085.007 Create Fake Research | T0105.001 Photo Sharing |  |  |  | T0129.007 Delete Accounts/Account Activity |  | T0081.003 Identify Existing Prejudices |  | T0091.003 Enlist Troll Accounts | T0100.002 Co-Opt Grassroots Groups | T0120 Incentivize Sharing | T0125 Platform Filtering
| T0136.003 Energise Supporters |  | T0086 Develop Image-Based Content | T0105.002 Video Sharing |  |  |  | T0129.008 Redirect URLs |  | T0081.004 Identify Existing Fissures |  | T0092 Build Network | T0100.003 Co-Opt Influencers | T0120.001 Use Affiliate Marketing Programmes |
| T0136.004 Boost Reputation |  | T0086.001 Develop Memes | T0105.003 Audio Sharing |  |  |  | T0129.009 Remove Post Origins |  | T0081.005 Identify Existing Conspiracy Narratives/Suspicions |  | T0092.001 Create Organisations | T0142 Fabricate Grassroots Movement | T0120.002 Use Contests and Prizes |
| T0136.005 Cultvate Support for Initiative |  | T0086.002 Develop AI-Generated Images (Deepfakes) | T0106 Discussion Forums |  |  |  | T0129.010 Misattribute Activity |  | T0081.006 Identify Wedge Issues |  | T0092.002 Use Follow Trains |  | T0121 Manipulate Platform Algorithm |
| T0136.006 Cultivate Support for Ally |  | T0086.003 Deceptively Edit Images (Cheap Fakes) | T0106.001 Anonymous Message Boards |  |  |  | T0130 Conceal Infrastructure |  | T0081.007 Identify Target Audience Adversaries |  | T0092.003 Create Community or Sub-Group |  | T0121.001 Bypass Content Blocking |
| T0136.007 Recruit Members |  | T0086.004 Aggregate Information into Evidence Collages | T0107 Bookmarking and Content Curation |  |  |  | T0130.001 Conceal Sponsorship |  | T0081.008 Identify Media System Vulnerabilities |  | T0093 Acquire/Recruit Network |  | T0122 Direct Users to Alternative Platforms |
| T0136.008 Increase Prestige |  | T0087 Develop Video-Based Content | T0108 Blogging and Publishing Networks |  |  |  | T0130.002 Utilise Bulletproof Hosting |  |  |  | T0093.001 Fund Proxies |  |  |
| T0137 Make Money |  | T0087.001 Develop AI-Generated Videos (Deepfakes) | T0109 Consumer Review Networks |  |  |  | T0130.003 Use Shell Organisations |  |  |  | T0093.002 Acquire Botnets |  |  |
| T0137.001 Generate Ad Revenue |  | T0087.002 Deceptively Edit Video (Cheap Fakes) | T0110 Formal Diplomatic Channels |  |  |  | T0130.004 Use Cryptocurrency |  |  |  | T0094 Infiltrate Existing Networks |  |  |
| T0137.002 Scam |  | T0088 Develop Audio-Based Content | T0111 Traditional Media |  |  |  | T0130.005 Obfuscate Payment |  |  |  | T0094.001 Identify Susceptible Targets in Networks |  |  |
| T0137.003 Raise Funds |  | T0088.001 Develop AI-Generated Audio (Deepfakes) | T0111.001 TV |  |  |  | T0131 Exploit TOS/Content Moderation |  |  |  | T0094.002 Utilise Butterfly Attacks |  |  |
| T0137.004 Sell Items under False Pretences |  | T0088.002 Deceptively Edit Audio (Cheap Fakes) | T0111.002 Newspaper |  |  |  | T0131.001 Legacy Web Content |  |  |  | T0095 Develop Owned Media Assets |  |  |
| T0137.005 Extort |  | T0089 Obtain Private Documents | T0111.003 Radio |  |  |  | T0131.002 Post Borderline Content |  |  |  | T0096 Leverage Content Farms |  |  |
| T0137.006 Manipulate Stocks |  | T0089.001 Obtain Authentic Documents | T0112 Email |  |  |  |  |  |  |  | T0096.001 Create Content Farms |  |  |
| T0138 Motivate to Act |  | T0089.003 Alter Authentic Documents |  |  |  |  |  |  |  |  | T0096.002 Outsource Content Creation to External Organisations |  |  |
| T0138.001 Encourage |  |  |  |  |  |  |  |  |  |  | T0113 Employ Commercial Analytic Firms |  |  |
| T0138.002 Provoke |  |  |  |  |  |  |  |  |  |  | T0141 Acquire Compromised Asset |  |  |
| T0138.003 Compel |  |  |  |  |  |  |  |  |  |  | T0141.001 Acquire Compromised Account |  |  |
| T0139 Dissuade from Acting |  |  |  |  |  |  |  |  |  |  | T0141.002 Acquire Compromised Website |  |  |
| T0139.001 Discourage |  |  |  |  |  |  |  |  |  |  |  |  |  |
| T0139.002 Silence |  |  |  |  |  |  |  |  |  |  |  |  |  |
| T0139.003 Deter |  |  |  |  |  |  |  |  |  |  |  |  |  |
| T0140 Cause Harm |  |  |  |  |  |  |  |  |  |  |  |  |  |
| T0140.001 Defame |  |  |  |  |  |  |  |  |  |  |  |  |  |
| T0140.002 Intimidate |  |  |  |  |  |  |  |  |  |  |  |  |  |
| T0140.003 Spread Hate |  |  |  |  |  |  |  |  |  |  |  |  |  |

- T0073: Determine Target Audiences
- T0002: Facilitate State Propaganda
- T0016: Create Clickbait
- T0015: Create Hashtags and Search Artefacts
- T0029: Online Polls
- T0020: Trial Content
- T0114: Deliver Ads
- T0017: Conduct Fundraising
- T0059: Play the Long Game
- T0132: Measure Performance
- T0072: Segment Audiences
- T0003: Leverage Existing Narratives
- T0007: Create Inauthentic Social Media Pages and Groups
- T0009: Create Fake Experts
- T0039: Bait Influencer
- T0047: Censor Social Media as a Political Force
- T0074: Determine Strategic Ends
- T0066: Degrade Adversary
- T0018: Purchase Targeted Advertisements
- T0023: Distort Facts
- T0043: Chat Apps
- T0042: Seed Kernel of Truth
- T0114.001: Social Media
- T0017.001: Conduct Crowdfunding Campaigns
- T0060: Continue to Amplify
- T0132.001: People Focused
- T0072.001: Geographic Segmentation
- T0004: Develop Competing Narratives
- T0010: Cultivate Ignorant Agents
- T0009.001: Utilise Academic/Pseudoscientific Justifications
- T0049: Flood Information Space
- T0048: Harass
- T0074.001: Geopolitical Advantage
- T0075: Dismiss
- T0101: Create Localised Content
- T0023.001: Reframe Context
- T0043.001: Use Encrypted Chat Apps
- T0044: Seed Distortions
- T0114.002: Traditional Media
- T0057: Organise Events
- T0128: Conceal Information Assets
- T0132.002: Content Focused
- T0072.002: Demographic Segmentation
- T0022: Leverage Conspiracy Theory Narratives
- T0013: Create Inauthentic Websites
- T0097: Create Personas
- T0049.001: Trolls Amplify and Manipulate
- T0048.001: Boycott/"Cancel" Opponents
- T0074.002: Domestic Political Advantage
- T0075.001: Discredit Credible Sources
- T0102: Leverage Echo Chambers/Filter Bubbles
- T0023.002: Edit Open-Source Content
- T0043.002: Use Unencrypted Chats Apps
- T0045: Use Fake Experts
- T0115: Post Content
- T0057.001: Pay for Physical Action
- T0128.001: Use Pseudonyms
- T0132.003: View Focused
- T0072.003: Economic Segmentation
- T0022.001: Amplify Existing Conspiracy Theory Narratives
- T0014: Prepare Fundraising Campaigns
- T0097.001: Produce Evidence for Persona
- T0049.002: Flood Existing Hashtag
- T0048.002: Harass People Based on Identities
- T0074.003: Economic Advantage
- T0076: Distort
- T0102.001: Use Existing Echo Chambers/Filter Bubbles
- T0084: Reuse Existing Content
- T0103: Livestream
- T0046: Use Search Engine Optimisation
- T0115.001: Share Memes
- T0057.002: Conduct Symbolic Action
- T0128.002: Conceal Network Identity
- T0133: Measure Effectiveness
- T0072.004: Psychographic Segmentation
- T0022.002: Develop Original Conspiracy Theory Narratives
- T0014.001: Raise Funds from Malign Actors
- T0098: Establish Inauthentic News Sites
- T0049.003: Bots Amplify via Automated Forwarding and Reposting
- T0048.003: Threaten to Dox
- T0074.004: Ideological Advantage
- T0077: Distract
- T0102.002: Create Echo Chambers/Filter Bubbles
- T0084.001: Use Copypasta
- T0103.001: Video Livestream
- T0115.002: Post Violative Content to Provoke Takedown and Backlash
- T0061: Sell Merchandise
- T0128.003: Distance Reputable Individuals from Operation
- T0133.001: Behaviour Changes
- T0072.005: Political Segmentation
- T0040: Demand Insurmountable Proof
- T0014.002: Raise Funds from Ignorant Agents
- T0098.001: Create Inauthentic News Sites
- T0049.004: Utilise Spamoflauge
- T0048.004: Dox
- T0078: Dismay
- T0102.003: Exploit Data Voids
- T0084.002: Plagiarise Content
- T0103.002: Audio Livestream
- T0115.003: One-Way Direct Posting
- T0126: Encourage Attendance at Events
- T0128.004: Launder Information Assets
- T0133.002: Content
- T0080: Map Target Audience Information Environment
- T0068: Respond to Breaking News Event or Active Crisis
- T0065: Prepare Physical Broadcast Capabilities
- T0098.002: Leverage Existing Inauthentic News Sites
- T0049.005: Conduct Swarming
- T0123: Control Information Environment through Offensive Cyberspace Operations
- T0079: Divide
- T0084.003: Deceptively Labelled or Translated
- T0104: Social Networks
- T0116: Comment or Reply on Content
- T0126.001: Call to Action to Attend
- T0128.005: Change Names of Information Assets
- T0133.003: Awareness
- T0080.001: Monitor Social Media Analytics
- T0082: Develop New Narratives
- T0090: Create Inauthentic Accounts
- T0099: Impersonate Existing Entity
- T0049.006: Conduct Keyword Squatting
- T0123.001: Delete Opposing Content
- T0135: Undermine
- T0084.004: Appropriate Content
- T0104.001: Mainstream Social Networks
- T0116.001: Post Inauthentic Social Media Comment
- T0126.002: Facilitate Logistics or Support for Attendance
- T0129: Conceal Operational Activity
- T0133.004: Knowledge
- T0080.002: Evaluate Media Surveys
- T0083: Integrate Target Audience Vulnerabilities into Narrative
- T0090.001: Create Anonymous Accounts
- T0099.002: Spoof/Parody Account/Site
- T0049.007: Inauthentic Sites Amplify News and Narratives
- T0123.002: Block Content
- T0135.001: Smear
- T0085: Develop Text-Based Content
- T0104.002: Dating App
- T0117: Attract Traditional Media
- T0127: Physical Violence
- T0129.001: Conceal Network Identity
- T0133.005: Action/Attitude
- T0080.003: Identify Trending Topics/Hashtags
- T0090.002: Create Cyborg Accounts
- T0099.003: Impersonate Existing Organisation
- T0049.008: Generate Information Pollution
- T0123.003: Destroy Information Generation Capabilities
- T0135.002: Thwart
- T0085.001: Develop AI-Generated Text
- T0104.003: Private/Closed Social Networks
- T0127.001: Conduct Physical Violence
- T0129.002: Generate Content Unrelated to Narrative
- T0134: Measure Effectiveness Indicators (or KPIs)
- T0080.004: Conduct Web Traffic Analysis
- T0090.003: Create Bot Accounts
- T0099.004: Impersonate Existing Media Outlet
- T0118: Amplify Existing Narrative
- T0123.004: Conduct Server Redirect
- T0135.003: Subvert
- T0085.003: Develop Inauthentic News Articles
- T0104.004: Interest-Based Networks
- T0127.002: Encourage Physical Violence
- T0129.003: Break Association with Content
- T0134.001: Message Reach
- T0080.005: Assess Degree/Type of Media Access
- T0090.004: Create Sockpuppet Accounts
- T0099.005: Impersonate Existing Official
- T0119: Cross-Posting
- T0124: Suppress Opposition
- T0135.004: Polarise
- T0085.004: Develop Document
- T0104.005: Use Hashtags
- T0129.004: Delete URLs
- T0134.002: Social Media Engagement
- T0081: Identify Social and Technical Vulnerabilities
- T0091: Recruit Malign Actors
- T0099.006: Impersonate Existing Influencer
- T0119.001: Post across Groups
- T0124.001: Report Non-Violative Opposing Content
- T0136: Cultivate Support
- T0085.005: Develop Book
- T0104.006: Create Dedicated Hashtag
- T0129.005: Coordinate on Encrypted/Closed Networks
- T0081.001: Find Echo Chambers
- T0091.001: Recruit Contractors
- T0100: Co-Opt Trusted Sources
- T0119.002: Post across Platform
- T0124.002: Goad People into Harmful Action (Stop Hitting Yourself)
- T0136.001: Defend Reputaton
- T0085.006: Develop Opinion Article
- T0105: Media Sharing Networks
- T0129.006: Deny Involvement
- T0081.002: Identify Data Voids
- T0091.002: Recruit Partisans
- T0100.001: Co-Opt Trusted Individuals
- T0119.003: Post across Disciplines
- T0124.003: Exploit Platform TOS/Content Moderation
- T0136.002: Justify Action
- T0085.007: Create Fake Research
- T0105.001: Photo Sharing
- T0129.007: Delete Accounts/Account Activity
- T0081.003: Identify Existing Prejudices
- T0091.003: Enlist Troll Accounts
- T0100.002: Co-Opt Grassroots Groups
- T0120: Incentivize Sharing
- T0125: Platform Filtering
- T0136.003: Energise Supporters
- T0086: Develop Image-Based Content
- T0105.002: Video Sharing
- T0129.008: Redirect URLs
- T0081.004: Identify Existing Fissures
- T0092: Build Network
- T0100.003: Co-Opt Influencers
- T0120.001: Use Affiliate Marketing Programmes
- T0136.004: Boost Reputation
- T0086.001: Develop Memes
- T0105.003: Audio Sharing
- T0129.009: Remove Post Origins
- T0081.005: Identify Existing Conspiracy Narratives/Suspicions
- T0092.001: Create Organisations
- T0142: Fabricate Grassroots Movement
- T0120.002: Use Contests and Prizes
- T0136.005: Cultvate Support for Initiative
- T0086.002: Develop AI-Generated Images (Deepfakes)
- T0106: Discussion Forums
- T0129.010: Misattribute Activity
- T0081.006: Identify Wedge Issues
- T0092.002: Use Follow Trains
- T0121: Manipulate Platform Algorithm
- T0136.006: Cultivate Support for Ally
- T0086.003: Deceptively Edit Images (Cheap Fakes)
- T0106.001: Anonymous Message Boards
- T0130: Conceal Infrastructure
- T0081.007: Identify Target Audience Adversaries
- T0092.003: Create Community or Sub-Group
- T0121.001: Bypass Content Blocking
- T0136.007: Recruit Members
- T0086.004: Aggregate Information into Evidence Collages
- T0107: Bookmarking and Content Curation
- T0130.001: Conceal Sponsorship
- T0081.008: Identify Media System Vulnerabilities
- T0093: Acquire/Recruit Network
- T0122: Direct Users to Alternative Platforms
- T0136.008: Increase Prestige
- T0087: Develop Video-Based Content
- T0108: Blogging and Publishing Networks
- T0130.002: Utilise Bulletproof Hosting
- T0093.001: Fund Proxies
- T0137: Make Money
- T0087.001: Develop AI-Generated Videos (Deepfakes)
- T0109: Consumer Review Networks
- T0130.003: Use Shell Organisations
- T0093.002: Acquire Botnets
- T0137.001: Generate Ad Revenue
- T0087.002: Deceptively Edit Video (Cheap Fakes)
- T0110: Formal Diplomatic Channels
- T0130.004: Use Cryptocurrency
- T0094: Infiltrate Existing Networks
- T0137.002: Scam
- T0088: Develop Audio-Based Content
- T0111: Traditional Media
- T0130.005: Obfuscate Payment
- T0094.001: Identify Susceptible Targets in Networks
- T0137.003: Raise Funds
- T0088.001: Develop AI-Generated Audio (Deepfakes)
- T0111.001: TV
- T0131: Exploit TOS/Content Moderation
- T0094.002: Utilise Butterfly Attacks
- T0137.004: Sell Items under False Pretences
- T0088.002: Deceptively Edit Audio (Cheap Fakes)
- T0111.002: Newspaper
- T0131.001: Legacy Web Content
- T0095: Develop Owned Media Assets
- T0137.005: Extort
- T0089: Obtain Private Documents
- T0111.003: Radio
- T0131.002: Post Borderline Content
- T0096: Leverage Content Farms
- T0137.006: Manipulate Stocks
- T0089.001: Obtain Authentic Documents
- T0112: Email
- T0096.001: Create Content Farms
- T0138: Motivate to Act
- T0089.003: Alter Authentic Documents
- T0096.002: Outsource Content Creation to External Organisations
- T0138.001: Encourage
- T0113: Employ Commercial Analytic Firms
- T0138.002: Provoke
- T0141: Acquire Compromised Asset
- T0138.003: Compel
- T0141.001: Acquire Compromised Account
- T0139: Dissuade from Acting
- T0141.002: Acquire Compromised Website
- T0139.001: Discourage
- T0139.002: Silence
- T0139.003: Deter
- T0140: Cause Harm
- T0140.001: Defame
- T0140.002: Intimidate
- T0140.003: Spread Hate