mirror of
https://github.com/DISARMFoundation/DISARMframeworks.git
synced 2024-12-24 06:49:47 -05:00
18 lines
2.3 KiB
Markdown
18 lines
2.3 KiB
Markdown
|
# Technique T0097.107: Researcher Persona
|
|||
|
|
|
|||
|
|
* **Summary**: A person with a researcher persona presents themselves as conducting research (e.g. for academic institutions, or think tanks), or having previously conducted research.<br><br>While presenting as a researcher is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as researchers. Threat actors can fabricate researchers (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.<br><br>People who are legitimate researchers (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a Researcher to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.<br><br><b>Associated Techniques and Sub-techniques</b><br><b>T0097.204: Think Tank Persona:</b> People with a researcher persona may present as being part of a think tank.<br><b>T0097.108: Expert Persona:</b> People who present as researching a given topic are likely to also present as having expertise in the area.
|
|||
|
|
|
|||
|
|
* **Belongs to tactic stage**: TA16
|
|||
|
|
|
|||
|
|
|
|||
|
|
| Incident | Descriptions given for this incident |
|
|||
|
|
| -------- | -------------------- |
|
|||
|
|
| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | <I>“In March 2023, [Iranian state-sponsored cyber espionage actor] APT42 sent a spear-phishing email with a fake Google Meet invitation, allegedly sent on behalf of Mona Louri, a likely fake persona leveraged by APT42, claiming to be a human rights activist and researcher. Upon entry, the user was presented with a fake Google Meet page and asked to enter their credentials, which were subsequently sent to the attackers.”</i><br><br>In this example APT42, an Iranian state-sponsored cyber espionage actor, created an account which presented as a human rights activist (T0097.103: Activist Persona) and researcher (T0097.107: Researcher Persona). The analysts assert that it was likely the persona was fabricated (T0143.002: Fabricated Persona) |
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
| Counters | Response types |
|
|||
|
|
| -------- | -------------- |
|
|||
|
|
|
|||
|
|
|
|||
|
|
DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW
|