DISARMframeworks/generated_pages/tactics/TA15.md

Tactic TA15: Establish Assets

• Summary: Establishing information assets generates messaging tools, including social media accounts, operation personnel, and organisations, including directly and indirectly managed assets. For assets under their direct control, the operation can add, change, or remove these assets at will. Establishing information assets allows an influence operation to promote messaging directly to the target audience without navigating through external entities. Many online influence operations create or compromise social media accounts as a primary vector of information dissemination.

This Tactic was previously called Establish Social Assets.

• Belongs to phase: P02

Tasks
TK0010 Create personas
TK0011 Recruit contractors
TK0012 Recruit partisans
TK0013 find influencers
TK0014 Network building
TK0015 Network infiltration
TK0016 identify targets - susceptible audience members in networks
TK0033 OPSEC for TA15
TK0034 OPSEC for TA15

Techniques
T0007 Create Inauthentic Social Media Pages and Groups
T0010 Cultivate Ignorant Agents
T0013 Create Inauthentic Websites
T0014 Prepare Fundraising Campaigns
T0014.001 Raise Funds from Malign Actors
T0014.002 Raise Funds from Ignorant Agents
T0065 Prepare Physical Broadcast Capabilities
T0090 Create Inauthentic Accounts
T0090.001 Create Anonymous Accounts
T0090.002 Create Cyborg Accounts
T0090.003 Create Bot Accounts
T0090.004 Create Sockpuppet Accounts
T0091 Recruit Malign Actors
T0091.001 Recruit Contractors
T0091.002 Recruit Partisans
T0091.003 Enlist Troll Accounts
T0092 Build Network
T0092.001 Create Organisations
T0092.002 Use Follow Trains
T0092.003 Create Community or Sub-Group
T0093 Acquire/Recruit Network
T0093.001 Fund Proxies
T0093.002 Acquire Botnets
T0094 Infiltrate Existing Networks
T0094.001 Identify Susceptible Targets in Networks
T0094.002 Utilise Butterfly Attacks
T0095 Develop Owned Media Assets
T0096 Leverage Content Farms
T0096.001 Create Content Farms
T0096.002 Outsource Content Creation to External Organisations
T0113 Employ Commercial Analytic Firms
T0141 Acquire Compromised Asset
T0141.001 Acquire Compromised Account
T0141.002 Acquire Compromised Website

Counters	Response types
C00036 Infiltrate the in-group to discredit leaders (divide)	D02
C00040 third party verification for people	D02
C00051 Counter social engineering training	D02
C00056 Encourage people to leave social media	D02
C00058 Report crowdfunder as violator	D02
C00059 Verification of project before posting fund requests	D02
C00155 Ban incident actors from funding sites	D02
C00160 find and train influencers	D02
C00172 social media source removal	D02
C00197 remove suspicious accounts	D02
C00044 Keep people from posting to social media immediately	D03
C00067 Denigrate the recipient/ project (of online funding)	D03
C00077 Active defence: run TA15 "develop people” - not recommended	D03
C00133 Deplatform Account*	D03
C00135 Deplatform message groups and/or message boards	D03
C00162 Unravel/target the Potemkin villages	D03
C00203 Stop offering press credentials to propaganda outlets	D03
C00034 Create more friction at account creation	D04
C00042 Address truth contained in narratives	D04
C00046 Marginalise and discredit extremist groups	D04
C00052 Infiltrate platforms	D04
C00053 Delete old accounts / Remove unused social media accounts	D04
C00062 Free open library sources worldwide	D04
C00047 Honeypot with coordinated inauthentics	D05
C00189 Ensure that platforms are taking down flagged accounts	D06
C00048 Name and Shame Influencers	D07
C00093 Influencer code of conduct	D07

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW