DISARMframeworks/generated_pages/techniques/T0097.106.md

Technique T0097.106: Recruiter Persona

• Summary: A person with a recruiter persona presents themselves as a potential employer or provider of freelance work.
  
  While presenting as a recruiter is not an indication of inauthentic behaviour, threat actors fabricate recruiters (T0143.002: Fabricated Persona, T0097.106: Recruiter Persona) to justify asking for personal information from their targets or to trick targets into working for the threat actors (without revealing who they are).
  
  Associated Techniques and Sub-techniques
  T0097.205: Business Persona: People with a recruiter persona may present as being part of a business which they are recruiting for.

• Belongs to tactic stage: TA16

Incident	Descriptions given for this incident
I00074 The Tactics & Tropes of the Internet Research Agency	“A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included: - Requests for contact with preachers from Black churches (Black_Baptist_Church) - Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus) - Soliciting volunteers to hand out fliers - Soliciting volunteers to teach self-defense classes - Offering free self-defense classes (Black Fist/Fit Black) - Requests for followers to attend political rallies - Requests for photographers to document protests - Requests for speakers at protests - Requests to protest the Westborough Baptist Church (LGBT United) - Job offers for designers to help design fliers, sites, Facebook sticker packs - Requests for female followers to send photos for a calendar - Requests for followers to send photos to be shared to the Page (Back the Badge) - Soliciting videos for a YouTube contest called “Pee on Hillary” - Encouraging people to apply to be part of a Black reality TV show - Posting a wide variety of job ads (write for BlackMattersUS and others) - Requests for lawyers to volunteer to assist with immigration cases” This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend).
I00078 Meta’s September 2020 Removal of Coordinated Inauthentic Behavior	“[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States. “This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.” Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here. Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona).
I00091 Facebook uncovers Chinese network behind fake expert	“Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China. “State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile. “However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends. “It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him. [...] “It also said that his profile photo also appeared to have been generated using machine-learning capabilities.” In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery).
I00095 Meta: Chinese disinformation network was behind London front company recruiting content creators	“A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta. “The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited. “London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”. In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona).

Counters	Response types

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW