DISARMframeworks/generated_pages/techniques/T0097.206.md
2024-07-27 05:24:28 -04:00

2.5 KiB
Raw Blame History

Technique T0097.206: Government Institution Persona

  • Summary: Institutions which present themselves as governments, or government ministries, are presenting a government institution persona.

    While presenting as a government institution is not an indication of inauthentic behaviour, threat actors may impersonate existing government institutions as part of their operation (T0143.003: Impersonated Persona, T0097.206: Government Institution Persona), to add legitimacy to their narratives, or discredit the government.

    Legitimate government institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.206: Government Institution Persona). For example, a government institution could be used by elected officials to spread inauthentic narratives.

    Associated Techniques and Sub-techniques
    T0097.111: Government Official Persona: Institutions presenting as governments may also present officials working within the organisation.
    T0097.112: Government Employee Persona: Institutions presenting as governments may also present employees working within the organisation.

  • Belongs to tactic stage: TA16

Incident Descriptions given for this incident
I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kulebas signature seems to be copied from a publicly available letter signed by him in 2021.”


In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona).
Counters Response types

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW