Git-Mirrors/DISARMframeworks
1
0
Fork 0
mirror of https://github.com/DISARMFoundation/DISARMframeworks.git synced 2025-02-23 00:19:50 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity
DISARMframeworks/generated_pages/techniques/T0097.206.md

2.6 KiB
Raw Blame History

Technique T0097.206: Government Institution Persona

Summary: Institutions which present themselves as governments, or government ministries, are presenting a government institution persona.

While presenting as a government institution is not an indication of inauthentic behaviour, threat actors may impersonate existing government institutions as part of their operation (T0143.003: Impersonated Persona, T0097.206: Government Institution Persona), to add legitimacy to their narratives, or discredit the government.

Legitimate government institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.206: Government Institution Persona). For example, a government institution could be used by elected officials to spread inauthentic narratives.

Tactic: TA16 Establish Legitimacy Parent Technique: T0097 Present Persona

Associated Technique Description
T0097.111 Government Official Persona Institutions presenting as governments may also present officials working within the organisation.
T0097.112 Government Employee Persona Institutions presenting as governments may also present employees working within the organisation.
Incident Descriptions given for this incident
I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kuleba’s signature seems to be copied from a publicly available letter signed by him in 2021.”

In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona).
Counters Response types

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW