DISARMframeworks/generated_pages/techniques/T0097.106.md

Technique T0097.106: Recruiter Persona

Summary: A person with a recruiter persona presents themselves as a potential employer or provider of freelance work.

While presenting as a recruiter is not an indication of inauthentic behaviour, threat actors fabricate recruiters (T0143.002: Fabricated Persona, T0097.106: Recruiter Persona) to justify asking for personal information from their targets or to trick targets into working for the threat actors (without revealing who they are).

Tactic: TA16 Establish Legitimacy Parent Technique: T0097 Present Persona

Associated Technique	Description
T0097.205 Business Persona	People with a recruiter persona may present as being part of a business which they are recruiting for.

Incident	Descriptions given for this incident
I00074 The Tactics & Tropes of the Internet Research Agency	“A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included: - Requests for contact with preachers from Black churches (Black_Baptist_Church) - Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus) - Soliciting volunteers to hand out fliers - Soliciting volunteers to teach self-defense classes - Offering free self-defense classes (Black Fist/Fit Black) - Requests for followers to attend political rallies - Requests for photographers to document protests - Requests for speakers at protests - Requests to protest the Westborough Baptist Church (LGBT United) - Job offers for designers to help design fliers, sites, Facebook sticker packs - Requests for female followers to send photos for a calendar - Requests for followers to send photos to be shared to the Page (Back the Badge) - Soliciting videos for a YouTube contest called “Pee on Hillary” - Encouraging people to apply to be part of a Black reality TV show - Posting a wide variety of job ads (write for BlackMattersUS and others) - Requests for lawyers to volunteer to assist with immigration cases” This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend)., “A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included: - Requests for contact with preachers from Black churches (Black_Baptist_Church) - Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus) - Soliciting volunteers to hand out fliers - Soliciting volunteers to teach self-defense classes - Offering free self-defense classes (Black Fist/Fit Black) - Requests for followers to attend political rallies - Requests for photographers to document protests - Requests for speakers at protests - Requests to protest the Westborough Baptist Church (LGBT United) - Job offers for designers to help design fliers, sites, Facebook sticker packs - Requests for female followers to send photos for a calendar - Requests for followers to send photos to be shared to the Page (Back the Badge) - Soliciting videos for a YouTube contest called “Pee on Hillary” - Encouraging people to apply to be part of a Black reality TV show - Posting a wide variety of job ads (write for BlackMattersUS and others) - Requests for lawyers to volunteer to assist with immigration cases” This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend).
I00091 Facebook uncovers Chinese network behind fake expert	“Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China. “State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile. “However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends. “It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him. [...] “It also said that his profile photo also appeared to have been generated using machine-learning capabilities.” In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery).
I00095 Meta: Chinese disinformation network was behind London front company recruiting content creators	“A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta. “The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited. “London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”. In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona).

Counters	Response types

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW