T0007 "Create Inauthentic Social Media Pages and Groups"

Tactic stage: TA15

Summary: Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.


Has counters:

C00006 Charge for social media
C00012 Platform regulation
C00016 Censorship
C00034 Create more friction at account creation
C00036 Infiltrate the in-group to discredit leaders (divide)
C00040 third party verification for people
C00085 Mute content
C00097 Require use of verified identities to contribute to poll or comment
C00099 Strengthen verification methods
C00107 Content moderation
C00122 Content moderation
C00133 Deplatform Account*
C00135 Deplatform message groups and/or message boards
C00153 Take pre-emptive action against actors' infrastructure
C00172 social media source removal
C00176 Improve Coordination amongst stakeholders: public and private
C00189 Ensure that platforms are taking down flagged accounts
C00197 remove suspicious accounts

Detection methods include:

F00006 SWOT analysis of tech platforms
F00009 Detect abnormal events
F00010 Detect abnormal groups
F00011 Detect abnormal pages
F00012 Detect abnormal profiles, e.g. prolific pages/ groups/ people
F00015 Detect anomalies in membership growth patterns
F00058 Deplatform (cancel culture)
F00062 Detect when Dormant account turns active


Examples include:

Seen in incidents: