T0049.005 "Conduct Swarming"

Tactic stage: TA17

Summary: Swarming refers to the coordinated use of accounts to overwhelm the information space with operation content. Unlike information flooding, swarming centers exclusively around a specific event or actor rather than a general narrative. Swarming relies on “horizontal communication” between information assets rather than a top-down, vertical command-and-control approach.

Relationships

Has counters:

Detection methods include:

Datasets

Examples include:

Seen in incidents: