T0057 "Organize Events"

Tactic stage: TA10

Summary: Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.


Has counters:

C00012 Platform regulation
C00016 Censorship
C00036 Infiltrate the in-group to discredit leaders (divide)
C00046 Marginalise and discredit extremist groups
C00048 Name and Shame Influencers
C00070 Block access to disinformation resources
C00074 Identify and delete or rate limit identical content
C00085 Mute content
C00107 Content moderation
C00122 Content moderation
C00126 Social media amber alert
C00128 Create friction by marking content with ridicule or other "decelerants"
C00129 Use banking to cut off access
C00149 Poison the monitoring & evaluation data
C00153 Take pre-emptive action against actors' infrastructure
C00176 Improve Coordination amongst stakeholders: public and private
C00211 Use humorous counter-narratives
C00216 Use advertiser controls to stem flow of funds to bad actors

Detection methods include:

F00004 Recruit like-minded converts "people who used to be in-group"
F00015 Detect anomalies in membership growth patterns
F00038 Social capital as attack vector


Examples include:

Seen in incidents: