Technique Spotlight: Impersonating an existing news organisation

Threat actors can impersonate existing news organisations when producing inauthentic content, which has the following strategic benefits:

Exploiting peoples’ trust in a news organisation to make an inauthentic message appear legitimate

When we encounter a new source for information we must decide whether we trust it to be truthful (and can therefore rely on the information it provides). The amount we trust a source can build over time based on our experiences of the information it has delivered to us. A threat actor can exploit peoples’ existing trust for a source by pretending to be them when disseminating falsehoods.

Occupying fact-checking resources of the target organisation while they debunk the impersonation

When a news organisation is impersonated to spread inauthentic content, the organisation must invest resources in reducing the damage of the impersonation; leaving the fake unchecked could result in many people believing false content, or losing faith in the targeted organisation’s reporting capability.

From an operational perspective, members of the organisation with the skills required to safely and effectively debunk an impersonation will need to refocus from their ongoing investigations, which may be beneficial for threat actors who want other truths to remain hidden.

The reason I'm taking this so personally:
If we HAD reached the conclusion Ukraine was responsible, we would have said. We've covered alleged war crimes from both sides without fear.
We would still be researching the attack if we weren't wasting our time debunking this fakery.

— Alistair Coleman (@alistaircoleman) April 13, 2022

For transparency it’s worth noting that I haven’t seen reporting which claims the intention of a threat actor using this tactic is to occupy the resources of a target organisation, but it is regardless a real impact (so I’ve included this section just in case).

Real World Example:

In this example a Twitter account impersonated RapTV (a real news organisation reporting on developments in the music industry) when publishing the following inauthentic story:

Some users replying to the post appeared to believe it was from the legitimate RapTV account, asking why the content was newsworthy:

It makes sense that people were convinced by the impersonation; the illegitimate account has the same profile picture and writing style used by the real RapTV:

A standard user quickly scrolling through their feed may not notice the discrepancies, and take in the posted content as genuine. In this scenario the threat actor was just parodying RapTV, but other examples show the same tactic being used to achieve malicious goals.

Further Reading:

First Draft’s categorisations of information disorder includes a section on Imposter Content which details a variety of cases where legitimate news organisations were impersonated to deceive victims

I first came across imposter content designed to cause harm when I worked in 2014 for UNHCR, the UN Refugee Agency. We were constantly battling Facebook posts where smugglers were creating pages with the UNHCR logo and posting images of beautiful yachts and telling refugees that they should “call this number to get a place on one of these boats that would take them safely across the Mediterranean.”

Understanding Information disorder – Imposter Content by Claire Wardle in October 2019

Relevant Content from the Article Archives

---

Mapping to the DISARM framework

DISARM has the technique “Prepare Assets Impersonating Legitimate Entities” (T0099), in which “an influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content”.

In this post I specified the type of Legitimate Entity (a news organisation), which would make this a sub-technique of T0099. It remains to be seen whether there’s justification for different entities having their own categories; as we continue to uncover more impersonations used in influence operations, we can assess whether such sub-techniques should exist.

---

Threat actors would create impersonations while Preparing for an influence operation. These could be done in Positioning (if creating something like a spoof website to host false information) or in Production (if making something like a false image including the target’s branding).

---

This is a Stage 2 profile. You can read more about Profile Stages here.