Lion Cipher Lab
Map an influence operation with the DISARM framework (ATT&CK for disinformation)
- Threat Intel Analyst
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Cyber threats aren't only about breaking into systems. A growing slice of what threat-intel teams track is influence operations — coordinated, deceptive campaigns that attack what people believe and do, not the machines they use. These blend into security work constantly: brand-impersonation and spoofed sites, sock-puppet amplification, and hack-and-leak operations where a real breach is weaponised through a fake 'leak' narrative. Just as ATT&CK gave intrusion analysts one shared language, DISARM gives influence-operation analysts one shared language — used by the EU's External Action Service…
What you'll learn
- the DISARM framework (Red and Blue)
- understanding influence operations / FIMI
- mapping a campaign to tactics and techniques
- the ATT&CK-to-disinformation analogy
- coordinated inauthentic behaviour (CIB) judgment
- selecting countermeasures
Steps in this lab
- First: what is an influence operation — and why should a security analyst care?
- DISARM in one breath — it's ATT&CK, aimed at disinformation
- A quick, accurate history — say DISARM, not AMITT
- Open the framework and set up your worksheet
- The scenario — read it once before you map anything
- Map the planning and the narrative (TA14 Develop Narratives)
- Map the assets and the fake legitimacy (TA15 and TA16)
- Map the content and the amplification (TA06 and TA17)
- Switch to Blue — pick countermeasures for the highest-impact techniques
- Judgment: when it's an operation, and when it's just the internet
- What you built — and where it goes next