Research: Researchers Use Fake Social Accounts to Influence NATO Troops during Exercise

NATO’s Strategic Communications Center of Excellence published a report on the effectiveness of social media as an attack vector during military exercises. The researchers were able to use fake Facebook and Instagram accounts to “instill undesirable behavior” among NATO troops participating in an exercise. A combination of strategies were used to target these troops, including fake Facebook pages and groups, targeted advertising, open source research via search engines and “suggested friends” features in order to glean information about the unit, their movements and compromising personal information. In total, the group spent $60 for fake accounts and advertising, which represents a low bar in terms of investment for malicious actors that want to abuse these social network features.

Recommendations

• Enable Impersonation detection for your organization to find potentially fake profiles that engage in tactics, techniques and procedures similar to this research
• Enable rules that contain wordlist matching of potentially sensitive project names or operations to detect leaks of this information to the Internet
• Perform security awareness training with employees or personnel to help combat these attacks

Details

This exercise was part of a larger military training engagement. The NATO Red Team wanted to see if they could influence troop operations and provide useful intelligence using only open source resources. The group attempted to answer three questions:

1. What can we find out about a military exercise just from open source data?
2. What can we find out about the participants from open source data?
3. Can we use all this data to influence the participants behavior against their given orders?

StratCom, along with NATO, published its findings from this exercise last week. Their target set were professional soldiers who have had training specifically on influence operations like this. Over four weeks, the NATO team used a combination of targeted advertisement, closed groups and pages promoting those closed groups to attack the military members. By the end of the exercise 150 soldiers were identified on these platforms, and information collected included battalion locations and troop movements. The researchers even managed to get the troops to leave assigned locations which was explicitly against their orders.