Influence Operations

5 automated security scanners

Narrative Tracking

Purpose: The Narrative_Tracking Scanner is designed to analyze and understand how narratives related to a specified domain, company name, and social Twitter handle are spread across various platforms. It aims to detect the frequency and reach of specific narratives, identify key influencers, track changes in messaging over time, and detect potential threat and exposure indicators.

What It Detects:

Narrative Spread Analysis: Identifies the frequency and reach of specific narratives across various platforms, tracking mentions, retweets, and shares related to the company or domain.
Key Influencer Identification: Determines individuals or entities with a high influence on the narrative spread based on engagement metrics (followers, retweets) and content relevance.
Message Evolution Tracking: Monitors changes in messaging over time to detect shifts in public perception using timestamps of tweets and other social media posts.
Threat Indicator Detection: Identifies potential threat indicators such as CVE numbers, malware mentions, and command-and-control references using regex patterns to match known threat-related terms.
Exposure Indicator Detection: Detects exposure indicators like data breaches, unauthorized access, and data dumps using regex patterns to identify relevant keywords in the narrative spread.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
social_twitter_handle (string): Twitter handle of the company or relevant account (e.g., @acmecorp)

Business Impact: This scanner is crucial for organizations to monitor and understand how information related to their domain, company name, and social media handles is being disseminated across platforms. It helps in identifying key influencers and tracking changes in public perception, which can be critical for crisis management and strategic communications.

Risk Levels:

Critical: The scanner identifies a security incident or data breach that has not been publicly disclosed by the company.
High: The scanner detects unauthorized access to sensitive information or mentions of malware/ransomware related to the domain.
Medium: The scanner identifies potential exposure indicators such as leaked data or unauthorized access attempts in tweets and retweets.
Low: Informational findings indicating general discussions about the company’s products, services, or industry without specific threat or exposure implications.
Info: Non-specific mentions that do not directly indicate a security incident or breach but could be indicative of public interest or discussion around the domain.

Example Findings:

A critical finding might be an identified data breach disclosed by the company on its website, which is flagged by the scanner as a potential threat indicator.
A high-severity finding could be a tweet mentioning malware actively targeting the company’s systems, prompting further investigation and mitigation efforts.

Purpose: The Social Media Manipulation Scanner is designed to detect unauthorized use of company-specific hashtags and trending manipulation on social media platforms. It aims to identify malicious attempts to influence public opinion, mislead about a company’s reputation, or target specific security incidents by monitoring tweets for patterns indicative of malware, ransomware, phishing, command and control servers, or other malicious activities.

What It Detects:

Hashtag Hijacking: Identifies unauthorized use of company-specific hashtags by external entities.
Trending Manipulation: Monitors if false information is being promoted and trending on social media platforms.
Malicious Content Detection: Looks for patterns indicative of malware, ransomware, or other malicious activities in tweets.
Command and Control Indicators: Detects references to command and control servers or infrastructure.
Phishing Attempts: Identifies phishing attempts or credential harvesting efforts mentioned in tweets.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
social_twitter_handle (string): Twitter handle of the company (e.g., @acmecorp)

Business Impact: This scanner is crucial for maintaining a robust security posture by proactively detecting potential threats to a company’s reputation and sensitive information circulating on social media platforms. It helps in mitigating risks associated with unauthorized access, data breaches, and misleading public statements that could lead to significant financial and reputational damage.

Risk Levels:

Critical: Findings include references to malware or ransomware directly affecting the company’s systems, indicating a severe security breach.
High: Exposure of sensitive information or unauthorized access points are detected, posing a high risk of data theft or system compromise.
Medium: Patterns suggesting potential phishing attempts or manipulation around the company’s reputation indicate medium severity risks that need attention to protect brand integrity and user trust.
Low: Informational findings such as use of unofficial hashtags might require immediate action if they are being misused but do not pose direct threats to security or operations.
Info: General trends on social media that may suggest public discussions around the company, useful for understanding market sentiment but generally not affecting internal systems directly.

Example Findings:

A tweet containing “CVE-2023-1234” and discussing unauthorized access to sensitive data suggests a critical risk of an existing vulnerability being exploited by malicious actors.
A trending hashtag falsely claiming that Acme Corporation has been breached could be considered high risk, as it might lead to panic among stakeholders and potential customer loss if not addressed promptly.

Coordinated Inauthentic Behavior

Purpose: The Coordinated Inauthentic Behavior Scanner is designed to identify and analyze bot networks and amplification campaigns by evaluating domain reputation, IP exposure, known vulnerabilities, and dark web activities. This tool helps in identifying coordinated efforts to manipulate online presence and influence operations, thereby safeguarding digital environments from malicious activities.

What It Detects:

Bot Network Indicators: Detection of automated scripts or bots using the Shodan API.
Amplification Campaign Indicators: Analysis of IP reputation using AbuseIPDB to identify malicious IPs and scanning for known exploited vulnerabilities listed in CISA KEV.
Domain Reputation Indicators: Evaluation of domain reputation through VirusTotal API and identification of malicious activities or threats associated with the domain.
Vulnerability Exposure Indicators: Lookup of CVEs using NVD/CVE database to find exposed vulnerabilities and detection of services with known vulnerabilities listed in Shodan.
Dark Web Activity Indicators: Monitoring dark web feeds for mentions of the company or domain and identification of potential threats or malicious activities targeting the organization.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
social_twitter_handle (string): Twitter handle of the company (e.g., @acmecorp)

Business Impact: This scanner is crucial for organizations aiming to maintain a secure and authentic digital presence, as it helps in detecting and mitigating bot networks and amplification campaigns that could manipulate online operations and influence public opinion.

Risk Levels:

Critical: Conditions where the identified threats pose an immediate risk to organizational security, such as known vulnerabilities exploited by advanced persistent threat actors.
High: Conditions where unauthorized access or data exposure poses a significant risk to business operations and integrity.
Medium: Conditions where potential risks exist but are less severe than those at high risk levels.
Low: Conditions indicating minimal risk with no immediate impact on security posture.
Info: Conditions providing informational insights without direct threat implications.

If the specific risk levels are not detailed in the README, it can be inferred that critical and high risks pertain to severe threats requiring immediate attention, while medium and low risks indicate less severe but still significant concerns.

Example Findings: The scanner might flag a domain with multiple known vulnerabilities across various services or an IP address frequently associated with malicious activities on the dark web.

Platform-Specific Manipulation

Purpose: The Platform-Specific Manipulation Scanner is designed to detect and analyze various vulnerabilities and malicious activities by examining domain exposure, IP reputation, known exploited vulnerabilities, and dark web activities. This tool aims to identify potential security weaknesses and malicious actions that could compromise a company’s digital assets.

What It Detects:

CVE Indicators: Identifies specific Common Vulnerabilities and Exposures (CVE) in the domain or associated IPs, which are critical for understanding known vulnerabilities in systems.
Malware and Ransomware Indicators: Detects mentions of malware, ransomware, and trojans within threat intelligence feeds, crucial for assessing potential cyber threats.
Command and Control (C2) Indicators: Identifies references to command and control servers, which are often used by attackers to manage compromised systems, indicating active malicious activities.
Phishing and Credential Harvesting Indicators: Detects indicators of phishing attempts and credential harvesting activities, highlighting potential cyber threats that could lead to unauthorized access or data breaches.
Exposure Indicators: Identifies signs of data exposure, unauthorized access, or data breaches, which are critical for understanding the level of sensitive information at risk.

Inputs Required:

domain (string): The primary domain to analyze, such as acme.com, providing a specific target for vulnerability scanning.
company_name (string): The company name, like “Acme Corporation,” which is used in searching for breach disclosure statements and incident reports.
social_twitter_handle (string): The Twitter handle of the company, such as @acmecorp, providing additional context for social media analysis related to cybersecurity incidents.

Business Impact: This scanner is crucial for organizations looking to proactively identify potential security threats and vulnerabilities that could be exploited by malicious actors. By detecting early signs of compromised systems or unauthorized access, companies can take immediate action to mitigate risks and protect their sensitive information.

Risk Levels:

Critical: Conditions where critical vulnerabilities are identified in the domain or associated IPs, indicating a high risk of data exposure or system compromise.
High: Conditions where malware, ransomware, or trojans are detected within threat intelligence feeds, highlighting potential significant risks to the organization’s security posture.
Medium: Conditions where phishing activities or credential harvesting are identified, which could lead to unauthorized access and sensitive information theft.
Low: Informal findings that do not pose immediate critical threats but should still be monitored for trends or future risk assessments.
Info: Informational findings that provide context about known vulnerabilities or system exposures without directly impacting security risks.

If specific risk levels are not detailed in the README, these can be inferred based on the scanner’s purpose and impact, with criticality increasing as threats become more severe.

Example Findings:

“CVE-2021-44228 was identified in our systems,” indicating a known vulnerability that needs immediate attention.
“Malicious activity detected by VirusTotal: {‘engine_name’: ‘example_engine’, ‘result’: ‘malicious’},” highlighting potential malicious software impacting the organization’s digital assets.

Astroturfing Campaigns

Purpose: The Astroturfing Campaigns Scanner is designed to identify and analyze fake grassroots movements and artificial consensus by examining social media activity, domain reputation, and threat intelligence feeds. It aims to detect signs of orchestrated influence operations that may be attempting to manipulate public opinion or promote false narratives.

What It Detects:

Social Media Activity Analysis: The scanner tests for unusual spikes in follower growth or engagement, checks for coordinated messaging patterns indicative of bot activity, verifies the authenticity of user-generated content related to the company or domain, detects automated retweets and likes from unfamiliar accounts, and flags suspiciously high interaction rates with minimal organic engagement.
Domain Reputation Analysis: The scanner tests for malicious activities associated with the domain using VirusTotal API, checks for known vulnerabilities listed in CISA KEV, verifies IP reputation using AbuseIPDB, detects recent data breaches or exposures involving the domain, and flags suspicious DNS changes or subdomain registrations.
Threat Intelligence Feeds: The scanner tests for mentions of the domain or company name in dark web forums and marketplaces, checks Shodan API for exposed services or vulnerabilities linked to the domain, verifies known exploits targeting the domain using NVD/CVE database, detects malicious activities reported by other threat intelligence sources, and flags suspicious network traffic patterns indicating compromised infrastructure.
Content Analysis: The scanner checks for consistent messaging across multiple social media platforms, ensures the presence of real user testimonials or endorsements, verifies the authenticity of influencer collaborations and partnerships, detects repetitive content with minor variations suggesting automated posting, and flags unusual promotional activities without genuine community support.
Behavioral Patterns: The scanner identifies sudden changes in online behavior indicative of orchestrated campaigns, checks for coordinated actions across different social media channels, verifies the presence of multiple accounts engaging in similar activities, and detects patterns of engagement that deviate from typical user behavior.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
social_twitter_handle (string): Twitter handle of the company (e.g., @acmecorp)

Business Impact: This scanner is crucial for organizations and individuals seeking to distinguish between genuine grassroots movements and artificial campaigns orchestrated by bad actors. It helps in maintaining transparency, protecting public trust, and ensuring that online discussions reflect authentic community engagement rather than manipulated influence operations.

Risk Levels:

Critical: The risk level is critical when the scanner detects malicious activities associated with the domain or mentions of the domain in dark web forums, indicating a high likelihood of compromised infrastructure or illicit activity.
High: High risks are identified through coordinated messaging patterns on social media platforms and suspicious network traffic patterns that suggest unauthorized access to the domain’s resources.
Medium: Medium risk findings include unusual spikes in follower growth, automated retweets from unfamiliar accounts, and minor variations in content suggesting automated posting.
Low: Low risk findings pertain to minor deviations from typical user behavior on social media platforms and minimal exposure of services or vulnerabilities through Shodan API scans.
Info: Informational findings include consistent messaging across multiple social media platforms that align with the company’s public statements, indicating a genuine online presence.

If specific risk levels are not specified in the README, these inferred levels reflect potential severity based on the scanner’s purpose and impact.

Example Findings:

Critical: The scanner identifies multiple accounts engaging in coordinated messaging across social media platforms promoting support for Acme Corporation, suggesting a critical risk of orchestrated influence operations.
High: A sudden spike in follower growth followed by automated retweets from unfamiliar accounts raises concerns about high risks associated with potential fake grassroots movements and artificial consensus.