Disinformation Defense

5 automated security scanners

Service Misinformation

Purpose: The Service Misinformation Scanner is designed to detect false claims and service disruption campaigns by analyzing domain reputation, vulnerability disclosures, and specific keyword patterns related to disinformation. This tool helps identify potential misinformation spread through malicious actors, unauthorized access attempts, or other deceptive practices.

What It Detects:

False Claims Detection:
- Identify CVE numbers indicating known vulnerabilities.
- Detect mentions of malware, ransomware, trojans, and other malicious software.
- Locate command and control (C2) server references.
- Find phishing and credential harvesting attempts.
Service Disruption Campaigns:
- Search for indicators of exposed or leaked data.
- Identify unauthorized access incidents.
- Detect data dumps that may indicate service disruptions or breaches.
Domain Reputation Analysis:
- Utilize VirusTotal API to assess domain reputation.
- Check Shodan API for exposed services and vulnerabilities.
- Verify IP addresses against AbuseIPDB for malicious activity.
Known Exploited Vulnerabilities (KEV):
- Cross-reference findings with CISA KEV to identify known exploited vulnerabilities.
- Ensure that reported issues align with publicly recognized security threats.
Keyword Pattern Matching:
- Search for specific keywords provided by the user to detect targeted misinformation or service disruption campaigns.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
keyword (string): Specific keyword to search for targeted misinformation or service disruption campaigns

Business Impact: This scanner is crucial for organizations aiming to maintain the integrity and security of their digital assets. It helps in identifying potential threats posed by false claims, malicious software, unauthorized access attempts, and other deceptive practices that could lead to significant disruptions in services and data breaches.

Risk Levels:

Critical: Conditions where there is a direct threat to critical infrastructure or high-value assets with immediate action required.
High: Conditions involving severe vulnerabilities or imminent threats requiring mitigation efforts within tight timelines.
Medium: Conditions involving significant risks that require attention but can be mitigated over a moderate period.
Low: Conditions where the risk is minimal and can be addressed at leisure without immediate impact on operations.
Info: Conditions providing informational insights useful for future planning but not currently impacting operational security.

If the README doesn’t specify exact risk levels, infer them based on the scanner’s purpose and impact.

Example Findings:

A domain was flagged due to multiple mentions of malware and unauthorized access incidents, indicating a potential breach scenario.
An identified CVE related to a known exploit in critical infrastructure software was reported, prompting an immediate review and patch update by the organization.

Conspiracy Theory Targeting

Purpose: The Conspiracy Theory Targeting Scanner is designed to identify and analyze web content for specific keywords and patterns that may indicate a company’s involvement in conspiracy theories, false narratives, malicious intent, or misinformation. This tool helps organizations proactively detect potential risks associated with the company’s reputation and operations by scanning for indicators of disinformation and hidden agendas.

What It Detects:

Conspiracy Theory Keywords: Identifies mentions of the company name in conjunction with known conspiracy theory terms, suggesting a cover-up or involvement in secret activities.
False Narrative Patterns: Detects patterns that suggest false narratives about the company’s involvement in suspicious events or controlling specific industries.
Malicious Intent Indicators: Looks for indicators of malicious intent such as funding illegal organizations or distributing malware to control markets.
Disinformation Sources: Identifies references to disinformation sources that spread false information about the company, potentially damaging its reputation and operations.

Inputs Required:

domain (string): The primary domain to analyze, providing a comprehensive view of the company’s online presence.
company_name (string): The specific name of the company being analyzed, used for keyword and pattern matching across web content.
keyword (string): A specific keyword related to conspiracy theories or false narratives, which helps in focusing the scanning on relevant topics.

Business Impact: This scanner is crucial for maintaining a clear digital footprint and reputation management strategy. By detecting and mitigating potential risks associated with conspiracy theories and false narratives, organizations can protect their brand image and stakeholder trust from malicious attacks and misinformation campaigns.

Risk Levels:

Critical: Findings that directly link the company to illegal activities such as malware distribution or significant financial fraud are considered critical. These findings could lead to immediate regulatory action or severe damage to the company’s reputation.
High: Significant exposure of sensitive information, unauthorized access points, or substantial misinformation linking the company to false narratives can be classified as high risk. This level requires urgent attention and strategic response plans.
Medium: Information that suggests involvement in less critical conspiracy theories or minor breaches of data security is considered medium risk. However, this does not diminish its importance for monitoring and corrective action.
Low: Informative findings about the company’s online presence but without direct links to malicious activities are classified as low risk. These can be used for continuous improvement in digital security practices.
Info: Any informational findings that do not pose immediate risks or threats to the company’s operations, such as minor mentions of conspiracy theories unrelated to the core business, are considered informational and help in ongoing strategic planning.

Example Findings:

“Acme Corporation was mentioned in a news article discussing a shadowy government cover-up.”
“According to leaked documents, Acme Corporation is suspected of funding a dissident group for political control.”
“A disinformation site falsely claims that Acme Corporation has been distributing ransomware targeting critical infrastructure sectors.”

Executive Targeting

Purpose: The Executive Targeting Scanner is designed to identify and analyze malicious content and disinformation campaigns aimed at executives within a company. It scans publicly available information for signs of character assassination, composite content targeting, threat intelligence indicators, phishing attempts, and exposure incidents that could discredit executive leadership or compromise sensitive information.

What It Detects:

Character Assassination Patterns: The scanner detects derogatory language or personal attacks directed at specific executives, false accusations, rumors about actions or decisions, fabricated evidence, and malicious content targeting executives’ reputations.
Composite Content Indicators: It identifies the use of misleading information that combines facts with falsehoods, manipulated images, videos, or documents, fabricated interviews or quotes, and social media amplification of disinformation campaigns.
Threat Intelligence Indicators: The scanner looks for mentions of known vulnerabilities (CVEs), indicators of compromise (IOCs), malicious software signatures, and command and control (C2) server references related to executive devices or systems.
Phishing and Credential Harvesting Attempts: It detects phishing emails or social engineering tactics targeting executives’ accounts, patterns indicating credential harvesting efforts, and suspicious communications with executives.
Exposure Indicators: The scanner identifies mentions of exposed data, unauthorized access incidents, breached information, and potential insider threats related to executive data.

Inputs Required:

domain (string): Primary domain to analyze, such as acme.com, used for searching company site content and dark web sources.
company_name (string): Company name, like “Acme Corporation”, for specific statement searches related to incidents or breaches.
keyword (string): A specific keyword associated with the executive or target, such as “CEO” or “John Doe”, used in search queries and targeted content analysis.

Business Impact: This scanner is crucial for maintaining the integrity of executive leadership within companies by detecting and mitigating malicious activities that could discredit their public image or compromise sensitive company information. It helps organizations proactively address potential threats to their top executives, ensuring a secure business environment.

Risk Levels:

Critical: Findings include known vulnerabilities exploited for unauthorized access or severe malware infections directly affecting executive devices.
High: Presence of malicious software signatures or indicators of compromise that could lead to system compromises or data breaches involving sensitive information about executives.
Medium: Phishing attempts targeting executive accounts, combined with potential exposure incidents that may not yet be critical but pose a significant risk if left unchecked.
Low: Informational findings such as disinformation patterns that do not directly impact executive security but could indicate broader malicious activities within the company’s digital footprint.
Info: General indicators of suspicious activity or data exposures that require further investigation to confirm and potentially escalate based on context and additional evidence.

Example Findings:

A known vulnerability (CVE-2021-44228) was exploited to gain unauthorized access, posing a critical risk to executive information security.
Malware detected on the CEO’s device indicates potential compromise, requiring immediate attention and system remediation.
Command and control server IP 192.168.1.1 identified in network traffic logs suggests ongoing malicious activity that could affect multiple executive systems.

Corporate Narrative Attacks

Purpose: The Corporate Narrative Attacks Scanner is designed to identify and analyze disinformation campaigns that may be targeting a company. By examining breach disclosure language, attribution claims, and responsibility framing, this scanner aims to detect malicious narratives that could potentially mislead stakeholders and the public.

What It Detects:

Nation-State Actor Claims Without Evidence: The scanner identifies patterns such as “nation[- ]?state actor” or “sophisticated nation[- ]?state attack” in breach disclosure statements, indicating potential claims of involvement from nation-state actors without concrete evidence.
Advanced Persistent Threat (APT) Group Name-Dropping: It detects mentions of specific APT groups like Fancy Bear, Lazarus, APT[0-9], or Equation Group, which are known for sophisticated cyber attacks.
Vague Sophistication Claims: The scanner looks for vague descriptions of sophistication in the breach disclosure statements, such as “sophisticated,” “advanced,” “complex,” or “elaborate,” suggesting a higher level of technical skill involved in the incident.
Third-Party Vendor Blame: It flags mentions of third-party vendors or outsourcing arrangements that might be used to deflect responsibility for the breach.
Employee Scapegoating: The scanner identifies claims blaming rogue employees, insiders, or malicious insiders for the data breach.

Inputs Required:

domain (string): This is the primary domain of the company whose security posture is being assessed. It helps in searching for relevant breach disclosure statements on the company’s website.
company_name (string): The name of the company, which is used to search within their online disclosures for specific keywords related to breaches or cyber attacks.
keyword (string): A specific keyword that relates directly to the type of incident or attack vector being investigated. This helps in focusing the scanner’s analysis on relevant breach statements.

Business Impact: Detecting and understanding disinformation campaigns is crucial as they can significantly impact a company’s reputation, stakeholder trust, and regulatory compliance. Understanding these narratives early can help companies prepare mitigation strategies and communicate effectively with stakeholders during crises.

Risk Levels:

Critical: This risk level would be triggered by clear evidence of nation-state involvement without prior knowledge or confirmation from official sources.
High: Triggered by direct mentions of APT groups, especially those not previously linked to the company’s sector, suggesting a high level of sophistication and intentionality.
Medium: Identified through vague descriptions of complexity or sophistication that are suggestive but not definitively confirmed, requiring further investigation.
Low: Involves third-party vendor mentions without concrete evidence of negligence or misconduct beyond typical contractual risks.
Info: Informational findings include generic descriptions of security incidents that do not fit into the other risk categories and require contextual evaluation based on company policies and industry standards.

Example Findings:

“A sophisticated nation-state actor was behind the breach, claiming responsibility without providing tangible evidence.”
“The attack was carried out by a known APT group, Lazarus, which has been linked to several high-profile cyber attacks.”
“Sophisticated attackers exploited a zero-day vulnerability, suggesting a higher level of technical expertise than typical breaches.”

This structured output provides clear insights into the types of threats and narratives that the scanner is designed to identify, aiding in informed decision-making about corporate security strategies.

Brand Reputation Attacks

Purpose: The Brand Reputation Attacks Scanner is designed to identify and analyze synthetic reviews, coordinated criticism, and other forms of disinformation that could potentially harm a company’s brand reputation. It aims to detect malicious activities such as fake reviews, coordinated negative campaigns, and data breaches or unauthorized access that may be used in disinformation campaigns.

What It Detects:

Synthetic Review Detection: Identifies patterns indicative of fake or automated reviews, looking for repetitive language, unnatural phrasing, and lack of personal details.
Coordinated Criticism Analysis: Detects coordinated negative campaigns across multiple platforms, identifying common themes, timestamps, and IP addresses associated with criticism.
Malicious Activity Indicators: Utilizes threat intelligence feeds to identify malicious activities targeting the company, including indicators such as malware, ransomware, and command-and-control servers.
Exposure Indicators: Detects signs of data breaches or unauthorized access that could be used in disinformation campaigns, identifying patterns like “exposed,” “leaked,” or “breached” in public sources.
Pattern Matching with Real Regex: Utilizes real regex patterns to match known threat indicators and exposure indicators, including CVE numbers, malware terms, and phrases indicating unauthorized access.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)
keyword (string): Specific keyword related to the company or product being targeted

Business Impact: This scanner is crucial as it helps in detecting and mitigating disinformation campaigns that could severely impact a company’s brand reputation, potentially leading to financial losses and loss of consumer trust. It plays a vital role in maintaining the integrity of online reviews and public opinions about companies.

Risk Levels:

Critical: The scanner identifies malicious activities such as fake reviews or coordinated negative campaigns with high confidence, indicating significant risks to the company’s reputation.
High: Detects patterns indicative of disinformation campaigns that could harm the brand image, requiring immediate attention and action to mitigate risks.
Medium: Identifies potential threats that might not be immediately critical but are part of a larger pattern suggesting disinformation efforts, warranting monitoring and strategic responses.
Low: Flags less significant findings such as exposure indicators or minor irregularities in reviews, which do not pose immediate high risks but should still be monitored for trends.
Info: Provides informational insights that might help with ongoing reputation management strategies without being critical or highly risky.

Example Findings:

The scanner identifies a surge of negative reviews on the company’s product page, likely part of a coordinated campaign, which could lead to consumer distrust and decreased sales.
A detected data breach that was not publicly disclosed but is mentioned in suspicious forums online suggests unauthorized access to sensitive information, raising concerns about potential future breaches or misuse of data.