Page 272 - Cyber Defense eMagazine September 2025

Disinformation Campaigns and False Flag Operations

Just as nation-states use disinformation to mislead public opinion, defenders can plant false narratives
within ecosystems. Examples include fake internal threat intel feeds, decoy sensitive documents, or
impersonated attacker TTPs designed to confuse attribution.

False flag operations are where an environment mimics behaviors of known APTs. The goal is to get one
attack group to think another group is at play within a given target environment. This can redirect
adversaries' assumptions and deceive real actors at an operational stage.

Example: False Flag TTP Implantation to Disrupt Attribution

Consider a long-term red vs. blue engagement inside a critical infrastructure simulation network. The
blue team defenders implement a false flag operation by deliberately injecting decoy threat actor behavior
into their environment. This can include elements such as:

• Simulated PowerShell command sequences that mimic APT29
(https://attack.mitre.org/groups/G0016/) based on known MITRE ATT&CK chains.
• Fake threat intel logs placed in internal ticketing systems referring to OilRig or APT34
(https://attack.mitre.org/groups/G0049/) activity.
• Decoy documents labeled as "internal SOC escalation notes" with embedded references to
Cobalt Strike Beacon callbacks allegedly originating from Eastern European IPs.

All of these artifacts can be placed in decoy systems, honeypots, and threat emulation zones designed
to be probed or breached. The red team, tasked with emulating an external APT, stumble upon these
elements during lateral movement and begin adjusting their operations based on the perceived threat
context. They will incorrectly assume that a separate advanced threat actor is and/or was already in the
environment.

This seeded disinformation can slow the red team’s operations, divert their recon priorities, and lead them
to take defensive measures that burn time and resources (e.g. avoiding fake IOC indicators and
misattributed persistence mechanisms). On the defense side, telemetry confirmed which indicators were
accessed and how attackers reacted to the disinformation. This can become very predictive regarding
what a real attack group would do. Ultimately, the defenders can control the narrative within an
engagement of this sort by manipulating perception.

From Fragility to Adversary Friction

Security chaos engineering has matured from a resilience validation tool to a method of influencing and
disrupting adversary operations. By incorporating techniques such as temporal deception, ambiguity
engineering, and the use of disinformation, defenders can force attackers into a reactive posture.
Moreover, defenders can delay offensive objectives targeted at them and increase their attackers' cost

Cyber Defense eMagazine – September 2025 Edition 272
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.