text: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52020DC0790&from=EN 2 See https://www.enisa.europa.eu/publications/enisa-threat-landscape-methodology 3 See https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends

text: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52020DC0790&from=EN Please use footnotes for providing additional or explanatory information and/or relevant links. References should be listed in a dedicated section. Use only the function References/Insert Footnote

text: https://data.consilium.europa.eu/doc/document/ST-11429-2022-INIT/en/pdf https://www.eeas.europa.eu/eeas/strategic-compass-security-and-defence-1_en 8 See https://www.enisa.europa.eu/publications/enisa-threat-landscape-methodology 9 See https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends

text: See https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends 11 One of the feedbacks received from the ENISA ad hoc Working Group on Cybersecurity Threat Landscapes suggested to consider the platform element in the analytical framework. For example, the Atlantic Council's Digital Forensic Research Lab (DFRLab) describes the medium through which the disinformation is conveyed, to include open web, social media, and messaging services. https://github.com/DFRLab/Dichotomies-of-Disinformation#platforms. 12 https://attack.mitre.org/matrices/enterprise/ 13 https://disarmframework.herokuapp.com/

text: OpenCTI is a product powered by the collaboration of the private company Filigran, the French national cybersecurity agency (ANSSI), the CERT-EU and the Luatix non-profit organization. More information: https://github.com/OpenCTI-Platform/datasets 15 https://eur-lex.europa.eu/eli/dir/2016/1148/oj 16 See https://www.europarl.europa.eu/thinktank/en/document/EPRS_BRI(2021)689333 17 OpenCTI is a product powered by the collaboration of the private company Filigran, the French national cybersecurity agency (ANSSI), the CERT-EU and the Luatix non-profit organization. More information: https://github.com/OpenCTI-Platform/datasets 18 Availability can be resource availability, service availability, and/or operation(business) continuity.

text: Although this data label refers to events that last longer than one month, it is important to note that FIMI/disinformation events can last years.

text: As explained in section 2.4, the category “Manipulation of information” has been used at the triage stage to identify the events in scope of the report, which all share this motivation. Accordingly, the analysis of section 3 does not include “manipulation of information” among the motivations. 21 https://disarmframework.herokuapp.com/ 22 The other DISARM framework is called “DISARM Blue”, which focuses on disinformation countermeasures. DISARM Blue maps response options to take in reaction to the TTPs outlined in DISARM Red.

text: In accordance with the EU cybersecurity act Art.7 Par.6 (https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:32019R0881&from=EN) 25 As explained in section 2.4, the framework underlying the ENISA Threat Landscape includes among the possible motivations also the category “Manipulation of information”. This category has been used to select the events to be analysed in the current report, which are all motivated by the manipulation of information. Accordingly, this category is not reflected in the analysis of motivations in section 3.2.3. Still, it has been included in the description of “Motivations” as it could be used at the triage stage to identify relevant events. 26 “Information operation’ means planned and coordinated actions and measures used to influence the target audience” - National Cybersecurity Status Report 2020 – Ministry of National Defence of the Republic of Lithuania

text: It is to be noted that the tactics outlined in this graph represents more than 85% of the total.

text: It is to be noted that the tactics outlined in this graph represents more than 70% of the total.

text: Each event might be associated to more than one asset

text: Some examples of work in this direction: EUvsDisinfo is a project led by the EEAS that identifies, compiles, and exposes disinformation cases originating in pro-Kremlin media (https://euvsdisinfo.eu/); the open source threat intelligence platform MISP which contains a “galaxy” (a method to express an object that can be attached to events or attributes) on threat actors (https://www.misp-project.org/galaxy.html#_misinformation_pattern); the European Digital Media Observatory that brings together fact-checkers, media literacy experts, and academic researchers to understand and analyse disinformation (https://edmo.eu/edmo-ata-glance/) Please use footnotes for providing additional or explanatory information and/or relevant links. References should be listed in a dedicated section. Use only the function References/Insert Footnote

text: Source: Eurostat (“Enterprises make persons employed aware of their obligations in ICT related issues” – 2019 data) https://appsso.eurostat.ec.europa.eu/nui/submitViewTableAction.do 32 For example, one important lesson from the “traditional” cybersecurity analysis is to avoid the abundance of threat actors/campaign naming.

text: See https://stixproject.github.io/ 34 https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act 35 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0595 36 https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package 37 https://eur-lex.europa.eu/legal-content/en/TXT/?uri=COM%3A2020%3A842%3AFIN 38 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52021PC0206 39 https://digital-strategy.ec.europa.eu/en/policies/code-practice-disinformation 40 https://ec.europa.eu/info/strategy/priorities-2019-2024/new-push-european-democracy/european-democracy-action-plan_en 41 https://www.eeas.europa.eu/eeas/strategic-compass-security-and-defence-1_en 42 https://ec.europa.eu/commission/presscorner/detail/en/ip_22_5504

identifier: Foreign Information Manipulation Interference (FIMI) and Cybersecurity - Threat Landscape

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Foreign Information Manipulation Interference (FIMI) and Cybersecurity - Threat Landscape

serie: rapporter

text: FOREIGN INFORMATION MANIPULATION AND INTERFERENCE (FIMI) AND CYBERSECURITY – THREAT LANDSCAPE FOREIGN INFORMATION MANIPULATION AND INTERFERENCE (FIMI) AND CYBERSECURITY – THREAT LANDSCAPE

type: rubrik

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For contacting the authors please use etlteam@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: ENISA: Erika Magonara, Apostolos Malatras

text: EEAS: EEAS Strategic Communication Task Forces and Information Analysis Division (SG.STRAT.2)

text: LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2022 This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

text: Cover image ©Shutterstock. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-606-4, DOI: 10.2824/7501

text: FOREIGN INFORMATION MANIPULATION AND INTERFERENCE (FIMI) AND CYBERSECURITY – THREAT LANDSCAPE

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 6

text: 1.1 CONTEXT 6

text: 1.2 SCOPE 7

text: 1.3 TARGET AUDIENCE 8

text: 1.4 STRUCTURE 8

text: 2. PROPOSED APPROACH 9

text: 2.1 OVERVIEW 9

text: 2.2 SECTORS AND VICTIMS AND IMPACT 9

text: 2.3 SEVERITY AND DURATION 11

text: 2.4 THREAT ACTORS AND MOTIVATION 12

text: 2.5 DISARM FRAMEWORK AND MITRE ATT&CK 12

text: 3. TESTING THE FRAMEWORK: ANALYSIS AND TRENDS 14

text: 3.1 DATA COLLECTION AND CLEANING 14

text: 3.2 APPLICATION OF THE PROPOSED APPROACH – DATA ANALISYS 15

text: 3.2.1 Sectors, victims and impact 15 3.2.2 Severity and duration 16 3.2.3 Threat actors and motivation 17 3.2.4 DISARM framework and MITRE ATT&CK 18

text: 4. RECOMMENDATIONS 23

text: 4.1 TECHNICAL 23

text: 4.1.1 On the analytical framework 23 4.1.2 On the role of cybersecurity 24

text: 4.2 STRATEGIC 25

text: 4.3 POLICY 26

text: EXECUTIVE SUMMARY

text: The EU Agency for Cybersecurity (ENISA) and the European External Action Service (EEAS) have joined forces to study and analyse the threat landscape concerning Foreign Information Manipulation and Interference (FIMI) and disinformation. A dedicated analytical framework is put forward, consistent with the ENISA Threat Landscape (ETL) methodology, with the aim of analysing both FIMI and cybersecurity aspects of disinformation.

text: The concept of Foreign Information Manipulation and Interference (FIMI) has been proposed by the EEAS, as a response to the call of the European Democracy Action Plan for a further

text: FIMI

text: refinement of the definitions around disinformation. Although disinformation is a prominent part Foreign Information of FIMI, FIMI puts emphasis on manipulative behaviour, as opposed to the truthfulness of the Manipulation and content being delivered. Several strategic documents, such as the Strategic Compass for Interference (FIMI) Security and Defence and the July 2022 Council Conclusions on FIMI, refer to the importance of describes a mostly noncountering FIMI as well as hybrid and cyber threats. illegal pattern of behaviour that threatens Accordingly, in light of broader hybrid threats that cross different domains, one of the main or has the potential to motivations behind this report is to identify ways to bring the cybersecurity and counter-FIMI negatively impact communities closer together. The ambition is to provide an input to the on-going and evervalues, procedures and pressing discussion on the nature and dynamics of information manipulation and interference, political processes. Such including disinformation, and on how to collectively respond to this phenomenon. activity is manipulative in character, conducted in The report proposes and tests an analytical approach describing FIMI and manipulation of an intentional and information, as well as the underlying cybersecurity elements, by combing practices from both coordinated manner. domains: Actors of such activity can be state or non-state • For cybersecurity: The open methodological framework used by ENISA’s annual actors, including their report on the state of the cybersecurity threat landscape, the ENISA Threat proxies inside and Landscape Reports outside of their own • For FIMI: The open-source DISARM framework used to capture FIMI/disinformation territory.

text: By testing the framework on a limited set of events, the report serves as a proof of concept for the interoperability of the frameworks. In addition, it puts forward some preliminary conclusions on the relationship between cybersecurity and FIMI/disinformation:

text: • Role of cybersecurity in FIMI/disinformation. Cybersecurity analysis seems to be particularly important in establishing attribution: among the events analysed, those that had been attributed relied on a cybersecurity analysis. In addition, cyber-attacks seem to be more prominent at the initial stages of FIMI/disinformation events. This means firstly that specific cyber-attack techniques could act as an indicator of a FIMI/disinformation event and, secondly, that awareness raising is important to limit the development or acquisition of content and the compromise of infrastructure that facilitate dissemination. • Importance of structured and seamless incident reporting between the cybersecurity and FIMI/disinformation community. Consistency of data and data quality are the main limitation to cross-domain analyses. For example, open-source data about FIMI/disinformation events often cover entire operations encompassing several incidents, whereas a “pure” cybersecurity perspective would tend to focus on

text: single incidents. Also, data about FIMI/disinformation events might not contain sufficient information about its cybersecurity aspects. In both cases, improved incident reporting practices could help. • Mutual exchanges between the cybersecurity and the FIMI/disinformation community could benefit the fight against FIMI/disinformation. Since incident handling and response has been at the core of the cybersecurity community for many years, established cybersecurity practices can help the counter FIMI/disinformation community speeding up analytical maturity. For example, the FIMI community can adopt and adapt standard information formats widely used in the cybersecurity realm, to move beyond information sharing by written reports. Conversely, the FIMI/disinformation community can, in return, inform cybersecurity practitioners on new and emerging motivations, targets and threat vectors.

text: This report has been validated and supported by the ENISA ad hoc Working Group on Cybersecurity Threat Landscapes (CTL) .

text: 1. INTRODUCTION

text: 1.1 CONTEXT

text: This chapter details the concepts used in the report to describe and define manipulation of information, focusing on the activities the EU aims to address and explaining why the terminology commonly used might not be sufficiently comprehensive and precise.

text: One of the most important parameters in defining the manipulation of information is the notion of “intent”. “Misinformation”, i.e. the unintentional spread of false and/or misleading information, differs from the intentional manipulation of the information environment. The importance of this basic distinction is the repertoire of response options that can be used for unintentional misinformation versus intentional information manipulation. Responses like exposing the actors responsible for such activity is adequate if actors engage in intentional, coordinated and systematic manipulation, but not if they are individual citizens who merely believed a false/misleading piece of information. Misinformation falls outside the scope of this report.

text: Intentional attempts to manipulate the information environment and public discourse by foreign actors is by no means a new phenomenon. However, activity which has previously been described as “propaganda” and more recently as “disinformation” has received a considerable new impetus by technological advancements and the propagation of the internet, in particular social media and private messenger services. With this development, new ways of manipulation have become available to malicious actors. In the last years, the term “disinformation”, intended as the intentional spread of false and/or misleading information for a specific purpose, has become well-known and broadly used. However, this definition of disinformation captures only part of the problem: the manipulation of the content that is being pushed to distort facts and reality, to foster fear and hatred and to sow division in societies. Other terms have also been developed, such as “computational propaganda”, “coordinated inauthentic behaviour” or “information pollution”, to name just a few. These either incorporate new aspects in addition to disinformation intended as above or they depict activities that go beyond its focus on content.

text: The current over-abundance of terms and concepts could hamper effective responses and lead to confusion over which phenomena or aspects thereof are actually being addressed. This is exacerbated by the fact that the stakeholders countering such threats are diverse: from international organisations to governments (national, regional and even local), private industry and civil society. Therefore, it is necessary to go beyond the surface and be more specific in describing the manipulation of the information environment the EU aims to address.

text: Accordingly, the European Democracy Action Plan called for the further refinement of the definitions, in close cooperation with stakeholders. The European External Action Service (EEAS) has proposed the definition of “Foreign Information Manipulation and Interference”:

text: “Foreign Information Manipulation and Interference (FIMI) describes a mostly non-illegal pattern of behaviour that threatens or has the potential to negatively impact values, procedures and political processes. Such activity is manipulative in character, conducted in an intentional and coordinated manner. Actors of such activity can be state or non-state actors, including their proxies inside and outside

text: of their own territory.”

text: The concept of FIMI puts emphasis on manipulative behaviour as the main indicator of an attack instead of content and its truthfulness. From this perspective, the manipulation of the information environment is only one aspect of FIMI, although a prominent one.

text: The need to further step up the EU’s efforts in the area of FIMI has been highlighted in the recent 6 7 Council Conclusions on FIMI . Also, the Strategic Compass for Security and Defence stresses that FIMI does not only constitute a threat to democracy, but also to our security. Russia’s use of information manipulation and interference in the preparation and execution of its war of aggression against Ukraine demonstrates this and shows how such activity constitutes an integral part of modern warfare.

text: Cybersecurity is an important aspect of this context. Firstly, hybrid threats make use of combinations of cyberattacks and information manipulation to successfully materialise. Therefore, a comprehensive analysis of related phenomena has to encompass the cybersecurity domain. Secondly, a thorough understanding of the tactics, techniques and procedures (TTPs) used by malicious actors is crucial for effective response to threats – this corresponds to the part of the FIMI definition which speaks about a “pattern of behaviour” and “activity [that is] manipulative in character”. In the cyber domain working with TTPs has been an established practice for many years and can inform approaches to counter-FIMI.

text: 1.2 SCOPE

text: The objective of the report is to propose and test an analytical approach describing FIMI and manipulation of information (hereby referred to as “FIMI/disinformation”) as well as the underlying cybersecurity elements. The peculiarity of such approach is in the combination of practices from both the counter-FIMI and the cybersecurity communities in order to:

text: • Describe FIMI/disinformation, creation and dissemination behaviours as a way to

text: expose the activities the EU aims to prevent, deter and respond to

text: • Show the role of (or lack of thereof) in the production of FIMI/ disinformation, by

text: identifying the underlying cybersecurity elements

text: To do so, the proposed approach relies on two pillars:

text: • For cybersecurity: The open methodological framework used by ENISA’s annual report on the state of the cybersecurity threat landscape, the ENISA Threat Landscape Reports • For FIMI: The open-source DISARM framework used to capture FIMI/disinformation

text: In light of broader hybrid threats that cross different domains, one of the main motivations behind this approach is to identify ways to bring the cybersecurity and FIMI communities closer together. In this respect, the approach showcases how work on FIMI/disinformation can benefit from approaches from the cyber domain where e.g. working with TTPs has been an established practice for many years.

text: A considerable part of the approach builds on the idea that a concurrent analysis of relevant events by means of specialised frameworks that adequately describe the characteristics of the respective domains (cybersecurity and FIMI) can yield significant intelligence and amplify joint situational awareness therefore allowing better identification and protect against FIMI/disinformation.

text: By testing the proposed approach on a real set of events, the report serves as a proof of concept for the interoperability of the frameworks. In addition, it puts forward some preliminary conclusions on the relationship between cybersecurity and FIMI/disinformation.

text: IMPORTANT: Relevant statistics and findings are presented; however, it needs to be highlighted that the findings are dependent on the limited set of specific incidents analysed and that this report is

text: designed to give a first indication as food-for-thought. Future, much richer datasets and further research will bring better insight.

text: As stated above, a shared understanding on how to describe the manipulation of the information environment is key for the detection of malicious activities, information sharing and response. Against this context, the proposed approach should not be intended as a final product, but rather as an initial, operational contribution to this common effort. Ultimately, the ambition is to provide an input to the ongoing and ever-pressing discussion on the nature and dynamics of information manipulation and interference, including disinformation, and on how to collectively respond to this phenomenon.

text: 1.3 TARGET AUDIENCE

text: The audience of the report consists of policy-makers, as well as of practitioners and academics from both the counter-FIMI/Disinformation and cybersecurity communities, who could use and/or enhance the proposed approach to describe FIMI/Disinformation incidents and define countermeasures.

text: 1.4 STRUCTURE

text: The report is structured as follows:

text: • Section 2 presents the proposed approach, including a general overview and its categories and definitions • Section 3 shows how the proposed approach has been applied and tested on a limited set of events. • Section 4 outlines the conclusions and recommendations on different levels: technical, strategic and political

text: 2. PROPOSED APPROACH

text: As explained above, the two pillars of the proposed approach are, on one hand the framework used by ENISA’s annual report on the state of the cybersecurity threat landscape, the ENISA Threat Landscape Reports , and, on the other hand, the DISARM. The former has been adapted and complemented with practices from the counter-disinformation community, in particular with respect to the severity and the disinformation tactics.

text: 2.1 OVERVIEW

text: The table below shows an overview of the proposed approach, which is expanded in the subsequent sections:

text: Table 1: Overview of the analytical framework

text: Categories Description

text: Sectors (Primary and secondary) Open Cyber Threat Intelligence (Open CTI) Platform

text: EU Directive 2016/1148 (NIS Directive)

text: Severity Reach of a FIMI/disinformation event

text: Duration Short/Medium/Long

text: Impact Domains affected

text: Threat actors Technical or political attribution to a state, non-state actor or proxy

text: Motivation Reason underlying an information event

text: MITRE ATTA&CK MITRE ATT&CK for Enterprise

text: DISARM DISARM (DISinformation Analysis & Risk Management) Red framework

text: 2.2 SECTORS AND VICTIMS AND IMPACT

text: The classification of the sectors and victims has been defined in order to reflect the fact that an event directly affecting one sector/one victim or having a specific direct impact, might be designed to target another sector/another victim and to have another impact. As an illustration, the primary target could be the holder of a social media account that an actor breaches to gain control, but the secondary target (the one that is the intended target of an actor) could be the followers of the account.

text: Although in FIMI/disinformation the secondary effect is often speculative, in an attempt to capture the actual intent of an attacker, the events are described in terms of:

text: • Primary sector/victim/impact • Secondary sector/victim/impact

text: Table 2: Example: fake accounts on social media posting critical allegations about a country’s government

text: Categories Primary Secondary

text: Medias and audio Sector Citizens visual

text: Victim Public Government/Country

text: Impact Political Social

text: Concerning the sectors, the framework uses the sectors of Open Cyber Threat Intelligence (Open CTI) , since they encompass a wider and hierarchical range of actors – from economic sectors to political parties and citizens – and can more accurately reflect the wide FIMI/disinformation landscape. In addition, it uses the list of essential sectors included in the EU Directive 2016/1148 concerning measures for a high common level of security of network and information systems across the Union 15 16 (NIS Directive) , as well as the recently adopted revised NIS2 Directive .

text: The breakdown of sectors is available on GitHub .

text: The category of “Impact” is broken down as follows:

text: • Impact • Financial • Availability • Reputation • Social • Political

text: The break-down for the victims is outlined below.

text: Table 3: Victims - sub-categories and definitions

text: Victims Definition

text: Private sector Private entities, e.g. companies, industries, etc.

text: Government / Country Entities with representative power e.g. ministries or governmental officials

text: Public Public entities without representative power e.g. hospitals, administrations and citizens

text: Individual Single persons

text: 2.3 SEVERITY AND DURATION

text: At the design stage of the proposed approach, attempts were made to calculate the seriousness of an event based on its duration and its effects on the real world. However, it was noticed that:

text: • It was difficult to gauge with precision the duration of a FIMI/disinformation event – especially in light of the fact that some events refer to incidents (one-off, unique activities) and others to operations. • The impact of FIMI/disinformation events would depend in particular on their outreach beyond the initial “information bubble.”

text: As a consequence, it was decided to analyse duration independently and to distinguish the effects of a FIMI/disinformation event into severity (that is, the reach of a FIMI/disinformation event) and impact (that is, the domain affected). The tables below describe the categories of duration and severity, whereas the impact is described in the previous section.

text: Table 4: Duration – subcategories and definitions

text: Duration Definition

text: Short The event lasts less than a week

text: Medium The event lasts more than a week and less than a month

text: Long The event lasts more than a month

text: Table 5: Severity - sub-categories and definitions

text: Severity Definition

text: The incident was shared and/or noticed only within and

text: 1 -Very Low

text: by the network that launched the incident

text: 2 - Communication The incident was shared and/or noticed beyond the Breakout (Low) network that launched the incident

text: The incident left the scope of communication

text: 3 - Real World Breakout

text: environments and led to non-harmful actions in the real

text: (Medium)

text: world (like peaceful demonstrations)

text: The incident left the scope of communication 4 - Real World Harm environments and led to harmful actions in the real world (High) (i.e. attacks on people, destruction of property, harmful self-medication etc.)

text: FOREIGN INFORMATION MANIPULATION AND INTERFERENCE (FIMI) AND CYBERSECURITY – THREAT LANDSCAPE 2.4 THREAT ACTORS AND MOTIVATION

text: The classification of threat actors is based on the attribution – technical (TA) or political (PA) – and on whether the entity identified as responsible for the event was a state actor, a non-state actor or a proxy.

text: Table 6: Threat actor

text: Threat Actor Definition

text: State actor PA State actor identified with political attribution i.e. through official statements or reports

text: Non-State actor PA Non- State actor identified with political attribution i.e. through official statements or reports

text: Proxy PA Proxy actor identified with political attribution i.e. through official statements or reports

text: State actor TA State actor identified with technical attribution i.a. through statements by victims e.g. platforms, or independent research by civil society

text: Non-State actor TA Non- State actor identified with technical attribution, i.a. through statements by victims, e.g. platforms, or independent research by civil society

text: Proxy TA Proxy actor identified with technical attribution, i.a. through statements by victims, e.g. platforms, or independent research by civil society

text: Not officially attributed No information about attribution

text: Other Category not reflected above [free text]

text: The motivation has been categorised as in:

text: • Geopolitical • Disruption • Manipulation of information • Ideological • Monetisation • Other

text: 2.5 DISARM FRAMEWORK AND MITRE ATT&CK

text: The DISARM (DISinformation Analysis & Risk Management) framework is designed for describing and understanding the behavioural parts of FIMI/disinformation. The report uses the DISARM Red 21 22 framework , which focuses on FIMI/disinformation creation and dissemination behaviours . The framework is inspired by the structure of the MITRE’s ATT&CK ® framework, which is a knowledge-

text: base of cyber adversary behaviour and taxonomy for adversarial actions across their lifecycle. The DISARM Red Framework is a useful tool to describe FIMI TTPs. DISARM is born out of the collaborative effort of individuals from the FIMI defender community, which introduced the concepts of kill chain, tactics, techniques and procedures (TTPs) and behavioural fingerprints to the FIMI field. Due to its threat-informed, open-source and community-driven nature, the DISARM framework allows to consolidate all known FIMI TTPs. It also introduces a taxonomy for defenders to speak a common language when describing their findings.

text: In the present report the DISARM framework is used jointly with MITRE ATTA&CK. MITRE ATT&CK has two parts: ATT&CK for Enterprise, which covers behaviour against enterprise IT networks and cloud, and ATT&CK for Mobile, which focuses on behaviour against mobile devices. The report uses MITRE ATT&CK for Enterprise .

text: Both the DISARM and MITRE frameworks are structured across Tactics, Techniques and Procedures (TTPs). During the initial phase of work on the report it was noticed that mapping events against tactics and techniques using only one of the frameworks was not sufficient to understand both cyber and FIMI dimensions. Hence the report suggests to use uses both frameworks to capture the entire complexity of the events. This is a finding in itself, necessitating better and more in-depth incident reporting both in the cyber and FIMI/disinformation domains and ensuring that the two communities exchange information.

text: The joint use of the DISARM and MITRE frameworks helps identifying cybersecurity patterns used in support of FIMI/disinformation behaviours and, at the same time, the mapping of FIMI/disinformation patterns against cybersecurity TTPs. By analysing TTPs using only one of the two frameworks, one might overlook TTPs from the other dimension, which could be important insights about the event as well. FIMI/disinformation events often also incorporate a cyber element, whose analysis can assist for the event’s attribution, as well as for the identification of indicators of compromise that enable rapid mapping. Conversely, by analysis only cyber TTPs, important elements such as severity and impact cannot be conceptualised and the coordinated nature of such complex events might be missed. The complementarity of the analyses resulting from the combination of these two frameworks brings to more comprehensive threat intelligence. This is especially important in light of hybrid campaigns and the EU’s ambition to tackle such threats holistically. Facilitating the joint use of frameworks established for specific domains can significantly boost comprehensive situational awareness and early warning. Sharing insights in an interoperable way between the FIMI/disinformation and cybersecurity domains can lead to quicker and more effective responses, mitigating the severity of harmful activities.

text: 3. TESTING THE FRAMEWORK: ANALYSIS AND TRENDS

text: This section presents a proof of concept for the joint use of cybersecurity and FIMI/disinformation cases through the analysis of a set of indicative cases. The section showcases the feasibility and potential of the proposed approach, identifies trends and patterns and yields novel insight on the complementary of the FIMI/disinformation and cybersecurity domains, by identifying correlations among them.

text: IMPORTANT: As reported above, relevant statistics and findings are presented; however, it

text: needs to be highlighted that the findings are dependent on the limited set of specific incidents analysed and that this report is designed to give a first indication as food-for-thought. Future,

text: much richer datasets and further research will bring better insight.

text: 3.1 DATA COLLECTION AND CLEANING

text: The events analysed in this report are based on OSINT (Open Source Intelligence) collected by ENISA for situational awareness purposes and are all publicly disclosed. The scope of the collection is global and multi-sectorial. However, events with a direct impact in the EU area are given a priority.

text: Specifically, the proposed approach is tested against 33 events that have been collected by ENISA in the period from January 2020 until mid-June 2022 and that at a first triage state where identified as motivated by the manipulation of information . It is to be noted that singling out this motivation might not be straightforward. For example: how should a phishing mail with false information luring the receiver to click on a link be considered? In the context of the report, phishing would be analysed only if it contributes to manipulating the information environment, for instance by supporting the compromise of accounts that would facilitate the legitimisation and spread of disinformation.

text: Another important consideration is that it has not been possible to identify upfront which of the events fell into the definition of FIMI, which outlines many specific features. This is normal since, as reminded throughout the report, the proposed approach is meant to be used by the counter FIMI/disinformation and the cybersecurity communities to improve the description of events, amplify joint situational awareness and, as a result, it is expected to help identifying those that call for EU action with particular attention to FIMI. After the analysis has been carried out it has been noted how not all the events analysed could be considered FIMI, although all of them have been considered as motivated by the manipulation of information (see above). For simplicity, the report refers to the analysed events as FIMI/disinformation events.

text: Finally, one issue that emerged during the analysis is that some events referred to information/cyber incidents that are part of the same information operation and others referred to information operations composed by different information/cyber incidents. In addition, some information/cyber incidents seem to be correlated, raising the question of how they should be counted. For simplicity and being aware of the limitations, the report labels as “events” both information/cyber incidents and information operations and does not group coordinated events into a single one.

text: FOREIGN INFORMATION MANIPULATION AND INTERFERENCE (FIMI) AND CYBERSECURITY – THREAT LANDSCAPE 3.2 APPLICATION OF THE PROPOSED APPROACH – DATA ANALISYS 3.2.1 Sectors, victims and impact

text: As stated in section 2.2, events have primary and secondary sectors, victims and impacts. The graphs below show this duality.

text: Concerning the sectors, it has been analysed that more than half of the events (18) had a direct impact on actors who are related to different aspects of a State (namely: government and administrations, political parties; defence and legislative branch). In most of cases, citizens have not been impacted directly, but rather as a consequence. They represent the secondary target in more than half (19) of the events. The relevance of the media and audio-visual sector is especially noteworthy. Cybersecurity analysis has a strong focus on critical sectors (e.g. energy or transport), whose disruption, by definition, is particularly serious and addressed by specific legislation (e.g. NIS Directive). Clearly, in the context of FIMI/disinformation, the sector of media and audio-visual is also to be considered as critical.

text: Figure 1: Primary and secondary sectors

text: The observations above mirror the ones on the victims, with governments being the primary victims in 17 events and the public and individuals being secondary victims (in 22 cases).

text: Figure 2: Primary and secondary victims

text: When the impact is analysed, the results do not differ to a great extent from primary to secondary. In both cases there is a strong focus on social and political impacts (the former more pronounced in the category of secondary impacts). Figure 3: Primary and secondary impact

text: 3.2.2 Severity and duration

text: The severity of the great majority of the events analysed is either low or medium, meaning that they were systematically shared/noticed beyond the network that launched the incident (low severity) and left the scope of the communication environment (medium severity), although without leading to prominent actions in the real world.

text: Figure 4: Severity

text: Concerning the duration, it is considered based on the reported event (that is, not distinguishing among incidents and operations). Therefore, observations related to duration are made with a low degree of confidence. In particular, while the 10 events featuring a long duration (that is, they lasted more than one month) correspond to operations featuring multiple incidents, it is unclear whether events with a shorter duration are in fact incidents part of an operation extending over a longer period of time.

text: Figure 5: Duration

text: 3.2.3 Threat actors and motivation

text: The analysis of the threat actors focused on attribution. Not surprisingly, for the great majority of the events (about 2/3), an attribution could not be found and for the remaining events technical attribution seems to be more frequent.

text: Figure 6: Attribution (number of events)

text: The analysis showed multiple motivations underlying single events. For example, multiple social media accounts run from a single location and perpetuating a critical narrative with respect to a government might be motivated by ideology, but also by the willingness to disrupt. For this reason, multiple motivations have been associated to single events.

text: About two-thirds of the motivations identified referred to geopolitics or disruption. The line between disruption, ideology and geopolitics can be blurred at times since disruption can be carried out for ideological and/or geopolitical motives. Therefore, the allocation of an event to a category could be facilitated by a more elaborated definition of motivations. Monetisation has been identified as motivation only in rare cases.

text: Figure 7: Motivations associated to events

text: 3.2.4 DISARM framework and MITRE ATT&CK

text: In this section the events have been mapped against both the DISARM and the MITRE ATT&CK tactics with the ultimate goal to identify the FIMI/disinformation tactics (as defined in the DISARM framework) that are impacted the most by cybersecurity tactics (as defined in MITRE ATT&CK). The idea is that, on the ground, the detection of specific MITRE ATT&CK TTP(s) could act as an indicator of a FIMI/disinformation event.

text: Accordingly, the analysis contained in this section starts with the identification of the most recurrent tactics firstly as per the DISARM framework (sub-section 3.2.4.1) and, secondly, as per the MITRE ATT&CK framework (sub-section 0). Lastly, the analysis unfolds with the joint use of the frameworks, by showing the MITRE ATT&CK tactics and techniques associated to the most recurrent DISARM tactics (sub-section 0). Considerations on the affected assets are also included.

text: 3.2.4.1 DISARM Framework perspective

text: The table below shows the distribution of the most recurrent tactics according to the DISARM framework. The analysis has been carried out by associating to each FIMI/disinformation event several tactics. Figure 8: Distribution of FIMI/disinformation tactics according to the DISARM framework

text: Based on the above, the most recurrent DISARM tactics are displayed in the table below. The most recurrent tactics are those that have been identified at least 10 times .

text: Table 7: Definitions of the most recurrent DISARM tactics

text: DISARM Tactic Definition

text: TA06 - Develop Content Create or acquire text, images, and other content

text: TA16 - Establish

text: Establish assets that create trust

text: Legitimacy

text: Selecting platforms and affordances assesses which online or offline platforms and their associated affordances maximize an influence operation’s ability to reach its target audience. To select the most appropriate platform(s), an operation may assess the technological affordances including platform algorithms, terms of service, permitted

text: TA 07- Select Channels

text: content types, or other attributes that determine platform usability and accessibility.

text: and Affordances

text: Selecting platforms includes both choosing platforms on which the operation will publish its own content and platforms on which the operation will attempt to restrict adversarial content.

text: Establishing information assets generates messaging tools, including social media accounts, operation personnel, and organizations, including directly and indirectly managed assets. For assets under their direct control, the operation can add, change, TA15 - Establish Social or remove these assets at will. Assets Establishing information assets allows an influence operation to promote messaging directly to the target audience without navigating through external entities. Many online influence operations create or compromise social media accounts as a primary vector of information dissemination. The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a ""whole of society"" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perspective TA14 - Develop the tactics around master narratives center more precisely on the day-to-day Narratives promotion and reinforcement of this messaging. In other words, beneficial, highcoverage master narratives are a central strategic goal and their promotion constitutes an ongoing tactical struggle carried out at a whole-of-society level. Tactically, their promotion covers a broad spectrum of activities both on- and offline.

text: Set clearly defined, measurable, and achievable objectives. Achieving objectives ties execution of tactical tasks to reaching the desired end state. There are four primary considerations: - Each desired effect should link directly to one or more objectives

text: TA02 - Plan Objectives

text: - The effect should be measurable - The objective statement should not specify the way and means of accomplishment - The effect should be distinguishable from the objective it supports as a condition for success, not as another objective or task. Maximize exposure of the target audience to incident/campaign content via flooding,

text: TA17- Maximize

text: amplifying, and cross-posting.

text: Exposure

text: 3.2.4.2 MITRE ATT&CK Framework perspective

text: The table below shows the distribution of the most recurrent tactics according to the MITRE ATT&CK framework. The analysis has been carried out by associating to each FIMI/disinformation event several tactics.

text: Figure 9: Distribution of FIMI/disinformation tactics according to the MITRE ATT&CK framework

text: Based on the above, the most recurrent MITRE ATT&CK tactics are displayed in the table below. The most recurrent tactics are those that have been identified at least 10 times are: Resource development, Initial access, and Impact.

text: Table 8: Definitions of the most recurrent MITRE ATT&CK tactics

text: MITRE ATT&CK Definition Tactic

text: Resource Development consists of techniques that involve adversaries creating, purchasing, or compromising/stealing resources that can be used to support targeting. Such resources include infrastructure, accounts, or capabilities. These resources can Resource Development be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using purchased domains to support Command and Control, email accounts for phishing as a part of Initial Access, or stealing code signing certificates to help with Defense Evasion. Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted Initial Access spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords. The adversary is trying to manipulate, interrupt, or destroy your systems and data. Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques Impact used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.

text: 3.2.4.3 DISARM and MITRE ATT&CK: Joint perspective and the role of cybersecurity

text: Unsurprisingly, when the DISARM and MITRE ATT&CK frameworks are applied jointly, it is noted that the three most recurrent MITRE ATT&CK tactics mentioned above (that is: Resource development, Initial access and Impact) are also the most used within each DISARM tactic, as shown in the Annex.

text: The graphic below shows the definition of the three most recurrent MITRE ATT&CK tactics and of the techniques the framework associates to them.

text: Figure 10: Definition of the three most recurrent MITRE ATT&CK tactics and techniques

text: It is important to note that these techniques are those associated to the identified tactics by the MITRE ATT&ACK framework i.e. not all of them correspond to the analysed events. Future and more in-depth applications of the approach proposed in this report might carry out a more detailed analysis and dig also into the techniques. This is also due to the quality of the data, often not sufficiently precise to determine the specific technique.

text: An analysis of the assets impacted has been carried out, although it also suffers from the lack of information as, in most of the cases (13 events out of 33), it has not been possible to understand which asset had been affected by an event.

text: Table 9: Assets affected by FIMI/disinformation events

text: 3.2.4.4 The role of cybersecurity

text: Cybersecurity attacks play an important role in the manipulation of the information environment and, in particular, they provide some of the tools that enable information incidents and operations, especially in terms of content and infrastructure at the initial stages of a FIMI/disinformation event. They also play a role in dissemination, although to a lesser extent.

text: The graph below conveys a qualitative analysis of the cyber-security activities that have been associated to the most recurring DISARM tactics.

text: Figure 11: Role of cybersecurity (in orange boxes) across the most recurring DISARM tactics (in blue boxes)

text: 4. RECOMMENDATIONS

text: 4.1 TECHNICAL 4.1.1 On the analytical framework

text: As described in section 2, this report showcases how the interaction between frameworks developed for different domains can lead to enhanced situational awareness. Through the application of both frameworks to specific events, it is possible to:

text: • Describe FIMI/disinformation creation and dissemination behaviours • Show the role of cybersecurity (or lack of thereof) in facilitating FIMI/disinformation by identifying the underlying cybersecurity elements • Expose the manipulative and harmful behaviours the EU wants to prevent, deter and respond to by helping singling out incidents that can be considered as FIMI

text: Enhance the collective understanding of the kill-chain across the FIMI/disinformation and cybersecurity domains, opening up to new and potential earlier response options While the combination of practices from different domains can be considered overall effective, the implementation of the proposed approach implementation reveals some peculiarities that merit attention and potentially further refinement.

text: • Distinction between information/cyber incidents and operations. Somewhat differently from the “purely” cybersecurity domain, open-source data about FIMI/disinformation events often cover entire operations encompassing several incidents. Albeit to a lesser extent, some reports refer to coordinated incidents distinctively. This is normal as FIMI/disinformation events often appear as such only after “connecting the dots” of single incidents. However, it would be important to find a common way to report on FIMI/disinformation events that manages to consider both operations and incidents in a consistent way. The difficulty is to reconcile two seemingly different angles. From the cybersecurity perspective, the focus on incidents is especially important as the cybersecurity tactics are likely to change from incident to incident within the same operation. However, from the FIMI/disinformation perspective, elements such as motivation and impact might become evident only by considering operations in their entirety. There is thus a growing need to consider incident reporting initiatives that are prominent in cybersecurity, also in the field of FIMI and foster relevant information sharing mechanisms either voluntarily (for example building on existing or new ISACs) or mandatory (by means of legal instruments, such as NIS2 in the case of cybersecurity). • Difficulties in establishing the duration of events. This aspect partly derives from the previous one. A cybersecurity incident spanning over a few days might have an impact on the information environment that goes way beyond that timeframe. In addition, it might not be always clear what constitutes the “end” of an operation, as opposed to the “temporary pause of an operation”. As explained, the proposed approach has been applied in such a way that duration is considered based on the reported event (that is, not distinguishing among incidents and operations), which is sub-optimal. This aspect would probably not be as problematic once a distinction between incidents and operations is made. • DISARM vs MITRE: the importance of focusing on DISARM tactics to analyse the cybersecurity component of information events. The DISARM framework is very good at describing sets of (FIMI/disinformation) incidents that have a common (FIMI/disinformation) goal and are part of the same operation, whereas MITRE is very good at describing single (cybersecurity) incidents, regardless of whether they have the same goal or are part of the same operation. Therefore, it has been found that the most effective way to jointly use of the two frameworks is to analyse the MITRE tactics and techniques at the level of specific DISARM tactics.

text: • The primary target (in terms of victims, sectors and impact) is often not the real/main one. The ENISA Threat Landscape identifies the sectors affected by a cyber-incident, without the need to specify whether the sectors identified are primary or secondary targets. In the case of FIMI/disinformation events, however, it is important to assess whether the directly affected victim/sector/domain (primary) is the actual one or is used only as a means to reach a different target (secondary). • FIMI/disinformation events do not necessarily target critical sectors. The analysis of cybersecurity incidents often focuses on critical sectors as per applicable EU legislation, namely the NIS2 Directive. However, FIMI/disinformation events often target sectors that are not necessarily considered critical (e.g. media) and can have disastrous consequences regardless of the criticality of the sector impacted. The current framework includes both the categories identified by the Open Cyber Threat Intelligence Platform and the NIS Directive. The Open CTI Platform is deemed more appropriate for disinformation events.

text: 4.1.2 On the role of cybersecurity

text: Based on the above, four areas emerge as important to tackle the manipulation of the information environment from a cybersecurity perspective:

text: • The role of cybersecurity seems to be particularly important in establishing attribution. While most of the events analysed were not attributed (see section 3.2.3), those that had been attributed relied on a cybersecurity analysis. It would be beneficial to create a structured link between technical attribution and FIMI/disinformation. • The role of cyber-attacks at the initial stages of some FIMI/disinformation events,

text: strengthens the idea that, on the ground, the detection of specific MITRE ATT&CK

text: TTP(s) could act as an indicator of a FIMI/disinformation event. Seam-less cooperation procedure between the cybersecurity and counter FIMI/disinformation communities could yield significant benefits. • One of the most relevant limitation in the analysis of the considered

text: FIMI/disinformation events has been the quality of the data. Open-source data about FIMI/disinformation events might not contain sufficient information about its cybersecurity aspects., FIMI/Disinformation reporting should consider this aspect

text: more systematically. For example, in many cases the description of the cyber-component was not sufficiently detailed to identify the cybersecurity techniques utilised. As outlined in the ENISA Threat Landscape 2021, more work is needed to better classify cyber incidents related to disinformation and misinformation. On the one hand, a lot of them are classified in other categories given that they are commonly used in complex, hybrid attacks. On the other hand, data concerning FIMI/disinformation does not necessarily dig into cybersecurity aspects. This shows that more cooperation between the cyber and the counter-FIMI community is needed to bring these insights together in a more structured and systematic manner . • Another limitation has been the comparability of different events, hence reporting needs to be made as coherent as possible. Incident reporting and information exchange are fundamental components of the lifecycle of response to both cybersecurity and FIMI/disinformation incidents. It would be important to assess how to best integrate cybersecurity and FIMI/disinformation aspects in reporting and information exchange. The use of DISARM in combination with MITRE ATTA&CK could constitute a starting point. Both frameworks take into account the specificities of the respective domains to be able to analyse and describe effectively any activity in either the cyber or FIMI domain. However, it has

text: become clear that these frameworks should also consider activities that bridge both domains and should be made as interoperable as possible. • The role of cyber-attacks at initial stages leads also to another recommendation:

text: awareness raising is important to limit the development or acquisition of content and

text: the compromise of infrastructure that facilitate dissemination. Awareness raising trainings on cybersecurity are becoming more and more common among organisations e.g. on average, 61% of enterprises provide them (EU average) . Attacks on the governmental/public and media/audio-visual sectors (see section 3.2.1) have been identified as instrumental in obtaining data for the development of content and dissemination and in establishing legitimacy for the dissemination phase. Hence, it is key that awareness raising campaigns are held for these sectors, also flagging the importance of cybersecurity as a means to prevent, deter and respond to FIMI. Awareness raising should also include guidance as to how identify first signals (precursors for a campaign, indicators of a campaign) and then to inform other stakeholders. Moreover, since the more high-level the account compromised is, the more legitimacy it has, it is important that high-profile members of governmental/public and media/audio-visual sectors are aware of this. This aspect might be especially relevant in the context of elections and should therefore be considered to help boost the EU’s resilience in view of the 2024 European Parliament election.

text: 4.2 STRATEGIC

text: FIMI, just like cybersecurity, is a complex, global and ever evolving threat. The vast amount of information attacks prevents any individual defender alone to have a comprehensive and timely overview of the threat landscape. The defender community likewise is highly complex – from governments and international organisations to private industry and civil society as well as academia and journalists, many different stakeholders are involved in tackling FIMI and provide essential contributions to the overall work. Collaboration among defenders is therefore essential. Acknowledging the parallels in the nature of the threat both communities face, we can apply concepts from the cybersecurity community to advance our understanding of FIMI. This includes common definitions, taxonomies and standards such as a data sharing standard, a focus on TTPs, a common methodology and information exchange. Specifically, it is recommended to:

text: • Foster mutual exchanges between the cybersecurity and FIMI/disinformation community. As this report outlines, concepts of cybersecurity can be applied to the detection and analysis of FIMI/disinformation incidents and operations. Existing frameworks, taxonomies, tools, structures and interoperable standards from cybersecurity can be adapted and adopted by the counter FIMI/disinformation community to speed up analytical maturity and interoperability within and beyond the field. Indeed, incident handling and response has been at the core of the cybersecurity community for many years, meaning that procedures and reporting are codified . The behaviour-focussed work on counter-FIMI/Disinformation, instead, is relatively more recent, considering that for many years, the main focus has been laying on “disinformation” and there with the content, not the manipulative tactics. Interoperable, reliable and consistent analytical output by the FIMI/disinformation community can, in return, inform cybersecurity practitioners on new and emerging motivations, targets and threat vectors. Such exchanges can also help disrupt activities that span both domains at an earlier stage. • Improve the availability and quality of FIMI/disinformation incident information. Aggregable and representative information on FIMI/disinformation incidents is so far mostly unavailable. While individual data and research exist and stakeholders do share highly relevant insights, the sector is still underdeveloped compared to the diversity, specialisation and quantity of information shared in the cybersecurity sector. FIMI defenders should consider building on the behaviour (TTP) focus for FIMI detection and analysis. Organisations maintaining FIMI SOCs can drive the development or adoption of commonly shared

text: frameworks and standards inter alia in voluntary vehicles like Information Sharing and Analysis Centers (ISACs) for FIMI. • Adopt and adapt standard information formats for sharing FIMI/disinformation intelligence. The more structured information about incidents available, the higher each investigator’s effectiveness. Building again on good case practices from cybersecurity, the FIMI community can adopt and adapt standard information formats, such as STIX , the Standard Threat Information Expression language, to move beyond information sharing by written reports. DISARM TTPs are already available as attack patterns in STIX format; other STIX objects help to easily and comprehensively communicate important information of who did what to whom, when, how and why. Existing STIX objects like threat actors, intrusion sets, observables, vulnerabilities, identities etc. can already be used to communicate the majority of relevant FIMI information. With standardised threat exchange formats automation can be brought into the fight against FIMI and a shared threat intelligence knowledge base could be established. With processes and approaches developed in cybersecurity, the gap between well-resourced attackers and a decentralised but collaborative defender community could be narrowed. By ridging cybersecurity with FIMI analyses, as defenders we have one additional tool of threat intelligence at our disposal to better protect against relevant threats.

text: 4.3 POLICY

text: Recent EU policy initiatives, such as the Cyber Resilience Act (CRA) , the Digital Operational 35 36 Resilience Act for the financial sector (DORA) , Digital Services Act (DSA) , Digital Markets Act 37 38 (DMA) , Artificial Intelligence Act (AI) , etc. rank cybersecurity high on the agenda across other dimensions compared to strictly defined sectors. Likewise, the Code of Practice on Disinformation 39 40 (CoP) , European Democracy Action Plan (EDAP) , the DSA and the Strategic Compass for Security 41 42 and Defence as well as the European Media Freedom Act (EMFA) highlight the fundamental threat that FIMI poses. FIMI, as outlined in this report, does not necessarily target ‘critical sectors’, but corrodes the very basis of our democracy and security, by targeting i.a. society at large. Cybersecurity, FIMI and hybrid threats permeate all aspects of our daily lives and thus future policy initiatives should consider these aspects in relevant impact assessment. This leads to the following recommendations:

text: • The EU Institutions have expert teams dealing with FIMI and cybersecurity respectively, both from a policy and an operational perspective. Facilitation of cooperation between those

text: groups should be a priority, especially in crises and surrounding important events such

text: as the upcoming 2024 European Elections. • These expert teams jointly should build capacity and capability of Member States and

text: international partners, not only to raise awareness of the importance to bridge the silos,

text: but also to support them to increase their own capabilities. Based on the proposed common definition for FIMI and the existing scope of the cybersecurity community, trainings on applying to analytical frameworks in an interoperable way, building respective processes etc. should be supported. Politically, the EU has committed in the Strategic Compass to build a FIMI Data Space, to enhance the EU’s posture vis-à-vis FIMI threat actors. This could, based on previous points, be in the shape of an Information Sharing and Analysis Center (ISAC). Exploratory work on this has already started in 2021 in the EEAS, in close exchanges with relevant stakeholders from governments, civil society and private industry. Such a FIMI ISAC should be set up in a timely manner and should be discussed with stakeholders from the

text: cybersecurity community, to ensure the FIMI ISAC is interoperable with existing structures in the cybersecurity domain.

text: ANNEX

text: The table below shows, for each of the most relevant DISARM tactics, the top-3 MITRE techniques.

text: DISARM Tactic Top 3 MITRE tactics

text: Resource Development 52 TA06 - Develop Content Impact 25 Initial Access 14 Resource Development 43 TA16 - Establish Legitimacy Initial Access 21 Impact 17 Resource Development 33

text: TA 07- Select Channels and

text: Initial Access 13

text: Affordances

text: Impact 9 Resource Development 28 TA15 - Establish Social Assets Impact 15 Reconnaissance 6 Resource Development 26 TA02 - Plan Objectives Impact 8 Initial Access 7 Resource Development 15 TA14 - Develop Narratives Initial Access 8 Impact 7 Resource Development 16 TA17- Maximize Exposure Impact 8 Initial Access 5

text: -N -EN -329 -22 -08 TP

text: ABOUT ENISA

text: ISBN 978-92-9204-606-4 DOI: 10.2824/7501


text: Reference to the report page:

identifier: Foresight 2030 Threats

title: Foresight 2030 Threats

text: FORESIGHT 2030 THREATS EXECUTIVE DIRECTOR FOREWORD

text: The cybersecurity threat landscape is a complex ecosystem of threats, threats actors and attack techniques that are also subject to the influence of world events such as pandemics and geopolitics. The best knowledge, and tools we have at hand today to reduce the impact of cyber threats might not fit tomorrow’s threat landscape.

text: Can we foresee the full extent of the potential use or abuse of our current technological developments?

text: Even if we still cannot predict the future, we have the duty to anticipate emerging trends and patterns.

text: In 2021, ENISA developed a cybersecurity foresight methodological framework grounded in foresight research and future studies. The framework was first used in 2022 to devise future scenarios and identify threats and challenges likely to emerge by 2030. This methodology was produced in cooperation with the wider cybersecurity community.

text: This booklet summarises upcoming challenges and provides for an assessment of the risks. We are now ready to design the cyber secure future ahead of us.

text: Juhan Lepassaar

text: Executive Director

text: SUPPLY CHAIN COMPROMISE OF SOFTWARE

text: DEPENDENCIES

text: WHAT IF… State-sponsored actors insert a backdoor in a well-known and popular open-source library on online code repository. They use this to infiltrate information from most major European corporations and

text: use the information to blackmail leaders, espionage, or otherwise initiate disruptions across the EU.

text: More integrated components and services from third party suppliers and partners could lead to novel and unforeseen vulnerabilities with compromises on the supplier and customer side.

text: POTENTIAL THREAT ACTORS

text: State-sponsored groups, criminal organisations

text: POTENTIAL METHODS

text: Sabotage, theft, network reconnaissance, malicious code, abuse of information leakage

text: POTENTIAL IMPACTS

text: Disruption, malfunction, data loss, data leakage

text: FORESIGHT 2030 THREATS ADVANCED DISINFORMATION CAMPAIGNS

text: WHAT IF… A state-sponsored actor may impersonate a political rival by using deepfakes and spoofing the candidate’s digital identity, significantly

text: impacting election results.

text: Deepfake attacks can manipulate communities for (geo) political reasons and for monetary gain.

text: POTENTIAL THREAT ACTORS

text: State-sponsored groups, criminal organisations, hackitvists

text: POTENTIAL METHODS

text: Fraud, unauthorised access, session hijacking, identity theft, abuse of personal data

text: POTENTIAL IMPACTS

text: Distrust, disinformation, financial damage, foreign information manipulation and interference (FIMI)

text: RISE OF DIGITAL SURVEILLANCE AUTHORITARIANISM /

text: LOSS OF PRIVACY

text: WHAT IF… An authoritarian regime uses their power to retrieve databases of information about individuals who have visited their country, from both public and private entities. They track all those who participated in anti-government protests, put them on a watch list,

text: and subsequently are able to manipulate those individuals’ access to national services like voting, visits to their healthcare providers, or access to other online services.

text: Facial recognition, digital surveillance on internet platforms or digital identities data stores may become a target for criminal groups.

text: POTENTIAL THREAT ACTORS

text: POTENTIAL METHODS

text: Man in the middle, malicious software, use of rogue certificates, abuse of personal data

text: POTENTIAL IMPACTS

text: Privacy breaches, human rights abuses

text: FORESIGHT 2030 THREATS HUMAN ERROR AND EXPLOITED LEGACY SYSTEMS WITHIN CYBER-

text: PHYSICAL ECOSYSTEMS

text: WHAT IF… Manuals for all legacy OT equipment are available online and studied primarily by state-sponsored groups. Once a vulnerability is found, they target user devices or other IoT products used at the plant.

text: Cyber criminals begin a new form of ransomware in which they bring ?

text: down important infrastructure and demand payment, given that the operator likely lacks the resources to solve the issue themselves.

text: The fast adoption of IoT, the need to retrofit legacy systems and the ongoing skill shortage could lead to a lack of knowledge, training and understanding of the cyberphysical ecosystem, which can lead to security issues.

text: POTENTIAL THREAT ACTORS

text: State-sponsored groups, cyber criminals, hacktivists

text: POTENTIAL METHODS

text: Tampering, failure of communication links, denial of service, malicious activity, manipulation of information, targeted attacks, brute force, unauthorised physical access

text: POTENTIAL IMPACTS

text: Malfunction, failures and outages, physical damage 5

text: TARGETED ATTACKS (E.G. RANSOMWARE) ENHANCED BY SMART

text: DEVICE DATA

text: WHAT IF… Cybercriminals may use the increased amount of available data from smart devices and analyse it with AI to create behavioral models of

text: their victims for spear phishing campaigns or stalking.

text: Through data obtained from internet-connected smart devices, attackers can access information for tailored and more sophisticated attacks.

text: POTENTIAL THREAT ACTORS

text: Cybercrime actors, hackers-for-hire

text: POTENTIAL METHODS

text: Denial of service, interception of information, social engineering, unauthorised activities, data breach

text: POTENTIAL IMPACTS

text: Financial damage, privacy breaches

text: FORESIGHT 2030 THREATS LACK OF ANALYSIS AND CONTROL OF SPACE- BASED INFRASTRUCTURE

text: AND OBJECTS

text: WHAT IF… State-sponsored attackers access space infrastructure, build up their capabilities and knowledge of the technology, and secure their presence to execute attacks. Their aim may be to create infrastructure

text: malfunctions as a statecraft tool to sabotage other governments or commercial space operations and systems during geopolitical conflicts.

text: Due to the intersections between private and public infrastructure in space, the security of these new infrastructures and technologies need to be investigated as a lack of understanding, analysis and control of space-based infrastructure can make it vulnerable to attacks and outages.

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, cybercrime actors, hackers-for-hire

text: POTENTIAL METHODS

text: Unauthorised use of IPR protected resources, targeted attacks, fraud, sabotage, information leakage, session hijacking, malicious software

text: POTENTIAL IMPACTS

text: Damage, outages, malfunctions

text: RISE OF ADVANCED HYBRID THREATS

text: WHAT IF… Hackers are hired by a corporation to investigate the new technology being developed by a competitor. In their quest, they are able to retrieve metadata, view code, and set up a machine learning algorithm that continuously collects changes to the code and then continuously

text: accesses user account to prevent monitoring systems from recognising ?

text: that the attacker is in the network. In parallel they obfuscate the activity by spreading fake news about insider trading and industrial espionage from a third competitor by dropping fake evidence of physical intrusion.

text: Physical or offline attacks are evolving and becoming often combined with cyberattacks due to the increase of smart devices, cloud usage, online identities and social platforms.

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, hackers-for-hire, cyber criminals

text: POTENTIAL METHODS

text: Unauthorised access, social engineering, abuse of personal data, remote command execution, malicious activity

text: POTENTIAL IMPACTS

text: Privacy breaches, outages, failures/malfunctions

text: FORESIGHT 2030 THREATS SKILL SHORTAGES

text: WHAT IF… The skill shortage leads to an increase of online job advertisements that tell attackers the technologies that each organisation is using and the approximate number of empty positions. A state-sponsored

text: actor may use this to their advantage as a part of a larger campaign to tamper with critical infrastructure in another country.

text: Lack of capacities and competencies could see cybercriminal groups target organisations with the largest skills gap and the least maturity.

text: POTENTIAL THREAT ACTORS

text: Cybercrime actors, hackers-for-hire, state-sponsored actors

text: POTENTIAL METHODS

text: Spear phishing attacks, social engineering

text: POTENTIAL IMPACTS

text: Financial damage, outages

text: CROSS-BORDER ICT SERVICE PROVIDERS AS A SINGLE POINT OF FAILURE

text: WHAT IF… A state-sponsored actor aims to temporarily cripple a region during an active conflict by installing malware that disrupts all critical functions of the ICT

text: provider. Without operational cities, roadways, and communication channels, ?

text: the region is essentially crippled without the ability for civilians to go about their daily lives and the responsible parties limited in their ability to maintain defense monitoring systems and to collaborate to develop response options and methods for bringing the necessary systems back online.

text: ICT sector connecting critical services such as transport, electric grids and industry that provide services across borders are likely be to targeted by techniques such as backdoors, physical manipulation, and denials of service and weaponised during a future potential conflict.

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, hackers-for-hire

text: POTENTIAL METHODS

text: Fraud, theft, corruption, terrorist attack, network traffic manipulation, manipulation of hardware or software, abuse of authorisations

text: POTENTIAL IMPACTS

text: Outages, damage/loss, unavailable critical infrastructure

text: FORESIGHT 2030 THREATS ARTIFICIAL INTELLIGENCE ABUSE

text: WHAT IF… A state-sponsored actor wants to sow discord in a population before an election and manipulates the learning data of a law enforcement algorithm to target specific populations, causing widespread protests and violence. They are also able to deduct information about the political opponents themselves by using an AI analysis of the individuals’

text: whereabouts, health history, and voting history – the correlation of such personal data will likely only be feasible with the use of AI tools.

text: Manipulation of AI algorithms and training data can be used to enhance nefarious activities such as the creation of disinformation and fake content, bias exploitation, collecting biometrics and other sensitive data, military robots and data poisoning.

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, cyber criminals, hackers-for-hire

text: POTENTIAL METHODS

text: Spoofing, denial of service, malicious code, unauthorised access, targeted attacks, misuse of information, man in the middle attack

text: POTENTIAL IMPACTS

text: Biased decision-making, privacy violations, foreign information manipulation and interference (FIMI) 11

text: 2030 TOP THREATS CONTINUED

text: 11 12

text: INCREASED DIGITAL EXPLOITATION OF E-HEALTH CURRENCY-ENABLED (AND GENETIC) DATA CYBERCRIME

text: The amount of genetic and health data By 2030, digital currency-enabled cybercrime increases tremendously by 2030 and is in will increase rapidly. Cryptocurrencies, and the the hands of many stakeholders in the public broad market adoption of them, already have and private sectors. Vulnerabilities in e-health enabled organised crime to expand their reach. devices and databases containing very sensitive Because digital currencies will be very commonly and/or genetic information may be exploited used as an investment asset and means of or used by criminals to target individuals or by payment in European markets, organised crime governments to control populations, e.g., using may be able to expand their targets. This means diseases and genetic diversity as a reason for that cybercrime groups offering professional discriminating against individuals. Genetic data services (cyber-attacks) will be better funded may further be abused to aid law enforcement because of an increase in the efficiency and activities like predictive policing or to support effectiveness of their efforts. a more regimented social credit system.

text: FORESIGHT 2030 THREATS

text: 13 14

text: TAMPERING WITH DEEPFAKE ATTACKS USING QUANTUM VERIFICATION SOFTWARE COMPUTING SUPPLY CHAIN

text: In 2030 quantum computing resources will be By 2030, deepfake technology will be widely made more widely available, allowing threat used. It may be used as a form of harassment, actors to use quantum computing to attack evidence tampering, and provoking social existing deployments of public key cryptography. unrest. Although there will likely be a rapid influx Likewise, there is a risk that threat actors collect of verification software that analyses videos and sensitive encrypted data now, aiming to decrypt voice to verify the identity of individuals , the it once quantum computing is accessible. This is urgent market demand leads to programmers especially relevant for current digital IDs that use cutting corners. This software will be highly asymmetric cryptography to authenticate. targeted by anyone wishing to use deepfakes for illegal or unethical purposes.

text: 15 16

text: EXPLOITATION OF AI DISRUPTING / ENHANCING UNPATCHED AND OUT-OF- CYBER ATTACKS DATE SYSTEMS WITHIN THE

text: Escalation as a result of AI-based tools. Attackers OVERWHELMED CROSS- will use AI-based technologies to launch attacks. SECTOR TECH ECOSYSTEM In order to defend against those attacks and

text: even to launch counter measures, there must Everything-as-a-service leads to a multitude also be defensive AI-based weapons. Behaviour of tools and services that require frequent of the AI in these cases is difficult to test, updates and maintenance by both consumers measure and control – if speed of response is and providers. This combined with the skill valued. shortage presents a difficult to manage surface of vulnerabilities that can be exploited by threat actors. Furthermore, the complexity of the supply chain fosters confusion on where responsibilities for security lie. For governments, this creates more backdoors for espionage while cyber-criminals can exploit the unpatched and outdated services for financial gains. This is especially true when critical infrastructure is in the hands of the private sector or when national security data is reliant on singular private entities.

text: FORESIGHT 2030 THREATS

text: 17 18

text: MALWARE INSERTION TO TECHNOLOGICAL DISRUPT FOOD PRODUCTION INCOMPATIBILITY OF SUPPLY CHAINE BLOCKCHAIN TECHNOLOGIES

text: Due to increased automatisation and Until 2030, several regionally based blockchain digitalization of food production, food supply technologies are created by different groups of chains can be disrupted by a range of threat governments to create an international "gold actors with medium-high resources. Denial of standard". This is driven by a societal lack of service attacks on packaging plants, for example, trust in blockchain that has accumulated over can prevent continued food operations; the last years. Each technology group aims to processed food manufacturing tools may be gain a competitive advantage. This gives rise manipulated to change the compounds in the to a period of technological incompatibility of food itself. Attacks like these can lead to a food blockchain technology which leads to failures, shortage, economic disruptions, and in the malfunctions, data loss and the exploitation of worst case, poisoning. vulnerabilities at the interfaces of the different blockchains. This creates challenges for ecosystem management and data protection, furthers distrust, and negatively affects trade and GDP growth.

text: 19 20 21

text: DISRUPTIONS PHYSICAL IMPACT MANIPULATION IN PUBLIC OF NATURAL / OF SYSTEMS BLOCKCHAINS ENVIRONMENTAL NECESSARY FOR DISRUPTIONS ON EMERGENCY

text: Blockchain has been implemented in nearly all CRITICAL DIGITAL RESPONSE aspects of society in 2030. INFRASTRUCTURE Manipulation of sensors with Unfortunately, security The increased severity and connections to emergency expertise in the area of frequency of environmental services may overload blockchain did not advance disasters causes several services like ambulances, significantly, creating a slew regional outages. Redundant police, firefighters, etc. For of vulnerabilities that may back-up sites that maintain example, call centres may be be exploited in the future. the availability of critical overloaded with inauthentic Locally unavailable blockchain infrastructure will also be calls or fire alarms may be technology will, for example, affected. manipulated to injure specific prevent access to voting, individuals or to obscure legal transactions, and even emergency response teams' security systems. Another ability to locate the issue. possible attack vector is Similarly, mass panics that exploited by partitioning the overload emergency systems bitcoin network by hijacking may also be provoked through IP address prefixes. This the use of social media. can cause, for example, duplicated spending and thus economic damage.

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certifi cation schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: ENISA

text: European Union Agency for Cybersecurity

text: Athens Oﬃ ce

text: Agamemnonos 14 Chalandri 15231, Attiki, Greece

text: Heraklion Oﬃ ce

text: 95 Nikolaou Plastira 700 13 Vassilika Vouton, Heraklion, Greece

text: Brussels Oﬃ ce

text: Rue de la Loi 107 1049 Brussels, Belgium

text: enisa.europa.eu https://www.enisa.europa.eu/topics/foresight