Threat Theaters

📣 Disinformation / IO theater

Detecting and exposing state-sponsored disinformation and information operations: coordinated inauthentic behavior, bot networks, laundered narratives, and synthetic media. Manufactured consensus erodes trust, polarizes societies, and shapes conflict.

🔄 Pivot:📁 disinformation📁 influence operation📁 coordinated inauthentic behavior📁 doppelganger📁 spamouflage📁 deepfake📁 bot network📁 propaganda📁 narrative laundering

Live indicators

0
in this theater

High severity

0
score ≥ 0.75 (top 60)

Actors tracked

6
documented

Mapped sources

1
in catalog
🔧 Native workbench📈 Native dashboardDomain command center →Sources (1)Copilot briefReport

🏹 Threat Actors

Doppelganger operatorsSpamouflage (Dragonbridge)Internet Research Agency (IRA)Ghostwriter (UNC1151)Cotton Sandstorm (Iran)Secondary Infektion

🧭 Intelligence disciplines

OSINT →SOCMINT →HUMINT →GEOINT →FININT →

📚 Priority sources & datasets

DFRLab →Stanford Internet Observatory →Graphika →EUvsDisinfo →Meta Adversarial Threat Report →GDELT →Bellingcat →

🔄 Live Datasets & APIs (1 key-free · ingestible)

Dataset / APIFormatEndpoint
Pushshift / Redditjsonhttps://api.pushshift.io/collect
Run Auto-Collect Datasets Hub Import

📜 Disinformation / IO Playbook

  1. Harvest suspected IO content and accounts from SOCMINT feeds, DFRLab/Graphika reporting, and GDELT.
  2. Detect coordinated inauthentic behavior via posting-cadence, asset-reuse, and network-graph analysis.
  3. Trace narrative provenance, amplifier tiers, and deepfake/generative-media indicators.
  4. Attribute campaigns to operators (Doppelganger, Spamouflage, Ghostwriter) via domain and TTP overlap.
  5. Publish an IO-exposure report with narrative maps, reach estimates, and confidence grading.
  6. Refer assets for platform takedown and issue pre-bunk and counter-messaging guidance.

⚡ AI Skills & Automation

🤖 Copilot brief⚡ AI SkillsResolveEnrichAuto-CollectHuntReportExport

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🎯 Add to case

Attach Disinformation / IO (Mission Domain) and pull all linked entities:

🗃 Data Management

+ Case+ CampaignWatchlistTagSave searchWhitelistExport STIX/MISPReport

🧩 Advanced Capabilities

Link AnalysisPivot ExplorerTimelineThreat HuntingAnalyticsDetection RulesBlockchainOSINT PivotPassive DNSTAXII 2.1MISP FeedCreate Alert RuleNetFlowCoverage & Gaps

🔗 Cross-domain pivots

Disinformation feed →IO domain →SOCMINT →Global events →Actor profiles →OSINT →
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

⚡ AI Skills

All SkillsResolveEnrichCorrelateSummarize

🔍 Lookup & Enrich

EnrichmentsPivotLink Analysis

📚 Docs & Reports

DocumentationGenerate ReportAPIPlatforms Hub

💡 Recommendations

⚙ Automation

Operations Center

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🔗 Related Tools

Mission CommandAdvanced SearchOperations Center