Author: Demetris Paschalides, University of Cyprus
In today’s contested information environment, foreign influence operations have become increasingly systematic, strategic and scalable. Disinformation tools now include AI-generated media, and psychological manipulation is part of coherent, coordinated campaigns rather than spontaneous acts.
The ATHENA project has undertaken a detailed analysis of how these operations unfold, examining 32 real-world Foreign Information Manipulation and Interference (FIMI) campaigns. Central to this analysis is the use of tactics, techniques, and procedures (TTPs), a concept adapted from military and cybersecurity doctrine to understand the “how” behind information attacks.
This blog post outlines how ATHENA uses the DISARM framework to reverse-engineer FIMI operations, revealing structural patterns across thematic case studies, common clusters of TTP combinations and emerging threats such as AI-generated content. The insights presented here are based on the methodology, analysis and findings detailed in ATHENA’s deliverable D1.1, a summary of which can be found on the project’s website (project-athena.eu).
What are TTPs and how do they work in practice?
To understand the notion of TTPs, let us first consider a fictional but probable scenario of an influence operation where a foreign actor seeks to undermine democratic trust in Country X ahead of national elections. Their objective is to erode confidence in the electoral system. To achieve this, they plan and execute a campaign involving the creation of fake social media accounts, the spread of fabricated stories about voter fraud, and the use of bot networks to amplify these narratives. They engage with local influencers to add authenticity and monitor engagement to refine future attacks. This scenario encapsulates the logic behind TTPs:
- Tactics describe the strategic goals (e.g., undermine democratic institutions).
- Techniques are the specific methods (e.g., use of bots, impersonation of trusted sources).
- Procedures outline how these methods are deployed in sequence to maximise impact and evade detection.
Understanding TTPs is vital to support policymakers, platforms and researchers as they move beyond content monitoring to behavioural mapping, offering insight into how disinformation and FIMI operations are structured and sustained.
 |
| Figure 1: Scenario illustrating how TTPs align with influence campaign objectives, strategy, and methods. |
DISARM: the kill chain for influence operations
To guide this behavioural mapping, ATHENA applies the DISARM Red Framework, which segments disinformation campaigns into four stages: Plan, Prepare, Execute and Assess, collectively known as the DISARM Kill Chain (see Figure 2).
Each phase includes a distinct set of tactics and techniques. For example, in the Plan phase, actors may segment audiences, analyse vulnerabilities or determine strategic goals. During Prepare, they create content, establish fake personas and select amplification channels. Execution involves dissemination, engagement manipulation or online harassment. Finally, the Assess phase evaluates impact for future refinement.
 |
| Figure 2: The four-phase structure of DISARM provides a blueprint for identifying and categorising tactics and techniques across disinformation operations. |
TTPs in action: insights from the 32 FIMI case studies
As part of the ATHENA project, a comprehensive analysis was conducted on 32 case studies of FIMI campaigns originating from actors including Russia, China, Turkey and others. These case studies provide valuable insights into the structural dynamics of FIMI operations. Each case was systematically annotated using the DISARM Red framework to identify the specific TTPs employed, as well as the combinations in which they appeared. For deeper insights into the methodology and findings, see the forthcoming book based on our research1.
 |  |  |
| Figure 3: Frequency of TTPs used during the planning, preparation and execution phases of the kill-chain. | ||
As depicted in Figure 3, the frequency analysis across campaign phases shows:
- Plan phase is dominated by efforts to undermine, divide and distort, often targeting public trust and institutional credibility.
- Prepare phase focuses on content creation, leveraging narratives and building fake social infrastructure.
- Execute phase includes tactics such as amplifying content, flooding the information space and driving online harms.
To gain a deeper understanding of TTP usage patterns in FIMI campaigns, the ATHENA project applied a dual analytical approach: (i) thematic clustering based on the context of the campaigns, and (ii) grouping of case studies according to their TTP usage footprint. This approach revealed a consistent and strategic application of TTPs across varying operational goals and campaign designs, highlighting the structured nature of influence operations.
Key takeaways
Understanding evolving disinformation strategies: Findings suggest that disinformation campaigns are highly adaptive, drawing on recurring TTPs that are carefully combined and adjusted to suit shifting contexts. These campaigns are not improvised but carefully designed, demonstrating a calculated application of influence methods. TTPs such as “Develop Text-Based Content” (T0085) and “Social Networks” (T0104) were among the most prevalent, enabling actors to tailor, disseminate and amplify disinformation efficiently and effectively.
Recurring themes across multiple actors: Despite differences in geopolitical goals, actors including Russia, China, Turkey and North Korea often rely on similar operational patterns. Techniques such as “Distort Facts” (T0023) and “Amplify Existing Narrative” (T0118) were observed across campaigns. These similarities suggest that threat actors learn from each other and adapt successful tactics across regions. Addressing such global disinformation efforts requires coordinated international responses and common mitigation frameworks.
Amplification through echo chambers: The analysis also reveals that disinformation actors build and maintain targeted information ecosystems designed to echo, reinforce and entrench their narratives. Techniques such as “Leverage Echo Chambers” (T0102), “Flood Information Space” (T0049) and “Cross-Posting” (T0119) were frequently observed, allowing manipulated narratives to gain traction and visibility. These tactics deliberately exploit the mechanics of social media algorithms, reinforcing users’ confirmation biases and making it difficult for counter-narratives to gain equal footing.
Use of multimedia to enhance credibility: A consistent finding across the ATHENA cases is the strategic integration of multimedia, consisting of text, images and videos, to boost engagement and believability. The use of “Develop Image-Based Content” (T0086) and “Video-Based Content” (T0087) alongside textual disinformation makes the content more emotionally compelling and credible. Looking ahead, AI-generated content (deepfakes, synthetic audio, auto-generated news articles) presents an evolving challenge, with the potential to fabricate convincing but entirely false realities. Responding to this will require advanced detection tools and digital literacy at scale.
Conclusion and call to action
ATHENA’s findings demonstrate that FIMI campaigns are not spontaneous but are organised, iterative and increasingly sophisticated. TTPs are methodically deployed across the phases of planning, preparation, execution and assessment. Techniques such as content creation, amplification and the exploitation of echo chambers are strategically employed to maximise impact.
Understanding this behavioural blueprint is critical. The DISARM framework, combined with ATHENA’s analytical methodology, provides a structured way to map disinformation behaviours and anticipate evolving tactics. This capability is particularly urgent as multimedia and AI-generated disinformation tools become more realistic, scalable, and accessible.
Addressing these threats requires more than traditional content moderation. It calls for systems that can identify the operational patterns behind influence campaigns. Only by understanding the underlying methods of disinformation can we build effective defences, enhance digital resilience and support coordinated policy responses.
Mapping the methods is not only a research imperative, it is a democratic necessity.
- Wright, David (ed.), Foreign Information Manipulation and Interference: Case studies from the ATHENA project, Springer, Cham, Switzerland, September 2025.
↩︎