Cognitive Wars

Anatomy of a Cognitive Attack: The Influence Operation Kill Chain

Influence operations are not bursts of propaganda. They are projects, with planning, infrastructure, delivery and evaluation, and each phase leaves traces. Read through the DISARM framework and one of the best-documented campaigns of recent years, Russia's Doppelgänger operation, the kill chain shows where cognitive attacks are strong, where they are weak, and where defenders spend their effort in the wrong place.

By Cyber defense analyst

Published 9 min read

Key judgments

Moderate confidence How we assess confidence
  1. Foreign information manipulation against Europe is rising in frequency and is increasingly outsourced. State sponsors rely on commercial firms, proxies and covert networks that obscure attribution. High confidence.
  2. Generative AI has lowered the cost of producing influence content far more than it has raised its impact. Content is now cheap and abundant; distribution and credibility remain the bottleneck. Moderate confidence.
  3. The Prepare phase offers defenders the best return. Infrastructure such as domains, accounts and invented outlets must exist before content can flow, and it is observable, attributable and legally actionable. High confidence.
  4. The decisive amplifiers of most influence operations are authentic actors: journalists, politicians and influencers who carry content beyond the networks that produced it. Moderate confidence.
  5. Counting incidents overstates the effect of influence operations while understating their cumulative cost. Most fail to break out, but their persistence erodes trust in the information environment itself.
Interactive · Kill chain explorer
Four phases of an influence operation

Select a phase to see what the operator does, how it looked in the Doppelgänger case, and where defenders can intervene.

Phase structure and tactic names follow the DISARM Red Framework. Case evidence from the US Department of Justice (2024), EU DisinfoLab (2022) and OpenAI (2024); see sources at the end of the article.

Why think in kill chains

Cybersecurity learned this lesson more than a decade ago. In 2011, analysts at Lockheed Martin argued that an intrusion is not a single event but a sequence of stages, and that a defender only has to break one link to defeat the whole chain (Hutchins, Cloppert and Amin, 2011). MITRE’s ATT&CK knowledge base later turned that idea into a shared catalogue of adversary tactics and techniques, giving defenders a common language to describe what they observe.

The information domain was slower to follow. Disinformation was long discussed as a problem of content, of what was false and who believed it, rather than as an operation run by an adversary. DISARM changed that. Born in 2019 as AMITT (Adversarial Misinformation and Influence Tactics and Techniques) and deliberately modelled on ATT&CK, it organises influence operations into four phases, Plan, Prepare, Execute and Assess, each broken down into tactics and techniques. Its Red Framework describes what attackers do; a less mature Blue Framework catalogues countermeasures. The European Commission and France already use it to tag incidents, and the EU and the United States have stated an intention to share information using it.

The value of the model is not taxonomy for its own sake. It shifts the analytical question from “is this content false?” to “what is this actor trying to do, and what did they have to build to do it?” That second question has answers that can be observed, compared across campaigns and acted upon.

The case: Doppelgänger

Few operations are documented as thoroughly as Doppelgänger. EU DisinfoLab exposed it in 2022, describing a network that cloned the websites of European news outlets to publish pro-Kremlin content under their identity. In September 2024 the US Department of Justice announced the seizure of 32 internet domains linked to the campaign and attributed it to three Russian entities, Social Design Agency, Structura National Technology and ANO Dialog, operating under the direction of the Russian Presidential Administration. On the same day the US Treasury sanctioned ten individuals and two entities over Russian influence efforts targeting the 2024 election.

The unsealed affidavit is unusually revealing because it describes not only what the operation published, but how it was organised: planning documents, project names, target countries and stated goals. That makes Doppelgänger an ideal case to walk through the kill chain phase by phase.

Phase by phase

Plan: objectives before narratives

Every serious operation starts with a sponsor’s objective, not with a story. According to US investigators, Doppelgänger’s internal proposals included projects named the Good Old USA Project, the Guerilla Media Campaign and a US social media influencers network, with goals that ranged from reducing international support for Ukraine to influencing voters in the 2024 US presidential election. Germany, Mexico and Israel also appeared as targets.

For defenders, the Plan phase is the least visible: it surfaces mostly through leaks, seizures and after-the-fact reconstruction. But it is the most predictable. Operations cluster around moments the sponsor cares about, such as elections, summits, military aid decisions or domestic crises in the target country. Anticipating those windows, and the social divisions an adversary is likely to exploit within them, is the earliest form of defence available.

Prepare: the stage must be built before the play

This is where Doppelgänger’s signature technique lived. Operators registered look-alike domains of real outlets, one example cited by US prosecutors mimicked the Washington Post on a .pm domain, and populated them with fabricated articles under the outlet’s brand. Alongside the clones, they built invented media brands with deliberately neutral names, such as “Recent Reliable News”, and created fake profiles posing as citizens of the target countries.

Preparation is expensive in a way content is not. A domain has to be registered and hosted; an account needs a history to look credible; a fake outlet needs enough material to survive a casual glance. And every one of those assets leaves forensic traces: registration dates, hosting providers, shared technical identifiers, recycled profile images. That is why the most consequential action against Doppelgänger was not a fact-check of any single claim, but the seizure of its infrastructure.

Execute: from seeding to breakout

Execution begins with what DISARM calls pump priming: seeding content through controlled accounts in the hope that real users will pick it up. Doppelgänger’s fake profiles posted comments carrying links to the cloned sites, while paid social media ads and paid influencers bought additional reach. OpenAI’s first threat report on the misuse of its models, published in May 2024, found that clusters linked to the operation used AI to write short comments in several languages, translate articles, generate French-language articles and repackage website content as social media posts.

The pattern is telling. AI was used to make execution cheaper and faster, not to make it more persuasive. The hard part of execution has never been producing content; it is getting content out of the network that created it and into conversations that matter. Synthetic text does little to solve that problem.

Assess: the metrics problem on both sides

Operators must justify their budgets to sponsors, and the easiest numbers to report are outputs: posts published, accounts created, impressions bought. Those numbers say little about whether anyone changed their mind. Defenders face a mirror-image problem. Counting incidents, accounts or posts makes threats look larger and more uniform than they are, and public exposure, if poorly handled, can hand an operation the visibility it failed to earn.

Doppelgänger illustrates the gap. It persisted for years and across many countries, re-registering infrastructure after successive exposures. Yet in OpenAI’s 2024 assessment, none of the operations reviewed, Doppelgänger included, scored above Category 2 on a six-point scale of impact.

The impact paradox

The scale in question is Ben Nimmo’s Breakout Scale, published by Brookings in 2020 and now widely used by platform investigators. It measures impact not by volume but by how far an operation travels:

  • Category 1: confined to one community on one platform.
  • Category 2: spreads across platforms within one community, or across communities on one platform.
  • Category 3: reaches multiple communities on multiple platforms.
  • Category 4: breaks out of social media and is picked up by mainstream media.
  • Category 5: is amplified by high-profile figures such as celebrities or political candidates.
  • Category 6: triggers a policy response or other concrete action, or includes a call to violence.

The structure of the scale contains an uncomfortable insight. From Category 4 upwards, the amplifiers are not the operators; they are authentic actors in the target society. An influence operation becomes significant at the moment a journalist reports it uncritically, a politician repeats it or an institution reacts to it. The operation supplies the spark; the target society supplies the oxygen.

None of this means that low-breakout operations are harmless. The European External Action Service documented more than 500 incidents of foreign information manipulation and interference in 2024, involving at least 25 platforms, some 38,000 accounts and 322 targeted organisations across 90 countries. Its fourth report, published in March 2026, counted 540 incidents in 2025, amplified through around 10,500 channels and websites, with Ukraine the primary target followed by France, Moldova and Germany. Russia and China together accounted for 35 % of documented incidents, and the report described AI-generated text, synthetic audio and manipulated video as routine, low-cost tools. Most of those incidents will never reach Category 4. But their sheer persistence has a cost of its own: it normalises the suspicion that everything might be fabricated. Legal scholars Robert Chesney and Danielle Citron called one version of this the “liar’s dividend”: in an environment saturated with fakes, genuine evidence becomes easier to dismiss (Chesney and Citron, 2019).

What AI changes, and what it doesn’t

Mapped onto the kill chain, the effect of generative AI is uneven. It dramatically lowers the cost of two tactics in the Prepare phase, developing content and establishing assets, and of content delivery in Execute: text in any language, synthetic personas, cloned voices, all at negligible marginal cost. It does far less for the tactics that decide outcomes: building genuine legitimacy, reaching new communities and persuading authentic amplifiers to carry the message.

The likely consequence is more operations, more noise and more experimentation, rather than proportionally more successful operations. That is still a problem: a defender who must triage ten times as many low-quality campaigns has less capacity for the few that matter. But it argues against treating AI-generated content as the core of the threat. The scarce resources in the information environment remain attention and trust, and neither can be generated synthetically.

Implications for defenders

  1. Shift left. Invest in detecting and disrupting the Prepare phase: look-alike domains, coordinated account creation, invented outlets. Infrastructure is slower and costlier to rebuild than content is to rewrite.
  2. Target the intermediaries. Commercial firms, proxies and service providers are the operational backbone of outsourced influence. The EEAS’s 2026 “FIMI Deterrence Playbook” points in this direction, imposing costs on the enablers rather than only on the narratives.
  3. Measure breakout, not volume. Prioritise operations that are crossing into new communities, mainstream media or public figures. Counting posts and accounts rewards activity, not impact.
  4. Protect the amplifiers. Brief journalists, campaign teams and public officials, the actors who determine whether an operation climbs above Category 3, on the techniques and narratives in circulation.
  5. Prebunk audiences. Short interventions that teach people to recognise manipulation techniques, rather than refute individual claims, have improved resilience in large field experiments (Roozenbeek et al., 2022). They protect against the next campaign, not just the current one.
  6. Speak a common language. Tagging incidents with DISARM tactics makes cross-organisation and cross-border analysis possible, and turns isolated reports into patterns.

Bottom line

Cognitive attacks are more industrial and less magical than they are often portrayed. They follow a sequence, depend on infrastructure and fail far more often than they succeed. Their real leverage lies at the two ends of the chain that defenders tend to neglect: the preparation that makes them possible, and the authentic voices that make them matter. A defence built around debunking content in the middle of the chain will always be late. One built around the whole chain has a chance to be early.

Sources

Join the discussion

Your email address will not be published. Comments are moderated: substantive disagreement is welcome, abuse is not.