MWW - Crime and Prigozhin

Welcome to Memetic Warfare Weekly!

My name is Ari Ben Am, and I’m the founder of Glowstick Intelligence Enablement. Memetic Warfare Weekly is where I share my opinions on the influence/CTI industry, as well as share the occasional contrarian opinion or practical investigation tip.

I also provide consulting, training, integration and research services, so if relevant - feel free to reach out via LinkedIn or ari@glowstickintel.com.

The past few days have really shown how one’s perception of time can be altered by being hashtag extremely online, but also and most importantly - how good investigation tools and techniques are functionally universal.

Anyway, let’s discuss this weeks events:

Russian OSINT Rodeo Roundup:

There's been some real #topkek memery as a result of the recent chapter of "Crime and Prigozhin". A few of my thoughts from the whirlwind coup that never was:

People, open-source intelligence/ investigation is more than just monitoring events, and it's more than just being on Twitter and rehashing content from Telegram channels. Being able to integrate various sources and tools is the only way to come up with a somewhat reasonable picture of what's going on.

Having said that, however, let's stop with the holier-than-thou approach to OSINT. If I have to hear another person say "open source intelligence is more than just finding information", and pretend that they carry out deep, thoughtful red teaming and analysis of every tweet they come across, I will have to begin trolling comment sections. Part of the reason we're in this field is because it's fun, and even whimsical at times - let's embrace that and not gatekeep.

Now that I've gotten that out of my system, I figured that it would be fun to do a brief review of some fun and under-utilized OSINT tools and techniques used to analyze the Wagner armed rebellion in Russia - beyond, of course, doomscrolling on Twitter and Telegram.

The first is, of course, flight tracking. Useful for many purposes in OSINT, tracking known planes, alongside larger meta-trends of commercial and private aircraft, can tell one much about a given conflict or event - as shown below. Where’s Putin really? Who knows. Much has already been discussed about other Russian oligarchs fleeing, as well as the presence of Lukashenko.

The next is the use of Google maps to track traffic activity - this approach has been used a few times in various conflicts, and never ceases to amaze in terms of its ability to predict coups, armed conflict and more.

Then we have the now rebranded “Irina Daily Tech Tips”, the OSINT influencer formerly known as

Cyb_detective

, coming out hot with the use of the “FIRMS” system to track fires. This of course, as Irina explains, has much utility in this specific scenario.

Pretty in Pink Wave

Recorded Future puts out some useful reporting on general geopolitical trends and so on in the wider context of information security, as well as some high-level reporting on IO activity (come on guys, publish some deep, targeted research!).

I’ve referred to some of their reporting in the past, including a solid report recently on Chinese OSINT contractors. Their recent report on Iranian influence in Latin America is notable in that it covers Latin America, a continent that I really don’t follow closely.

The report focuses mostly on high-level research: reading the news, some vendor reports and other sourcing for a broad overview of activity and trend analysis. Having a solid understanding of a given region is also, of course, a prerequisite for any effective research to be done.

The report is a great start for anyone interested in Iranian influence in Latin America - perhaps its most fertile ground for influence outside of the Middle East. The report correctly emphasizes the importance of Islamic centers and overt state media in promoting the regime’s narratives and influence, but misses some other outlets as well as perhaps not identifying nexuses of activity and overlap with Russia/China.

Unfortunately, the report doesn’t actually uncover any new online Iranian IO in Latin America- it’s not particularly hard to find on functionally any platform - so that’s a miss.

My final complaint is that the margins of the report aren’t justified - guys, please do so when publishing any report on any topic! It visually looks terrible and is less pleasant to read.

IO 360 AWP Noscope

Grey Dynamics did me the favor of publishing a short article on the creation of a custom Counterstrike map by Finnish newspaper Helsinging Sanomat. Normally this wouldn’t be a regular news item, but the map created in fact serves as a repository of verified information on Russia’s invasion of Ukraine.

As anyone who occasionally plays CS:GO, such as yours truly, knows - Russians love Counterstrike, and most importantly - CS isn’t banned yet in Russia. Doing so would perhaps finally incite a revolt amongst the disaffected youth, who as of the time of writing may in fact join whatever armed rebellion is currently happening in Russia what with the ongoing Wagner antics.

Jokes and Russian affairs aside - video games are a fascinating and under-reported vector for online activity, hybrid warfare, OSINT and journalism - and we can only expect to see more soon.

WIV’ing Dirty

The ODNI has released a sanitized report on potential links between the Wuhan Institute of Virology (WIV) and its potential ties to the COVID-19 virus. The report states that there may well be potential links between the WIV and the creation and escape of the COVID-19 virus, while also stating that the US IC has no consensus opinion on the topic.

While no one knows what really happened, and we probably never will (or at least not know for decades), this report will probably engender a strong Chinese public diplomacy, propaganda and probably even IO counter-offensive. I’m not one for trying to proactively predict IO (see my previous posts), but reports of this weight and impact on Chinese PR will almost certainly be exploited in IO.

As an aside - this report would be a great starting point for an IO investigation, be it by Crowdtangling the original link, looking for accounts on various platforms and beyond.

That’ll be it for this week, see you all next week! For any questions, complaints or jokes - please contact me at ari@glowstickintel.com.