The Wagner PMC as an Informational Tool: Between Kill Chain, 6D, and the Multiplication of Crises

  • By Christine Dugoin-Clément (Revue Defense Nationale 2024/8 No. 873)
  • Translated by Mohamed SAKHRI

The Wagner Private Military Company (PMC) became famous several years ago. Founded by Evgeny Prigozhin, who was declared dead in an airplane accident in August 2023, this PMC quickly expanded in Russia and was initially known for its mercenary and security activities serving governments. It must be understood as an integral part of the influence strategy implemented to serve the geopolitical and geo-economic objectives of the Kremlin in Europe, as well as in Africa.

Indeed, while military activities were widely exposed following the massive invasion of Ukraine, the “Prigozhin galaxy” developed a significant informational component, whose activity has been observed during several regime changes (in Mali, Burkina Faso, and Niger, and previously, in the Central African Republic and Sudan). This explosion of influence operations was facilitated by the development of Information and Communication Technologies (ICT) and Information Systems (IS). Furthermore, these activities can be accompanied by cyberattacks targeting the systems of businesses deemed strategically important or economically significant.

This militarization, targeting the cognition of individuals (civilians, military, fighters, or decision-makers), fits within the framework of cognitive warfare (CogWar), which has been studied and developed in several countries with both offensive and defensive approaches. It should be noted that this has numerous advantages, whether in terms of financial costs, deployment through third parties as seen in the case of Wagner, or modernization of the fog of war, which makes attribution of influence operations particularly delicate. This, in turn, facilitates plausible deniability. Finally, a question arises concerning the methods employed by Wagner (and by the structures that succeeded it). Thus, this article analyzes the contributions to understanding offered by the Kill Chain used in cybersecurity and the 6D cyber defense model in the context of CogWar, by observing operations carried out in Africa, particularly in Mali and Niger.

Models That Can Be Mobilized
The very nature of these actions calls for a transdisciplinary reading to grasp the complexity of operations conducted within the framework of CogWar.

Kill Chain and 6D
The Kill Chain is an approach aimed at analyzing the various phases that a cyber attacker must follow to execute the complete cycle of a cyber attack. Depending on the sources, it can consist of 5 to 18 phases. It is within this framework that Lockheed Martin developed a widely used model (KCLM).


A proactive defense approach against intrusions targeting IS has been derived from this, based on a reverse reading of the Kill Chain, aimed at categorizing the flow of actions of system defenders. The 6D is divided into various phases: Detect, Deny, Degrade, Disrupt, Deceive, and Destroy.

Finally, other studies establish a matrix of links between the 6D and the Kill Chain. Given that many influence operations utilize the online world, it seems interesting to see how these models could facilitate the understanding of informational operations.

Action Plan Matrix (Hutchins, et al., 2011, Table 1, p. 117).
PhaseDetect (Detecter)Deny (refuser)Disrupt (perturber)Degrade (degrade)Copyright 2019 DeceivebDestroy
RecognitionWeb analyticsFirewall ACL
ArsenalisationNESTSNIPS
DeliveryVigilant userProxy FilterIn-line AVCareful files
ExploitationHIDSPatchDEP
InstallationHIDS“chroot”jailOF
C2NESTSFirewall ACLNIPSTarpitRedirection DNS
Actions on goalsAudit logQuality of serviceHoneypot
Action Plan Matrix (Hutchins, et al., 2011, Table 1, p. 117).

Cognitive Warfare (CogWar)


The concept of cognitive warfare has become a subject of increasing interest following the massive deployment of manipulation, influence, and deception operations over the past decade. NATO defines it as “the convergence of a wide range of advanced technologies with human factors and systems such as Artificial Intelligence (AI), Machine Learning, ICT, neuroscience, biotechnology, and human enhancement, which are deliberately used […] in the battlefield of the 21st century.” The same document specifies that allies must develop capabilities “necessary to detect misinformation and help prevent or mitigate its impact, notably by better understanding people, networks, online information, and related narratives” in order to respond to and guard against this multidisciplinary approach that seeks to modify human thought, understanding, and decision-making, referred to as CogWar.

CogWar spans multiple disciplinary fields, including management sciences, IS, and social and cultural sciences, attracting the attention of researchers, analysts, theoreticians, and strategists. Thus, various works advocating for treating social-engineering cyberattacks as a specific type of psychological attack, drawing from IS, classify human cognition into four main categories: perception, working memory, decision-making, and action, upon which an attack could be schematically outlined.

Here, short-term memory is considered a component of working memory, while long-term memory participates in cognition in general; it is thus schematically represented in black as supporting the entirety of the four domains of cognition in the moment.

Finally, influence operations and CogWar could traverse different physical and digital spaces defined by the UK Ministry of Defense (MOD).

This ability to transcend different physical layers and the aspects of temporality highlighted by Rosana Montañez, Edward Golob, and Shouhuai Xu (2020), researchers at the University of Texas, recalls works classifying cognitive operations into two distinct categories: single campaigns and long-term campaigns. Recent events seem to demonstrate the capacity to conduct both single and long-term operations simultaneously, sometimes exhibiting interesting opportunistic capabilities that allow for the multiplication of crises. Moreover, if these operations can traverse the various layers previously presented, it becomes pertinent to question the feasibility of conducting unitary or long-duration operations that could extend across vast territories transcending political, or even physical, borders. In this hypothesis, an analysis should be proposed that incorporates the possibility of translating these boundaries, or even capitalizing on their porosity.

Methodology
This study proposes to analyze various elements related to two specific informational crises that affected the French armed forces: that of Gossi in Mali and the ousting of President Bazoum in Niger.

For reference, France committed its military forces in Mali with Operation Serval starting January 11, 2013, and then with Operation Barkhane beginning August 1, 2014. In agreement with the government then in place in Bamako, Serval aimed to stop the advance of jihadist groups toward southern Mali and thus ensure the safety of French nationals present in the country while limiting the capacity for violent projection through terrorist actions on French soil. Barkhane, which succeeded it, aimed to continue the fight against armed jihadist groups in the Sahelian band (BSS) with the support of allied armies.

In the spring of 2021, Mali faced a coup d’état that led to power being seized by a military junta, which then announced it would only ensure a transitional government leading to elections that were continually postponed, while by September, various voices spoke of more or less discreet negotiations with the Wagner group. Relations gradually deteriorated with Paris to the point where, in February 2022, Bamako summoned France to leave its territory and subsequently withdraw its military personnel, including those stationed at the Gossi base. It is in this context, as the anti-French sentiment continued to rise and was encouraged by various media channels, that a Facebook post emerged accusing France, with video evidence, of having committed assassinations of Malians, with the corpses filmed at a grave site near the Gossi base that the French military was preparing to leave. The video was posted by someone named Dia Diarra, whose biography claimed he was a “Former military/Patriotic Malian/political analyst.” This operation was denied by the French military, which showed drone images of a group not composed of French soldiers burying bodies and filming the scene. Furthermore, the individual named Dia Diarra had joined the network in January 2022 with a profile picture that actually belonged to a Colombian user. The photo had been quickly modified to show another man in military uniform. Finally, the dissemination could swiftly be linked to informational channels associated with the Wagner constellation.

In August 2023, Nigerien President Mohamed Bazoum was overthrown by his closest guard, granting power to General Tiani, who commanded it. He was proclaimed head of state on July 28. It was then that the Economic Community of West African States (ECOWAS) condemned the military’s actions, and France expressed its concern, while content accused the latter of “beginning to carry out a massive abduction of children,” insinuating that these kidnappings would be aimed at slavery and the sexual exploitation of the supposed young victims. These contents were produced by the “Foundation for Fighting Injustice,” which has been linked to Evgeny Prigozhin’s constellation, thus partially discrediting the accusations made, even though they were shared on Telegram by none other than Dmitry Polyansky, Russia’s Permanent Representative to the United Nations, along with many fake accounts known to have been activated previously in influence operations connected to the renowned Russian businessman.

For this study, we analyzed various reports and media content, particularly to understand the nature of the pre-existing context and how the pillars cited in cognition models could be mobilized within a CogWar approach, particularly how the elements could excite the cognitive factors related to long-term and/or short-term memory. Finally, interviews were conducted with analysts and experts in the area, as well as with individuals who held positions of responsibility in the countries covered by this study.

Results
Through this work, we found that the phases of the cyber kill chain can be applied, with adaptations (for example, the recall phase), to informational operations. Consequently, the 6D model is useful, but not absolute. Indeed, while detection is important, denial (if understood as a rebuttal) can actually induce a reinforcement effect. Interpreted as a refusal of access, it remains effective, although a total refusal seems unrealistic due to the volatility and plurality of information channels (news, radio, web, social media, blogs, native advertising, cartoons, films, etc.). While destruction of content can be partially achieved, it is not feasible for all production.

Moreover, it appears that the usual layers defined by the MOD are frequently transcended by operations that move from one to another to increase their effects and strengthen the credibility of the content. For example, false content can be reinforced by relying on a real event specifically orchestrated for this purpose in the offline world, as seen in the Gossi case. Likewise, the inverse scenario can also be observed. Furthermore, social targets can be mobilized at different levels, and legitimization can be sought if necessary. For example, a justification might be obtained by relying on influential persons (whether fake or real), as well as on organizations or foundations that might also be fake or real. This overlaps with the various levels of cognition defined by R. Montañez, E. Golob, and S. Xu, namely perception, working memory, decision-making, and action. However, the analysis and observations have highlighted the fact that influence operations can follow two different timelines: a long-term timeline aimed at shaping opinions by using pre-existing tensions, and a more opportunistic approach deploying narratives in response to exogenous or unexpected crises.

It is interesting to note that long-term shaping operations can function similarly to cyber operations, where the payload remains inactive until hackers decide to activate it. Furthermore, this shaping can facilitate the reconnaissance phase, as it is partly designed by long-term CogWar operations. Opportunistic operations can also exploit cognitive biases such as “anchoring effect,” particularly if the reconnaissance phase has been effective.

For instance, in Niger, the campaign alleging the involvement of French forces in the sexual exploitation of children echoed an earlier scandal in which a presidential candidate faced similar accusations. Consequently, this narrative benefits from anchoring in long-term memory, which elicits reactions. Notably, a (false) foundation was used, and the news was conveyed by a real person, benefiting from social legitimization due to their position, reaching a broad audience beyond Niger’s borders.

Ultimately, it appears that these models could be enriched by considering an additional factor: they not only traverse temporal lines and physical layers but also exert horizontal pressure to increase decision-making paralysis. While active measures during the Cold War aimed to divide populations and create chaos, we are now witnessing a multiplication of crises for the same purpose, accelerating the pace and reducing time and geography. Thus, the proliferation of informational operations in territories involving allies of Ukraine contributes to slowing or even freezing decision-making in favor of the strategists of CogWar.

Conclusion
The aim of this work is to observe the interpretive keys of actions that can be integrated into CogWar activities. It allows us to propose a model to better read an action to see if it fits into an informational action of the CogWar type, but also to open a reflection on the stakes such action(s) could carry beyond the geographical borders on which they seem to focus. This work, as exploratory as it may be, provides elements for analysis and reading the disinformation elements that could be part of a CogWar, a subject that raises serious concerns and is considered a battlefield poised to expand significantly in the near future.

References

  • Abass Islam A.M., « Social Engineering Threat and Defense : a Literature Survey », Journal of Information Security, vol. 9 n° 4, 2018, p. 257 (https://doi.org/10.4236/jis.2018.94018).
  • Baran Benjamin E. et Woznyj Haley M., « Managing VUCA : The human dynamics of agility », Organizational Dynamics, vol. 50, n° 2, avril-juin 2021, 100787 (https://www.sciencedirect.com/).
  • Bârgăoanu Alina et Durach Flavia, « Cognitive Warfare : Understanding the Threat », in Arcos Rubén, Chiru Irena et Ivan Cristina (dir.), Routledge Handbook of Disinformation and National Security, Routledge, 2023, p. 221-236.
  • Ber Jakub, « From Popasna to Bakhmut. The Wagner Group in the Russia-Ukraine War », Center for Eastern Studies (OSW), 8 avril 2023 (https://www.osw.waw.pl/).
  • Bernal Alonso, et al.., « Fall 2020 Cognitive Warfare. An Attack on Truth and Thought », Baltimore : Johns Hopkins University, NATO, 2021.
  • Berthemet Tanguy, « Le virage colonial du groupe Wagner en Centrafrique », Le Figaro, 15 août 2023.
  • Bertrand M., « Wagner, société militaire privée (SMP) et nouvel outil de la stratégie géopolitique moderne russe », Sécurité globale n° 24, 2020, p. 43-66.
  • Borgeaud dit Avocat Alexandra. « Cognitive Warfare : Battlefield of Tomorrow », CBAP Prague, 2021, p. 60-64.
  • Burda Robin, « Cognitive Warfare as Part of Society. Never-Ending Battle for Minds », The Hague Centre for Strategic Studies, juin 2023 (https://hcss.nl/).
  • Chivvis Christopher S., « Understanding Russian “Hybrid Warfare”–And What Can Be Done About It », Rand Corporation, 2017 (https://www.rand.org/).
  • Claverie Bernard et Cluzel (du) François, « “Cognitive Warfare” : The Advent of the Concept of “Cognitics” in the Field of Warfare », NATO Collaboration Support Office, 2022.
  • Commission de la défense nationale et des forces armées, L’opération Serval au Mali (Rapport d’information n° 1288), Assemblée nationale, 2013, 128 pages (https://www.assemblee-nationale.fr/14/pdf/rap-info/i1288.pdf).
  • Croom C., « The Defenders ‘Kill Chain’ », Military Information Technology, vol. 14, n° 10, 2010.
  • Danet Didier, « Cognitive Security : Facing Cognitive Operations in Hybrid Warfare1 », European Conference on Cyber Warfare and Security, vol. 22, n° 1, 2023, p. 161-168.
  • Danyk Yuriy et Briggs Chad M., « Modern Cognitive Operations and Hybrid Warfare », Journal of Strategic Security, vol. 16 n° 1, 2023, p. 35-50 (https://digitalcommons.usf.edu/).
  • Dugoin-Clément C., La prise de décision en situations extrêmes sous l’effet des nouvelles stratégies informationnelles : le cas des équipes militaires (thèse), Paris 1 Panthéon Sorbonne, 2020.
  • Gallagher Mike, « State of (Deterrence by) Denial », The Washington Quarterly, vol. 42, n° 2, 2019, p. 31-45.
  • Geers Kenneth (dir.), Cyber War in Perspective : Russian Aggression against Ukraine, NATO CCD COE, 2015 (https://ccdcoe.org/uploads/2018/10/CyberWarinPerspective_full_book.pdf).
  • Goel Sanjay et Nussbaum Brian, « Attribution across cyber attack types : network intrusions and information operations », IEEE Open Journal of the Communications Society, vol 2, 2021, p. 1082-1093 (https://doi.org/).
  • Grant Tim, « Detect, Deny, Degrade, Disrupt, Destroy, Deceive : which is the greatest in OCO ? », Proceedings of the 22nd European Conference on Cyber Warfare and Security, 2023 (https://ia600205.us.archive.org/).
  • Gupta Surbhi, et al.., « A literature survey on social engineering attacks : Phishing attack », 2016 International Conference on Computing, Communication and Automation (ICCCA), IEEE, 2016.
  • Harris Bryan, et al., « Breaking the DDoS Attack Chain », Institute for Software Research, 2013, p. 1-16.
  • Hung Tzu-Chieh et HUNG Tzu-Wei, « How China’s Cognitive Warfare Works : A Frontline Perspective of Taiwan’s Anti-Disinformation Wars », Journal of Global Security Studies, vol. 7 n° 4, 2022, ogac016 (https://doi.org/).
  • Jagolski Natalia, More than ‘Doing the Dirty Work’ : Analysing Wagner’s actions in Mali as undermining the International Rule of Law (mémoire), 2023 (https://studenttheses.uu.nl/).
  • Johnson R., « Hybrid War and Its Countermeasures : A Critique of the Literature », Small Wars & Insurgencies, vol. 29 n° 1, 2018, p. 141-163.
  • Masakowski Y. et Blatny J. M., Mitigating and Responding to Cognitive Warfare, NATO STO Technical Report RDP STO-TR-HFM-ET-356, 2023.
  • Mihai Ioan-Cosmin, et al., « Cyber Kill Chain Analysis », International Journal of Information Security and Cybercrime (IJISC), vol. 3, n° 2, 2014, p. 37-42.
  • Ministry of defense United Kingdom, Cyber Primer. (2nd edition), Development, Concepts & Doctrine Centre, MoD Shrivenham, UK, juillet 2016.
  • Montañez Rosana, et al.. (2020), « Human Cognition Through the Lens of Social Engineering Cyberattacks », Frontiers in Psychology, vol. 11, 1755 (https://www.frontiersin.org/).
  • NATO, Mitigating and Responding to Cognitive Warfare, 2023.
  • Pahi Timea et Skopik F., « Cyber Attribution 2.0 : Capture the False Flag », Proceedings of the 18th European Conference on Cyber Warfare and Security (ECCWS 2019), 2019, p. 338-345.
  • Pappalardo David, « “Win the War Before the War ?” : A French Perspective on Cognitive Warfare », War on the Rocks 1, 1er août 2022 (https://warontherocks.com/).
  • Parens Raphael, The Wagner Group’s Playbook in Africa : Mali, Foreign Policy Research Institute, 18 mars 2022 (https://www.fpri.org/article/2022/03/the-wagner-groups-playbook-in-africa-mali/).
  • Pfleeger Shari L. et Caputo Deanna D., « Leveraging Behavioral Science to Mitigate Cyber Security Risk », Computers & Security, vol. 31 n° 4, juin 2012, p. 597-611.
  • Pischedda Costantino et Cheon A., « Does Plausible Deniability Work ? Assessing the Effectiveness of Unclaimed Coercive acts in the Ukraine War », Contemporary Security Policy, vol. 332023, p. 345-371.
  • Pols Paul et Berg (van den) Jan, « The Unified Kill Chain : Designing a Unified Kill Chain for Analyzing, Comparing and Defending against Cyber Attacks », CSA Thesis, Hague, 2017, p. 1-104 (https://www.unifiedkillchain.com/).
  • Poznansky Michel, « Revisiting Plausible Deniability », Journal of Strategic Studies, vol. 45, n° 4, 2022, p. 511-533.
  • Redmond Matthew G. et Busbey Noah E., Attribution in Influence : Relative Power and the Use of Attribution (thèse), Monterey, California : Naval Postgraduate School, 2017 (https://apps.dtic.mil/sti/pdfs/AD1053405.pdf).
  • Reichborn-Kjennerud Erik et Cullen Patrick, « What is hybrid warfare ? », Policy Brief, n° 1/2016, Norwegian Institute of International Affairs.
  • Renz Bettina, « Russia and ‘hybrid warfare’ », in GÖTZ Elias, Russia, the West, and the Ukraine Crisis, Routledge, 2018, p. 35-52.
  • Salahdine Fatima et Kaabouch Naima, « Social Engineering Attacks : A Survey », Future Internet, vol. 11, n° 4, 2019, p. 89 (https://doi.org/10.3390/fi11040089).
  • Shah Faiz A., « Strategic Thought of Liddell Hart and its Relevance in Contemporary Time », International Journal of Social Science Archives (IJSSA), vol. 5 n° 1, juin 2022, p. 15-21 (https://ijssa.com/).
  • Sukhankin S., « Les contrats militaires privés, instruments de l’influence russe en Afrique subsaharienne », Diplomatie, vol. 108, mars-avril 2021, p. 54-57.
  • Sukhankin Sergey, « Russian PMCS in the Syrian Civil War : from Slavonic Corps to Wagner Group and Beyond », The Jamestown Foundation, 18 décembre 2019 (https://jamestown.org/).
  • Takagi Koichiro, « The Future of China’s Cognitive Warfare : Lessons from the War in Ukraine », War on the Rocks, 22 juillet 2022 (https://warontherocks.com/).
  • Yamin Muhammad M., et al., « Mapping Tools for Open Source Intelligence with Cyber Kill Chain for Adversarial Aware Security », Mathematics, vol. 10 n° 12, 2022, n° 2054 (https://doi.org/10.3390/math10122054).
Please subscribe to our page on Google News
SAKHRI Mohamed
SAKHRI Mohamed

I hold a Bachelor's degree in Political Science and International Relations in addition to a Master's degree in International Security Studies. Alongside this, I have a passion for web development. During my studies, I acquired a strong understanding of fundamental political concepts and theories in international relations, security studies, and strategic studies.

Articles: 15167

Leave a Reply

Your email address will not be published. Required fields are marked *