What Is DISARM? The DISARM Framework Explained

In short: DISARM is an open-source framework that lists the tactics and techniques used in disinformation and influence operations, so analysts can describe them in one shared language. The name stands for Disinformation Analysis and Risk Management. Modelled on the MITRE ATT&CK framework from cybersecurity, it is part of the common standard the EU and the US use to analyse foreign information manipulation and interference (FIMI).

Learn to code real cases with DISARM: start FIMI 101 → debunkacademy.org Get new FIMI analysis by email → debunk.org/subscribe

Also known as: DISARM Framework; DISARM Red Framework (the attacker techniques) and DISARM Blue Framework (the countermeasures). Formerly AMITT (Adversarial Misinformation and Influence Tactics and Techniques).

Key facts

• DISARM stands for Disinformation Analysis and Risk Management and is maintained by the DISARM Foundation.

• DISARM began in 2019 as AMITT, developed under the MisinfoSec Working Group and the Credibility Coalition, and took the name DISARM in late 2021, when the DISARM Foundation was created.

• The DISARM Red Framework lists 391 techniques (103 techniques and 288 sub-techniques) under 16 tactics, grouped into four phases: Plan, Prepare, Execute and Assess (version 1.6.1, checked October 2026).

• The DISARM Blue Framework lists 140 countermeasures that defenders can use.

• On 31 May 2023 the EU and the US named DISARM, together with the STIX data standard and the OpenCTI platform, as their common standard for analysing and sharing FIMI information.

• The EEAS has used DISARM to classify FIMI tactics since its 1st FIMI Threat Report (February 2023), calling it "currently the only framework" that met all its criteria.

• Debunk.org analysis of Operation Overload emails received, September 2023 – July 2026: the operation re-sent the same attachments from different throwaway accounts, which DISARM codes as T0084 (Reuse Existing Content) and T0128.001 (Use Pseudonyms).

Updated October 2026 · By Debunk.org, an independent non-profit that researches disinformation

Contents: What is DISARM? · Where DISARM comes from · How DISARM is organised · Red and Blue frameworks · DISARM in practice: real cases · Who uses DISARM · How to use DISARM · DISARM, ABCDE and STIX · Limits · More methodology guides · FAQ · Sources

What is DISARM?

DISARM is an open-source catalogue of the tactics, techniques and procedures (TTPs) used in disinformation and influence operations, with a code for each one.

Instead of describing an operation in loose terms ("they used fake accounts"), an analyst using DISARM can write T0128.001 Use Pseudonyms or T0049 Flood Information Space. Everyone who knows the framework understands what was observed, in any language, and the codes can be counted and compared across cases and countries. [1][2]

The EU's diplomatic service (EEAS) describes DISARM as "an open-source framework designed for describing and understanding the behavioural parts of FIMI/disinformation". [3] That focus on behaviour is the point: DISARM records how an operation works, not whether a claim is true or who is behind it.

Get new FIMI analysis by email. debunk.org/subscribe

Next: pair DISARM with the ABCDE framework to structure a whole case.

Where DISARM comes from

DISARM grew out of AMITT, a framework built in 2019 by misinformation and security researchers who borrowed the structure of MITRE ATT&CK, the standard catalogue of cyberattack techniques.

• 2019: AMITT (Adversarial Misinformation and Influence Tactics and Techniques) is created under the MisinfoSec Working Group and the Credibility Coalition. [4]

• Merger: teams from MITRE, Florida International University and CogSecCollab merged AMITT with SPICE, another technique catalogue; the framework's style "is based on the MITRE ATT&CK framework". [2]

• Late 2021: the framework is renamed DISARM and the DISARM Foundation is set up to maintain it. [1]

• 2023: the EEAS adopts DISARM in its 1st FIMI Threat Report (February) and the EU and the US name it part of their common FIMI standard (May). [3][5]

The framework is published openly on GitHub. Its licence file names Creative Commons Attribution-ShareAlike 4.0 (the project's README says CC BY 4.0). [2]

How DISARM is organised

DISARM is organised as phases, tactics and techniques: four phases contain 16 tactics, and each tactic contains specific techniques with their own codes.

The EEAS defines the three layers: tactics are "the operational goals that threat actors are trying to accomplish", techniques are "actions through which they try to accomplish them", and procedures are "the specific combination of techniques across multiple tactics… that indicate intent and may be unique for different threat actors". [6]

Source: DISARM Red Framework, tactics index (v1.6.1). [2] Tactic codes TA03 and TA04 are no longer used.

How to read a code: T0087 is a technique (Develop Video-Based Content, under Develop Content). A code with a decimal, such as T0128.001 (Use Pseudonyms), is a sub-technique of T0128 (Conceal Information Assets). The Red Framework has 103 techniques and 288 sub-techniques. [2]

Red and Blue frameworks

The DISARM Red Framework describes what influence operators do; the Blue Framework describes what defenders can do about it.

Source: DISARM Foundation, GitHub repository. [2]

DISARM in practice: real cases

Debunk.org codes the operations it profiles with DISARM, so readers can compare them technique by technique.

Sources for each row are on our profiles of Operation Overload, Doppelganger and the Pravda network. [7]

The same codes recur across operations. That is DISARM's value: it shows that Doppelganger and Operation Overload both rely on impersonating real media, even though they are run differently.

Who uses DISARM?

DISARM is used by the EU's diplomatic service, by national agencies such as France's VIGINUM, and by researchers and fact-checkers who share data on influence operations.

• The EEAS classifies tactics in its annual FIMI threat reports with DISARM. Its 1st report (2023) called DISARM "currently the only framework that fulfils all of the above criteria", and its 4th report (2026) still cites DISARM technique codes. [3][8]

• The EU and the US agreed on 31 May 2023, at the Trade and Technology Council, that their common standard for FIMI "is comprised of the DISARM framework, the STIX standard and the OpenCTI platform". [5]

• VIGINUM, France's agency against foreign digital interference, publishes a French version of DISARM and machine-readable data on operations such as Portal Kombat and Matriochka. [9]

• Researchers and fact-checkers, including the network behind the FIMI-ISAC's 2024 European election case studies, which Debunk.org summarised. [10]

How to use DISARM: 5 steps

To code a case with DISARM, list what you observed, match each behaviour to the closest technique, and keep the evidence next to each code.

1. Describe what you saw in plain words, with dates and links (archived).

2. Find the tactic: was the operation preparing (creating accounts, content) or executing (posting, amplifying)?

3. Pick the most specific technique in that tactic; use a sub-technique if one fits exactly.

4. Record the evidence for each code: the screenshot, link or report that shows it.

5. Note the framework version you used, because codes can change between versions.

The ABCDE framework is a good way to organise the rest of the report around the codes, and STIX is the format for sharing it as data.

Practise DISARM on real cases. FIMI 101 has a full session on the DISARM framework, alongside ABCDE and open-source checks. → Start FIMI 101

DISARM, ABCDE and STIX: how they fit together

DISARM names the techniques, ABCDE structures the analysis of a case, and STIX turns the result into data that others can import.

The EEAS combines all three in its threat reports. [8] Our What is FIMI? page explains the wider concept.

Limits of DISARM

DISARM describes behaviour; it does not prove who is behind an operation or how much harm it did.

• Not attribution: two unrelated operations can use the same techniques. Who is responsible is a separate judgement, explained on our page on attribution and confidence levels.

• Not impact: a technique being used says nothing about its reach.

• Judgement calls: different analysts may code the same behaviour differently; recording the evidence for each code makes the choice checkable.

• Changing versions: techniques are added and reorganised; cite the version you used.

More methodology guides from Debunk.org

DISARM is one of several tools analysts combine; these guides cover the rest of an investigation.

• The ABCDE framework: structure a whole case in five questions.

• The Breakout Scale: rate how far an operation spread.

• STIX for FIMI: share DISARM-coded findings as data.

• Bot farms and troll farms: how fake-account networks work and 10 signs to spot them.

• OSINT investigation techniques and 19 free OSINT tools we tested.

• Who owns a website when WHOIS is private?

• How to spot AI images and deepfakes

FAQ

What is DISARM? An open-source framework that catalogues the tactics and techniques of disinformation and influence operations, so analysts can describe them with shared codes.

What does DISARM stand for? Disinformation Analysis and Risk Management.

Who created DISARM? It grew out of AMITT (2019), developed under the MisinfoSec Working Group and the Credibility Coalition, and is now maintained by the DISARM Foundation, set up in late 2021.

What is the difference between DISARM and MITRE ATT&CK? MITRE ATT&CK catalogues cyberattack techniques; DISARM applies the same structure to influence operations and disinformation.

Is DISARM free to use? Yes. It is published openly on GitHub under a Creative Commons licence.

What is a TTP? Tactics, techniques and procedures: the goals of an operation (tactics), the actions used to reach them (techniques) and the combinations typical of a particular actor (procedures).

Written by Debunk.org. Updated October 2026. Debunk.org is an independent non-profit that researches disinformation and FIMI and an EU Digital Services Act trusted flagger.

Sources

1. DISARM Foundation, A brief history of DISARM. https://www.disarm.foundation/brief-history-of-disarm (accessed 22 Oct 2026)

2. DISARM Foundation, DISARMframeworks repository (README, LICENSE, tactics, techniques and counters indexes), tag v1.6.1. https://github.com/DISARMFoundation/DISARMframeworks (accessed 22 Oct 2026)

3. EEAS, 1st EEAS Report on Foreign Information Manipulation and Interference Threats: Towards a framework for networked defence, 7 February 2023, glossary and p. 29. https://www.eeas.europa.eu/eeas/1st-eeas-report-foreign-information-manipulation-and-interference-threats_en (accessed 22 Oct 2026)

4. CogSecCollab, AMITT repository. https://github.com/cogsec-collaborative/AMITT (accessed 22 Oct 2026)

5. EEAS, TTC Ministerial: Foreign Information Manipulation and Interference in Third Countries, 31 May 2023. https://www.eeas.europa.eu/eeas/ttc-ministerial-foreign-information-manipulation-and-interference-third-countries_en (accessed 22 Oct 2026)

6. EEAS, 4th EEAS Report on FIMI Threats: Dismantling the FIMI House of Cards, 12 March 2026, glossary ("TTPs"). https://www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en (accessed 22 Oct 2026)

7. Debunk.org profiles of Operation Overload (https://www.debunk.org/operation-overload-debunk-org-s-case), Doppelganger and the Pravda network, each with its own sources.

8. EEAS, 4th report (March 2026), as [6].

9. VIGINUM, Rapports techniques repository (STIX data and DISARM-FR). https://github.com/VIGINUM-FR/Rapports-Techniques (accessed 22 Oct 2026)

10. Debunk.org, 2024 Elections: Case Studies of Foreign Information Manipulation and Interference in EU, 22 October 2024. https://www.debunk.org/2024-elections-case-studies-of-foreign-information-manipulation-and-interference-in-eu