DISINFORMATION CAMPAIGNS IN UKRAINE: A STRUCTURING METHODOLOGY BASED ON THE DISARM FRAMEWORK AND THE OPENCTI PLATFORM
DOI:
https://doi.org/10.28925/2663-4023.2026.34.1255Keywords:
disinformation campaign;, methodology;, structuring;, framework;, open platform;, graph method;, big data;, visualization;, artificial intelligence.Abstract
With the onset of full-scale Russian aggression in Ukraine, the enemy’s aggressive use of the digital environment has evolved from isolated propaganda acts to the orchestration of powerful disinformation campaigns. This necessitates the development and implementation of standardized data structuring methodologies based on threat intelligence tools, specifically the DISARM framework and the OpenCTI platform. The aim of this article is to develop and scientifically substantiate a methodology for structuring disinformation campaigns through the lens of DISARM tactics and techniques, utilizing the knowledge graphs of the OpenCTI platform, based on an analysis of experimental data regarding the internal destabilization of society and the discrediting of Ukrainian military personnel.
The study utilized: general scientific theoretical methods, such as systems analysis and the abstract-logical method, to make theoretical generalizations and formulate conclusions and recommendations regarding the structuring of disinformation campaigns; the clustering method—to identify the most powerful disinformation campaigns in the first half of 2025; and the graph method—to visualize and analyze the structure of the network of disinformation incidents.
The application of graph theory to construct structural graphs of disinformation campaigns enabled the authors to map the architecture, topology, and dynamics of disinformation dissemination in Ukraine’s information space, while STIX Visualizer provided the ability to view the constructed graphs online. For the identified disinformation campaigns, the most common channels and web resources that systematically served as sources or key nodes for the dissemination of disinformation messages were identified. The use of the Gephi software tool made it possible to visualize the results of the graph analysis and investigate the architectures of disinformation message dissemination. Compared to the use of AI-based systems, Gephi allows researchers to more conveniently map out paths for further research and eliminates the hallucination errors that can be made by AI-based tools.
Downloads
References
Bârgăoanu, A., & Pană, M. (2024). Cyber influence defense: Applying the DISARM framework to a cognitive hacking case from the Romanian digital space. Applied Cybersecurity & Internet Governance, 3(1), 91-121. https://doi.org/10.60097/ACIG/190196
Prysiazhniuk, M. (n.d.). DISARM framework – "Mendeleev's table" of information operations and campaigns. ATHENA. https://project-athena.eu/disarm-framework-mendeleevs-table-of-information-operations-and-campaigns/
González, F. S., Pastor-Galindo, J., & Ruipérez-Valiente, J. A. (2025). Toward interoperable representation and sharing of disinformation incidents in cyber threat intelligence (arXiv:2502.20997). arXiv. https://doi.org/10.48550/arXiv.2502.20997
Niven, T. S., & Li, C.-T. (2026). Automatic tagging of foreign information manipulation and interference incidents with DISARM tactics, techniques, and procedures. IEEE Access, 14, 6364-6377. https://ieeexplore.ieee.org/document/11343758
Tseng, K., Toledano, J. C., & Dukach, B. De C. Yu. (2026). An agentic operationalization of DISARM for FIMI investigation on social media (arXiv:2601.15109). arXiv. https://arxiv.org/abs/2601.15109
Antagonistic information threats: Lessons from Ukraine. (2026, March 16). Policy Brief. https://freepolicybriefs.org/2026/03/16/antagonistic-information-threats/
Nosov, V., & Stetsyk, R. (2026). Cases of disinformation about Ukraine detected in the second half of 2025 [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19355384
Nosov, V., & Stetsyk, R. (2026). Systematised results of the analysis of the campaign "Destabilisation of Ukrainian civil society and the formation of internal support for the war among Russian audiences" for the second half of 2025 [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19355791
Nosov, V., & Stetsyk, R. (2026). Systematised results of the analysis of the campaign "Discrediting Ukrainian military personnel" for the second half of 2025 [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19356201
Nosov, V., & Stetsyk, R. (2026). STIX file of the disinformation campaign "Destabilization of Ukrainian civil society and the development of internal support for the war among the Russian audience" for the second half of 2025 [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19906835
Nosov, V., & Stetsyk, R. (2026). STIX file of the disinformation campaign "Discrediting Ukrainian military personnel" for the second half of 2025 [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19906470
Stetsyk, R., & Nosov, V. (2026). Distribution of disinformation posts across online platforms within the graph dataset "Destabilization of Ukrainian civil society and the development of internal support for the war among the Russian audience" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19907720
Stetsyk, R., & Nosov, V. (2026). Distribution of disinformation posts across online platforms within the graph dataset "Discrediting Ukrainian military personnel" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19664075
Stetsyk, R., & Nosov, V. (2026). Frequency of involvement of online platforms in the dissemination of disinformation by the number of incidents within the graph "Destabilization of Ukrainian civil society and the development of internal support for the war among the Russian audience" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19896612
Stetsyk, R., & Nosov, V. (2026). Frequency of involvement of online platforms in the dissemination of disinformation by the number of incidents within the graph "Discrediting Ukrainian military personnel" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19886629
Stetsyk, R., & Nosov, V. (2026). Most disseminated disinformation incidents and their primary sources (URL) within the graph "Destabilization of Ukrainian civil society and the development of internal support for the war among the Russian audience" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19898023
Stetsyk, R., & Nosov, V. (2026). Most disseminated disinformation incidents and their primary sources (URL) within the graph "Discrediting Ukrainian military personnel" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19888831
Stetsyk, R., & Nosov, V. (2026). Shared participation of online platforms in disinformation incidents within the graph "Destabilization of Ukrainian civil society and the development of internal support for the war among the Russian audience" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19898257
Stetsyk, R., & Nosov, V. (2026). Shared participation of online platforms in disinformation incidents within the graph "Discrediting Ukraine in the international arena" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19894895
Stetsyk, S., & Nosov, V. (2026). Most common disinformation channels and websites within the graph "Destabilization of Ukrainian civil society and the development of internal support for the war among the Russian audience" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19905646
Stetsyk, S., & Nosov, V. (2026). Most common disinformation channels and websites within the graph "Discrediting Ukrainian military personnel" (second half of 2025) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.19895231
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Віталій Носов, Олександр Манжай, Світлана Лучик, Роман Стецик, Костянтин Садовий
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
