Intelligence Brief: The Disinformation Machine

Article from Digital HUMINT Series, For better understanding read the full report

Right now, somewhere on X/forum people are fighting about a post that feels real raw, emotional, perfectly worded to hit a nerve. It has the right language, the right anger, the right timing. It sounds like someone who thinks exactly the way you do, or exactly the way you hate.

It wasn't written there. It wasn't written today. And the person who wrote it doesn't care about the issue at all.

That post was created two or three days earlier, on a hidden forum or a private chat group, following a set of instructions that described who to target, what emotions to trigger, which platform to use, and how much the job pays. By the time you see it, the operation has already worked. You engaging with it for or against is the whole point.

I've spent almost two decades watching these hidden spaces where online manipulation is planned. What I've learned isn't that fake content exists everyone knows that by now. What most people don't realize is that it works like a factory. There's a production line. There are workers, managers, and paychecks. And just like any factory, if you know where to look, you can see the product being assembled before it ever reaches the shelf.

It Works Like Any Other Business

We talk about "disinformation campaigns" as if they're political movements. Some are. But more and more, what you're actually looking at is a business with four steps, each handled by different people, often in different countries.

Step 1 — Someone writes the plan. A person with a goal and a budget writes a document that says: push this story, target these kinds of people, make them feel this emotion, use this language, post it on these platforms. These plans used to appear on hidden internet forums. Many have moved to private Telegram groups, but the structure hasn't changed since I first saw it in 2014.

Step 2 — Someone hires the workers. Job ads appear on hidden forums looking for people with real-looking social media accounts, willing to post about specific topics, in specific countries, for cryptocurrency payment. These ads are surprisingly open about what the job involves. They list the platform, the country, the topic, how many posts per day, and the pay anywhere from $20 to $200 per post.

Step 3 — The content goes live. Multiple accounts post similar content within a short window, dropping it into the right online communities. This is the moment it becomes visible to the public.

Step 4 — It spreads. Paid accounts boost the content. Automated accounts pile on. And then real people people who genuinely agree with the message start sharing it because it feels true. At that point, the operation runs on its own. The people sharing it have no idea it was manufactured.

The person who wrote the plan, the person who wrote the post, the person who published the post, and the person who shared it are four different people. Often living in four different countries.

The 48 Hours Nobody Is Watching

Here's the part that should bother everyone: the best chance to stop one of these operations is not after the content appears on your feed. It's in the two or three days before it appears while the plan is being written, the workers are being hired, and the content is being prepared.

During that window, the whole operation is visible to anyone watching the right places. The plan exists. The job ads are posted. People are being recruited and paid. The network that will spread the content has been told what's coming. Everything is ready, but nothing has been published yet.

Once that window closes, it's too late for prevention. You're just trying to clean up the mess while more content keeps coming. And that's exactly what most organizations tasked with fighting this problem are doing they're watching social media for fake content after it's already out there. They're looking at the finished product, not the factory.

The job ads alone tell you almost everything you need to know. An ad looking for English-speaking accounts, focused on election-related content, targeting a specific country, paying in cryptocurrency, posted a few weeks before an election that's not hard to interpret. It's a clear warning sign with specific details about what's coming. The challenge isn't understanding what it means. The challenge is that almost nobody is looking at the forum where it was posted.

What I Saw Change Over 12 Years — and What Stayed the Same

I first saw this system in action during the 2014–2015 period, monitoring hidden forums connected to the conflict in Eastern Ukraine. The instructions were crude open messages telling people what to post, where, and to whom. The people posting these instructions didn't think anyone outside their circle was reading them.

What surprised me then, and still surprises me now, is that the basic system hasn't changed in twelve years. The steps are the same. The timing is the same. The logic is the same.

What has changed is the tools. AI now writes content that used to take human writers hours. Cryptocurrency replaced bank transfers, making payments harder to trace. Telegram replaced some of the old forums for planning. TikTok got added to the list of target platforms. The factory is the same it just has better equipment.

The one change that actually makes a difference is that the planning stage has partly moved from open forums to private chat groups. Forums, even hidden ones, can be monitored by anyone who gains access. Private groups are much harder to watch. But the hiring stage — the job ads looking for people to post — still happens on forums, because you need to reach a wide pool of workers. That part of the process is still visible if you know where to look.

What This Means for You

If you're just someone who uses social media which is most of us the takeaway is simple. The content that triggers your strongest reaction, that perfectly matches your frustration or your fear, that sounds like someone finally saying what everyone is thinking that content may have been designed to feel exactly that way. Not by an algorithm. By a person with a plan and a budget, who identified people like you as the target and your specific worry as the way in.

It doesn't mean every post that makes you angry is fake. It means the posts that feel the most perfectly crafted to push your buttons deserve a second look. A pause. A moment of asking: who benefits if I share this right now?

The factory is real. The production line is running. And by the time you're arguing about the product on your timeline, the person who ordered it has already moved on to the next batch.

This short article is part of my Digital HUMINT Series.

This article is based on findings from report OT-045, "The Disinformation Supply Chain," published by Aether Intel (aether-intel.com). The full report includes the complete production-line framework, technical mapping, detection methods, and twelve years of evolution analysis. Available for free at aether-intel.com.