Executive Summary
Across the counter-FIMI and influence operations community, defenders attribute the same channels, map the same networks and name the same operations, and much of this work is never published. Threat actors are growing more sophisticated while defender funding shrinks, so the community can no longer afford this duplication.
The Threat Actor Mapping Methodology (TAMM) sets out a common framework for conducting, classifying and sharing threat actor attributions. It is a shared taxonomy that will let attribution data be exchanged through Alliance4Europe’s TRANSCRIPT platform.
It builds on the ADAC.IO attribution frameworks (Cardiff and Lund Universities), VIGINUM’s Information Manipulation Set (IMS) concept, EEAS FIMI reporting and the DISARM Red Framework.
TAMM proposes three taxonomies:
- Relationships: neutral, granular labels (owned, controlled, funded, supported, shared infrastructure, collaborates, service provider, systematic amplification), each marked as overt or covert. Limiting claims to relationships that can be proven reduces both room for interpretation and legal exposure.
- Influence operations: a structure linking threat actor ecosystems, threat actors, IMS, campaigns, operations, assets and behaviours. It adapts VIGINUM’s model to cases where a direct sponsor link cannot be established.
- IMS naming: a descriptive convention (Ecosystem + IMS Type) to replace today’s ad hoc names.
TAMM also sets out a mapping method built on content, behavioural, technical and financial signals and the ABCDE framework. No attribution rests on narrative alignment alone, or on a single non-technical indicator.
TAMM is published as the basis for a public consultation. Its taxonomies are proposals to be refined with practitioners.
