An operation designed to deflect attribution to an uninvolved party. A cyber operation would be a false flag if the threat actor behind it took steps to impersonate or use the distinctive infrastructure, tactics, techniques, or procedures of some other threat actor. The OlympicDestroyer cyberattack against the 2018 PyeongChang Winter Olympic Games is widely regarded as having been a false flag operation in which Russia’s GRU designed its attack to appear as if had been the work of North Korea.
