You Are Already In It: How Cognitive Warfare Reaches Ordinary People And Where the Dark Web Quietly Feeds It
Part three of the Cognitive Warfare series. Part one mapped the convergence of influence operations and the underground economy. Part two forecast where the next wave lands first the Eastern Flank. This piece brings it down to the level that actually matters: your feed, your family, the people you know. This is not the last installment; the series continues next month.
The first two parts of this series operated at altitude supply chains, state-aligned actors, forecast tempo. This one comes down to ground level, because that's where cognitive warfare actually lives. Not in a briefing room. In a phone held by someone scrolling before bed.
Here is the uncomfortable truth I've arrived at after monitoring this region for years: almost everyone on the Eastern Flank at least everyone in the environments I watch is exposed to cognitive warfare, and almost none of them know it. It doesn't feel like being attacked. It feels like watching a video. That's the entire point.
The Feed Is the Battlefield
Cognitive warfare found its ideal delivery system in the short-video platforms TikTok, Instagram, Facebook because those platforms are built to reward exactly what an influence operation needs: emotional content, fast sharing, and an algorithm that doesn't care whether something is true, only whether it holds attention. An operation doesn't have to defeat your judgment. It has to reach you before your judgment engages, and the feed is engineered to deliver content in precisely that pre-judgment window.
This is why the old mental model of "propaganda" fails people. Most of us picture a hostile broadcast, an obvious enemy voice we can identify and dismiss. What actually reaches you looks like a neighbor's repost. It looks like a concerned local voice. It looks like someone in your own community who is genuinely upset. And that appearance is not an accident it's the mechanism.
The People Spreading It Mostly Aren't Agents
This is the part that most coverage of disinformation gets wrong, and it's the heart of what I want you to take from this piece.
The overwhelming majority of people amplifying an influence operation are not paid, not recruited, and not aware. They are ordinary people who genuinely believe what they're sharing. Someone builds a piece of AI-generated content designed to trigger fear or outrage, releases it into a few seeded channels, and from that point forward the operation largely runs itself because real people, moving in good faith, pick it up and pass it on. They're not lying. They think it's true. They've become unwitting distributors, and they'd be offended if you told them so.
This is the genius and the cruelty of the modern model. In the version I watched form a decade ago, an operator needed a network of controlled accounts to push a narrative. Today, a state-aligned actor only needs to launch a handful of well-crafted seed campaigns. The targeted population already primed by economic anxiety, already inclined to distrust institutions does the rest of the distribution for free, at a scale no troll farm could match, and with a credibility no paid account could buy. A message from a stranger who works for a foreign government is easy to dismiss. The same message from your cousin, who truly believes it, is not.
The structural logic is brutal: the operation succeeds precisely by turning its victims into its distribution network. The people spreading it aren't collaborators. They're casualties who feel like participants.
Where the Dark Web Actually Connects — Tier 1
Now the part that ties this back to the underground thread running through the whole series but I want to be precise about it, because the connection is real without being what most people imagine.
The dark web link here sits at what I'd call Tier 1: the acquisition layer. The state-aligned groups running these campaigns generally don't do their own hacking. This is partly capability and partly self-image many of these groups see themselves as operators, strategists, information warriors, and regard hands-on intrusion as beneath them, the work of "mere" criminals. So instead of breaking in, they buy. And what they buy is available, commoditized, and cheap on the same markets, forums, and Telegram channels I described in part one:
Aged social media accounts — established Instagram, TikTok, and Facebook profiles with real posting history and follower bases, purchased in bulk so a campaign launches from accounts that already look human and local rather than freshly created and suspicious.
Payment and monetization accounts — verified Payment Accounts and similar accounts used to fund advertising, boost posts, or move money for the operation without tying it back to origin.
Fullz and identity sets — complete personal-data packages used to age, verify, or "back" synthetic personas so they survive platform scrutiny.
VoIP and phone-verification accounts — used to pass the SMS/phone checks that platforms rely on, and to enable the spear-phishing side of an operation when a campaign needs to compromise a specific person rather than just influence a crowd.
None of this is exotic tradecraft. That's the point. The acquisition layer for a national-scale influence operation is a shopping trip through infrastructure that already exists to serve ordinary cybercrime. The groups don't build it, don't steal it themselves, and don't consider themselves criminals for buying it. They see it as procurement. The underground is simply their supplier.
I'm describing the shape of this ecosystem, not a manual for it the categories are well-documented across public threat-intelligence reporting, and knowing they exist is what lets you understand why a "grassroots" campaign can look so convincingly authentic. The authenticity was purchased.
What This Means For You, Specifically
The individual incidents don't matter as much as the shift in your relationship to your own information environment. Three things worth internalizing:
The content designed to move you will not announce itself as foreign, hostile, or coordinated. It will arrive wearing the face of your own community, because it's being carried the last mile by people in your own community who believe it. Distrusting your neighbor is not the answer but neither is assuming that emotional certainty equals truth.
The people around you who share this material are not the enemy and shouldn't be treated as one. They've been used, and treating them with contempt only deepens the polarization that the operation was designed to create in the first place. The correct response to a family member sharing a manufactured fear is not humiliation; it's a genuine question about where something came from.
And the tell is almost always emotional, not factual. Cognitive warfare works by producing a feeling fear, outrage, hopelessness, contempt faster than it produces a checkable claim. If a piece of content makes you feel certain and furious within three seconds, that reaction is the product. That's the moment to slow down, not to share.
Closing This Chapter, Not the Series
The through-line of these three parts has been a single argument: cognitive warfare and the underground economy have merged, that merger is being aimed at the Eastern Flank first, and it reaches ordinary people through their own feeds and their own trusted relationships funded quietly by an acquisition layer bought off the dark web.
The doctrine I watched form a decade ago was patient and centralized. Now it's fast, cheap, and distributed across millions of well-meaning people who have no idea they're carrying it. That's not a reason for paranoia. It's a reason for a small, permanent habit: to notice when something is trying to make you feel before it lets you think.
I'll pick the series back up next month, going deeper on the defensive side what individuals, communities, and organizations can actually do to raise the cost of these operations and blunt their reach.
Disclaimer: This article is provided for educational and situational-awareness purposes only. It reflects the author's independent analytical assessment alongside open-source, publicly reported research (TLP:CLEAR). It does not name or accuse any specific state, government, nationality, organization, or individual of wrongdoing, and attributes no activity to any named party. Descriptions of underground-market categories are provided at a general, awareness-level of detail only; nothing in this piece constitutes technical instruction, operational guidance, or a how-to for acquiring illicit goods or services or for conducting intrusion, fraud, or influence operations — no sources, methods, vendors, prices, or identifiers are provided. All external findings are drawn from and attributable to third-party public research; no proprietary, classified, or non-public information is disclosed. The views expressed are the author's own and do not constitute legal advice.
Top comments (0)