The Grievance Catalog: Why Your Population's Pain Is Already on File
Adrian Alexandru Stinga | Lead Analyst, Aether Intel | June 2026
A grievance, once catalogued by a hostile actor, has already become a munition. Only the firing date remains undecided.
That's the conclusion of nearly two decades of monitoring Eastern European and Russian-speaking underground ecosystems. And it changes how we should think about hybrid threats entirely.
This Is Not a Propaganda Problem. It Is a Memory Problem.
We keep treating foreign influence operations as campaigns bounded events with a beginning, a peak, and an end. That framing is convenient for media reporting and political response. It is also wrong.
What I've observed since 2014 is not a sequence of campaigns. It is the continuous operation of an archive. A slow, patient, distributed accumulation of human pain — harvested from open social media, regional news comments, closed Telegram groups, and protest movement chats — indexed, tagged, mirrored, and held ready for activation.
The archive doesn't generate the crisis. It waits for the crisis and redirects it.
I watched material being filed in 2014 and 2015. I assumed it had a half-life that grievances not used quickly would expire and lose their emotional charge. That is not what happened. I've seen the same testimonies, sometimes the same screenshots, redeployed in 2022 and 2023 with their original emotional charge fully intact.
A grievance, properly catalogued, does not age. It waits.
How the Catalog Works
The architecture is deceptively simple. Four layers, none of which require sophisticated tooling or formal organisation.
Layer 1 - Harvest. Open social media, news comment sections, closed groups, protest chats. The harvesters don't know they're harvesters. They're reading, screenshotting, saving things they find interesting.
Layer 2 — Tagging. Material gets reposted into working threads, categorised by grievance type, region, demographic, exploitability. The taggers think they're having a conversation.
Layer 3 — Storage. Pinned threads, screenshot folders, secondary channels, cross-posted to ensure no single takedown kills the archive. The mirrorers think they're preserving something valuable.
Layer 4 — Activation. Pulled into messaging products, talking points, or used as a lens to identify individuals for future recruitment. Only at this layer is professional intent visible and by then the work of the first three layers was already done, for free, by people who would never describe what they were doing as intelligence collection.
The cost of building this archive is patience, language fluency, and an absence of scruples about treating other people's pain as a resource.
Five Categories of Pain, Faithfully Indexed
Across the ecosystems I've monitored, five grievance types account for the vast majority of catalog content. They're harvested in parallel and activated based on which external trigger arrives first.
Ethnic and minority tensions activated around local crime stories, school policy changes, census debates.
Economic inequality and class resentment activated around energy price spikes, inflation reports, pension reforms.
Religious and confessional divisions activated around religious anniversaries, clerical controversies, legal cases.
Historical wounds and unresolved past activated around commemoration disputes, border tensions, revisionist controversies.
Anti-institutional and anti-elite sentiment activated around corruption cases, institutional scandals, sovereignty debates.
When a coordinated network can activate across all five categories simultaneously, the preparation was done years in advance by people who understood each terrain well enough to file it correctly.
From Population Archive to Individual Targeting
Here's where it gets personal. The grievance catalog is not only a messaging tool. It is a recruitment tool.
Individual posts, accumulated over time, reveal the contours of a person their wounds, their loyalties, their resentments, their financial pressures. For an actor patient enough to read the archive longitudinally, the result is a low-cost behavioural dossier on people who never consented to be profiled.
I observed the same operators tagging grievance material also flagging individual authors for future contact. The vocabulary was basic — variants of "useful," "approachable," "angry enough," "locally credible" but the discipline was consistent.
The catalog of grievances and the catalog of exploitable individuals are not separate products. They are two views of the same dataset. This is the point where information operations become intelligence operations — and where data protection and national security genuinely converge.
The Asymmetry Defenders Haven't Solved
The core problem is not resources. It is memory horizon.
The adversary's catalog operates on a decade-plus timeline. Entries from 2014 are still operationally live in 2026. Western defender institutions operate on budget cycles, political cycles, and personnel rotations. Lessons learned in one crisis are forgotten 24 to 36 months later when the team rotates.
An adversary who remembers versus a defender who moves on that asymmetry is the structural condition under which everything else in the hybrid environment plays out.
Defender responses framed around incident, campaign, and attribution will continue to win battles and lose the longer contest. The catalog operates on a decade horizon. Any defender posture organised on shorter horizons concedes the strategic terrain by default.
What Needs to Change
The answer is not to mirror adversarial tradecraft. Defender institutions cannot and should not maintain catalogs of their own populations' pain. The answer is to build analytical capability whose institutional memory survives the political and personnel cycles that currently bound it.
EU EEAS, NATO StratCom COE, EU DisinfoLab, and national counter-disinformation units are the right starting institutions. The question is whether their mandate, budget, and continuity match the time horizon of the adversary.
The lesson of nearly two decades of direct observation: wounds are not weapons by themselves. They become weapons when someone with patience writes them down.
The full report (GN-069, TLP:CLEAR) is available at aether-intel.com as part of the GREY NEXUS series (GN-061 through GN-070).
Adrian Alexandru Stinga is the founder and Lead Analyst of Aether Intel, an independent Cyber Threat Intelligence practice based in Brașov, Romania, specialising in Eastern European and Russian-speaking underground ecosystems, HUMINT tradecraft, behavioral analysis, and nation-state/hybrid warfare intelligence.*
Top comments (0)