Sock Puppets – Creating Fake Identities for In-Depth Recon

I. Create or purchase an identity for Passive Collection

Once done with crafting a puppet, it’s time to perform some passive collection of data and information through profile scraping for mapping target’s digital footprint (emails, domains), forum monitoring by tracking discussions on reddit, social media archiving and metadata extraction. The entire process of passive collection should be done through VPN or puppet’s VM to avoid attribution.

II. Building Credibility

Credibility depends on progressive trust accumulation through consistent behavior, value delivery, social proof, and to establish presence without raising red flags. It may take 3-8 weeks (depending on target sensitivity).

• Connect with people in the targeted industry using LinkedIn and add at least 5-10 connections everyday (mix of bots or real users) to establish professional legitimacy.
• Engage with posts and repost or retweet industry news and articles (avoid political debates) or write your own if possible.
• Join relevant groups and follow industry accounts to be appeared as a genuine learner or observer.
• Make your activity rhythm by posting 2-3 times a week.

Perform some credibility boosting actions including resource sharing, micro help by answering simple questions, and controlled leaks to become a minor asset to the community. Avoid making connection with target immediately.

III. Intelligence Gathering

• The goal is to extract high-value information while maintaining puppet credibility and anonymity.
• It is an active elicitation using social engineering methods like phishing are used to extract internal information (via puppet email address or LinkedIn).
• Build trust by help solving minor problems in communities.
• Advanced elicitation technique involve reverse social engineering: puppet accidentally leaks fake credentials to monitors who uses them.