Intelligence

What is False flag?

Deliberately planting evidence, such as code, language or tools, that points investigators toward someone else.

A false flag is evidence planted to make an operation look like someone else's work: borrowed malware, foreign-language strings, copied infrastructure patterns or claims posted under another group's name.

False flags are why careful analysts weigh many independent lines of evidence and state confidence explicitly. A single striking clue, especially one that is easy to fake, should never carry an attribution on its own.

Where you learn it

See False flag in a real investigation

Our missions put you in front of real logs, domains and forums, with these terms underlined where they appear.

Start learning free