In a reversal of conventional scientific reasoning, the evidence against conspiracy theories is often construed as evidence for them, because the evidence is interpreted as arising from the conspiracy in question.

Conspiracy Theories are commonplace today. Or more importantly, they were always there but now they have become mainstream.

People – including conspiracy theorists themselves – just write off these beliefs as “crazy.” However, they can potentially cause lasting damage.

The psychology behind conspiracy theories and why people cling to them is so important but often overlooked. We should know how to tackle this, but we do not yet.

Many argue that we were so complacent when it comes to conspiracy theories that it allowed Donald Trump to win support and end up becoming President. We underestimated the influence then, and probably still is now.

Vulnerable people are more likely to believe these theories, so we must ensure we do not downplay influence and we highlight the risks associated with them.

Although the internet has allowed for theories to spread more quickly and more widely, it also allows us to be more critical of what we read and believe.

Conspiracy theories have been around for centuries. In the last few decades, their influence has remained much the same, despite them seeming more widespread.


This course combines certain aspects of our cyber intelligence, counterintelligence, influence operations, and cyber operations development training. The course follows traditional tradecraft within the intelligence and counterintelligence domains while including near-current influence operations focusing on disinformation with conspiracy theories, and the rapid constitution of hacktivist and proxy cyber operations groups. This is an intense course that covers six days of training and hands-on case studies. We need six days to cover the material, address case study needs, and see a level of results from planning execution. The course works in a live online environment using operational security mechanisms to maintain anonymity. Laptops must have administrative access. Prior to class, an open-source install list is provided to enrolled students. PCs work best or VMs running Windows software.

Some of the areas we cover:

  • Operational Security – maintaining anonymity online
  • Rapid persona creation for monitoring
  • Cyber Militia RoE –
  • D3A/F3EAD Target acquisition and exploitation
  • Rapid Training
  • Militia Members Levels of Expertise
  • Point and Shoot
  • Cyber Foreign Legion RoE
  • Socio-cultural / Geopolitical analysis
  • Strategic Dimensions of the Adversary
  • Counter Planning
  • Adversary Targeting Phase – Cyber battlefield(s)
  • Cyber dead drops and covert coms
  • Infiltration and elicitation
  • When you are infiltrated
  • Targeting for trolling
  • Adversary courses of action
  • Adjust your fire
  • A Cyber Foreign Legion
  • Needs – How – Levels of Trust
  • Switch to the alternative ‘frequency’
  • Setting up a crowdsourced-enabled offensive arsenal
  • Weaponizing content
  • Disinformation
  • Need for Polarization (or not)
  • Control the Narrative / Wag the Dog
  • Adjust and Shift

The course is a hybridized intelligence and counterintelligence course geared towards executing cyberspace operations through structured methods. Students gain practical hands-on skills in cyber militias and foreign legions, space operations, weaponizing conspiracy theories, using disinformation to control narratives, jihadist online operations and locations, and cryptocurrency scams and cash-out schemes, non-inclusively. The course concludes with a program maturity review, competency models for analysts and collectors, and a maturity tracking model for goals and objectives based on the maturity assessment.


  • Anonymity and Passive Persona setup – Clandestine Cyber HUMINT
  • Glossary and Taxonomy
  • Operational Security – OPSEC
  • What Intelligence Can and Cannot Do
  • Open-Source Intelligence Techniques and Tools
  • OSINT Tools for Data Manipulation
  • Stakeholder Analysis
  • Intelligence Requirements to PIRs
      • Strategic Intelligence Analysis
      • STEMPLES Plus – Hofstede Principles – Indicators of Change
      • Strategic Cyberspace Operations
      • Influence Operations
      • Counter-Influence Operations
      • Enhanced Situational Awareness
      • Space Operations
  • Adversary Targeting – D3A F3EAD
  • Time Sensitive Targeting
  • Collection Methods and Techniques
  • Collection Planning, IRs/PIRs/EEIs/Indicators/SIRs
  • Collection Process Flow – Collection (OSINT) Tools and Targeting
    • Identification and collection of adversary handles and relative data – OSINT / darknet / social media
    • Adversary Denial and Deception
    • Data assessment and analysis
    • Deception detection – Counter-deception planning and execution
    • Course of Action Decision Points
    • Offensive Cyberspace Operations Through Narrative Control
  • and Use of Maltego – overview
  • Darknet Sites of Interest
      • Social Media – Off the beaten path review of social media platforms not in the mainstream
      • Adversary use of social media for social engineering
        • Jihadist Sites and where to find them
          • Burn phones
          • Virtualbox
            • Plugins and Use
            • Open Semantic Search – Oracle Virtual Box – OVA setup – Tracelabs
            • Android emulation
          • Portable Social Media
        • Cryptocurrency Scams
          • Cash-out schemes
          • Wallet tracking
          • Social media campaigns
  • Intelligence Lifecycle Production Methods
  • Structured Analytic Techniques – Their use – Case Study – ACH
  • Extended Structured Analytic Techniques – In-depth coverage
  • Source Credibility and Relevance – The real NATO Admiralty Scoring – CRAAP Tool for Relevance
  • Source Validation – Confidence Levels
      • Disinformation and Conspiracy Theories
      • Fake, Beyond Fake, and the Misinformation Matrix
      • Memetic Warfare
      • Patient Cyber Psyops
      • Identification, Glossary, Targeted Terminology
      • Understanding People – Cognition
      • Terms targeting YOU – The Dunning-Kruger
      • Trolls and the Dark Triad
      • The Pitch-Black Tetrad
      • Weaponizing the Message
      • Tribalism and Cultism
      • Cialdini and Social Psych
      • Vaxx Schedders
  • Types of evidence
  • Production Management
    • Creating and using cyber militias
    • Rapid Training
    • Militia Members’ Levels of Expertise
    • Point and Shoot
    • Cyber Foreign Legion RoE
    • Cyber dead drops and covert coms
    • Targeting for trolling
    • Adversary courses of action
    • Adjust your fire
    • Cognitive Warfare
    • A Cyber Foreign Legion
  • Critical and Creative Thinking
  • Cognitive Bias
  • Analysis and Analytic Writing
    • Team Maturity Assessment
    • Skill and Competency Levels
    • Goals and Objectives – Rapid Creation
  • Class Review and Wrap-up

Validated and registered students will receive login and preparation information 1 week prior to class start.

Corporate accounts are not Gmail, Hotmail, Yahoo, Mail, Hushmail, Protonmail, and the like). Treadstone 71 reserves the right to restrict course registration based upon certain risk factors. This course presents the student with foundational concepts and processes in the discipline of cyber counterintelligence with a focus on cyber counterintelligence missions, defensive counterintelligence, offensive counterintelligence, and counterespionage as these realms apply to traditional tradecraft, and how they are or will evolve into the cyber domain. The course includes a very different approach to counterintelligence using models exhibited online over the past few years to steer the conversation to the desired outcome


Register at full price and Treadstone 71 pays up to $200/night for six nights hotel and gives you $500 back towards travel when you arrive at the training.

Online as well – Registration runs on-demand as defined on the main Cyber Intelligence Training Center registration page. The online courses are instructor video and audio recorded with periodic direct interaction with the instructor via online web meetings. The instructor will have standard office time for question and answer as well as regular access via class email and other messaging options.

As technology constantly and rapidly changes, so does the way our information is attacked and gathered. Society is being shown, that not only in the cyber realm but in human intelligence gathering, the lengths people will go to obtain information. Treadstone71 Cyber Intelligence training courses allow professionals on all levels, the ability to learn methods, techniques, and tools; to not only collect information, but to recognize and counter the gathering, analytics, and critical thinking skills used in intelligence and denial, and deception. The hands-on case studies, scenarios, and team presentations in our cyber intelligence training courses provide the ability for the extensive comprehension necessary to strengthen both your personal and professional intelligence capabilities.



Cyber Intelligence Tradecraft –  Certified Intelligence Analyst from Treadstone 71 – Contact us directly for group discounts. New locations coming soon!


Analytic Writing
Building a Cyber Intelligence Program
Certified Cyber Counterintelligence Analyst – Influence Operations
Certified Cyber Intelligence Analyst
Critical Thinking and Cognitive Bias
Cyber Militias – Rapid Organizing and Execution Against Nation-State Aggression
Intelligence and CounterIntelligence – Cyberspace Lifecycle and Operations
Online – Basic Cyber Intelligence Tradecraft
Online Advanced Cyber Intelligence Tradecraft
Online Analytic Writing (Reporting and Briefs)
Online Certified Cyber Counterintelligence Analyst
Online Critical Thinking and Cognitive Bias for Cyber Intelligence
Online Intermediate Cyber Intelligence Tradecraft
Online Strategic Intelligence Analysis
Online Strategic Intelligence Analysis Plus Building and Enhancing Your CTI Program
Online Threat Hunting with TaHiTI and MaGMa
Strategic Intelligence Analysis
Structured Analytic Techniques


By Treadstone 71

@Treadstone71LLC Cognitive Warfare Training, Intelligence and Counterintelligence Tradecraft, Influence Operations, Cyber Operations, OSINT,OPSEC, Darknet, Deepweb, Clandestine Cyber HUMINT, customized training and analysis, cyber psyops, strategic intelligence, Open-Source Intelligence collection, analytic writing, structured analytic techniques, Target Adversary Research, strategic intelligence analysis, estimative intelligence, forecasting intelligence, warning intelligence, Disinformation detection, Analysis as a Service