Intelligence Integration Training Module
0%
Intelligence Fusion Training Guide — Module MIF-01

Multi-Source Intelligence Correlation & Fusion

A comprehensive reference covering all intelligence collection disciplines — SIGINT, IMINT, MASINT, OSINT, HUMINT, GEOINT, ELINT, and CYBER INT — what each data type represents, how it is collected and processed, and the joint fusion workflows that turn disparate observations into actionable intelligence products.

8
INT Disciplines
12
Joint Workflows
7
Fusion Diagrams
64
Correlation Pairs
Explore INT Types ↓
4
Fusion Layers
3
Classification Tiers
28
Sensor Classes
<15s
SIGINT Geolocate Latency
0.3m
GEOINT GSD (NTM)
JDL L4
Highest Fusion Level
NATO
Standards Body
PED
Exploitation Model
01 — Intelligence Disciplines
The Eight Core INT Collection Disciplines

Each discipline collects fundamentally different phenomenology. Understanding what data each type actually measures — and critically, what it cannot see — is the prerequisite for effective multi-source fusion.

📡
Signals Intelligence
SIGINT — COMINT / ELINT / FISINT
Collection and exploitation of electromagnetic emissions — voice communications, data links, radar signals, telemetry. Provides behavioral indicators, order-of-battle, and technical parameters of adversary systems.
◉ Behavioral & Electronic
🛰
Imagery Intelligence
IMINT — EO / IR / SAR / MSI / HSI
Analysis of images acquired by satellite, airborne, or UAS sensors across visible, infrared, and microwave spectra. Provides physical disposition, activity indicators, and change detection for facilities and forces.
◉ Spatial & Spectral
🔬
Measurement & Signature Intelligence
MASINT — RADINT / NUCINT / CBRINT / ACINT
Intelligence derived from quantitative and qualitative analysis of physical attributes: radar cross-section, nuclear yield, chemical effluent, acoustic signatures. The deepest phenomenological discipline — detects what other INTs cannot characterize.
◉ Physical Phenomena
🌐
Open Source Intelligence
OSINT — WEBINT / SOCMINT / GEOSINT / FININT
Systematic collection and processing of publicly available information: news media, academic publications, commercial imagery, financial filings, social media, and web-scraped data. The volume tier — 80–90% of actionable context in many analytical products.
◉ Contextual & Volume
🕵
Human Intelligence
HUMINT — CLANDESTINE / OVERT / LIAISON
Intelligence derived from human sources: clandestine agents, walk-ins, debriefings, and official contacts. Provides intent, decision-maker mindset, and insider knowledge that no technical sensor can replicate. Low volume, high specificity.
◉ Intent & Decision
🗺
Geospatial Intelligence
GEOINT — NGA / Commercial / Terrain / MGRS
The fusion discipline within a discipline — analysis and exploitation of imagery and geospatial information to describe, assess, and visually depict physical features and activities on Earth's surface. Provides the common operational picture foundation.
◉ Spatial Framework
Electronic Intelligence
ELINT — TELINT / RINT / OE-ELINT
Sub-discipline of SIGINT focused on non-communications electromagnetic emissions: radar parametrics, navigation aids, missile telemetry. Key input to the Electronic Order of Battle and jamming/deception waveform libraries.
◉ Radar & Emission Tech
💻
Cyber Intelligence
CYBINT — NETINT / MALINT / DARKINT
Collection from computer networks, malware analysis, dark-web monitoring, and network traffic analysis. Bridges technical and behavioral intelligence — reveals actor TTPs, C2 infrastructure, and pre-attack indicators.
◉ Network & Behavioral
INT Discipline Hierarchy & Sub-Discipline Taxonomy

Each tile area reflects the relative analytical breadth and sub-discipline count of that INT family. Parent tiles show the top-level discipline; child tiles show every named sub-discipline. Hover any tile for a precise definition.

VIEW: LABEL:
Squarified treemap of all 8 INT disciplines and 42 named sub-disciplines. Tile area = relative analytical scope (number of distinct collection methods, data types, and exploitation pathways). Hover any tile for definition and key collection platforms.
Collection-to-Exploitation Data Flow & Fusion Architecture

Seven interactive diagrams covering the JDL Fusion Model, INT-to-product data flow, sensor coverage gap analysis, correlation mapping, and the three primary joint exploitation workflows.

Level 0 — Sub-Object Refinement Level 1 — Object Refinement Level 2 — Situation Refinement Level 3 — Threat Refinement Level 4 — Process Refinement
The JDL (Joint Directors of Laboratories) Data Fusion Model — five levels of abstraction from raw sensor data to intelligence-informed process adaptation. Each level ingests outputs from the previous and adds semantic meaning. Hover nodes for level descriptions.
End-to-end INT data flow from raw collection through tasking, processing, exploitation, and dissemination (TPED). Each INT discipline follows the same pipeline but with radically different sensor interfaces, latencies, and exploitation toolchains. Hover lanes for processing details.
Layered all-source fusion architecture: collection layer feeds raw data stores, which feed a normalization and correlation engine, which populates an Intelligence Knowledge Base (IKB), from which analytical products are derived and disseminated to consumers.
Target characteristic coverage matrix: rows are target attributes (location, intent, capability, identity, activity, network, infrastructure), columns are INT disciplines. Cell color intensity = confidence of detection for that attribute. Dark cells = coverage gap requiring fusion to fill.
Full-cycle target development process from initial OSINT/SIGINT nomination through IMINT confirmation, MASINT characterization, HUMINT intent assessment, and GEOINT weaponeering, to strike authorization and battle damage assessment (BDA).
Multi-INT threat attribution workflow for counter-terrorism and state-actor operations: anomaly detection triggers a collection surge, each INT layer adds a confidence increment, Bayesian fusion yields an attribution probability, and command authority routes to the appropriate response.
OSINT-as-cue loop: how open-source indicators (social media, news, commercial satellite, vessel AIS, flight tracking) are ingested and processed to cue collection by classified INT disciplines, reducing expensive sensor time and driving targeted tasking requests.
Cross-INT Data Fusion Compatibility

How strongly each pair of INT disciplines can be directly correlated to reinforce a product. HIGH = direct technical or temporal correlation possible; MEDIUM = correlation with transformation or temporal tolerance; LOW = indirect / via common framework only.

HIGH — Direct correlation, automated fusion possible
MEDIUM — Correlation with transformation/tolerance
LOW — Indirect via shared framework
— Same discipline / N/A
How All INTs Fuse to Build the Recognised Picture

Each INT layer contributes a distinct class of information about the same target. Stacked together they produce a decision-grade intelligence picture no single discipline can achieve alone. Hover each layer to see what it adds.

SCENARIO: Suspected mobile ballistic missile transporter operating in contested territory — 14:22 UTC
🎯
All-Source Fused Assessment — Decision Grade
Produced at JDL L2/L3 · Confidence: 94% · Latency from first cue: 47 min
Identity: TEL-class vehicle consistent with SS-26 STONE (ISKANDER-M). Positive.
Location: 41.847°N 044.612°E ±8m (GEOINT mensuration). Grid: 38TLL 4847 1236.
Activity: Erection sequence initiated. Launch readiness window: 18–35 min from detection.
Intent: HUMINT reporting + SIGINT command traffic indicate authorised launch authority delegated 06:00 UTC.
Capability: ELINT/MASINT confirm active seeker; warhead type undetermined (conventional / sub-kilo nuclear assessed by NUCINT).
Threat Level: CRITICAL. Recommend immediate commander notification and pre-delegated response authority invocation.
ELINT-Derived EOB Record: Adversary Air Defence Radar System
FieldValueSource INTConfidence
System NameSA-21 GROWLER (S-400 Triumf)OSINT / TECHINTHIGH
NATO Reporting NameSA-21 GROWLERDIA TECHINT LibraryHIGH
Emitter Designation91N6E BIG BIRD Acquisition RadarELINT ParametricHIGH
Frequency BandS-band · 2.7–3.7 GHz (observed: 3.12 GHz)ELINT RC-135UHIGH
Pulse Repetition Frequency250–400 Hz (mode-dependent; observed: 312 Hz)ELINT parametric captureMED
Pulse Width3.5 µs (acquisition mode)ELINT RC-135UHIGH
Scan Rate6 rpm azimuth / electronic elevationELINT time-on-targetHIGH
Frequency AgilityConfirmed (pulse-to-pulse hopping observed)ELINT wideband receiverMED
Max Instrumented Range~600 km (track); ~400 km (engagement)OSINT / TECHINTMED
Altitude Coverage5 m – 30,000 mOSINT specificationsMED
Location (last observed)41.912°N 044.538°E · Grid 38TLL 4894 1309GEOINT / SIGINT geolocateHIGH
Operational StatusACTIVE — emitting as of 14:18 UTCELINT real-timeHIGH
Unit Association8th Air Defence Brigade, assessedSIGINT COMINT / HUMINTLOW
Jamming SusceptibilityLow (ECCM observed); sidelobe suppression activeELINT EW analysisMED
Associated Fire Control92N2E GRAVE STONE (track + engage radar)ELINT co-located emitterHIGH
Missile System40N6E / 48N6 interceptors assessed on-padIMINT SAR change detectMED
EOB Entry DateCurrent collection period · Last updated 14:22 UTCAll-source fusionHIGH
A single EOB entry is itself an all-source fusion product: ELINT provides the parametric fingerprint; IMINT confirms physical deployment; SIGINT geolocates and associates unit identity; HUMINT and OSINT supply order-of-battle context. No single INT produces the complete record.
Real-Format INT Data Samples & Electronic Order of Battle

Representative examples of the actual data product each INT discipline produces — formatted as analysts receive them. The Electronic Order of Battle (EOB) example shows how ELINT, SIGINT, IMINT, and MASINT outputs are fused into a single authoritative threat register.

The Electronic Order of Battle (EOB) is a fused intelligence product — compiled from ELINT, SIGINT, IMINT, and MASINT — that catalogues every known adversary electronic emitter: its type, location, frequency parameters, operational status, and unit association. Below is a representative EOB extract for a notional integrated air defence system.
#
Emitter ID
System Name
NATO Code
Function
Location (MGRS)
Freq Band
PRF (Hz)
Status
Confidence
INT Source
Active — currently emitting
Standby — powered, not emitting
Silent — EMCON / unknown
Destroyed / BDA confirmed
How the EOB is built — Multi-INT fusion chain
ELINT
RF parametrics: frequency, PRF, pulse width, scan rate, polarisation → identifies emitter type and mode
SIGINT
COMINT: operator comms, unit call signs, operational orders → links emitter to unit and command chain
IMINT
Imagery: platform visual ID, vehicle count, site layout, camouflage indicators → confirms location and type
MASINT
RCS library match, thermal signature, NUCINT/CBRINT clearance → characterises physical signature
EOB ENTRY
Fused record: emitter ID, precise coords, parametric profile, unit attribution, operational status, confidence score
A SIGINT COMINT report (IIR format) capturing intercepted communications between two military units. The report includes collection metadata, traffic analysis indicators, and assessed meaning — not just raw content.
SIGINT // COMINT // IIR-2024-XXXX-0342 TS // SI // REL FVEY
DTG Collected:041823Z NOV 2024
Platform:RC-135W RIVET JOINT, Callsign COBRA 21
Collection Mode:COMINT — HF voice intercept, 7.455 MHz LSB
Geolocate Method:TDOA, 4-station fix — CEP 850m
Emitter Location:38°42'N 044°51'E ±850m (NW IRAN)
Source Reliability:B-2 (Usually reliable, probably true)
Call sign JULIET-FOUR contacted call sign WHISKEY-NINE at 1823Z on a prearranged HF frequency. Duration: 4 min 12 sec. Language: FARSI. Encryption: partial — voice encryption device malfunction indicated by operator statement. Message volume: above baseline (3× normal). No previous contact at this time-of-day slot in last 30-day baseline.
"...units are in position... convoy departs at first light... confirm grid Delta Foxtrot... air cover requested from 0400..."
Indicators consistent with pre-dawn mobile missile launcher repositioning. Correlation: IMINT track of 4× TEL vehicles departing garrison at 041630Z. Recommend immediate IMINT cue to grid DF area. Priority: FLASH.
MOBILITY INDICATORTEL ACTIVITYPRE-DAWN OPSIMINT CUE RECOMMENDED
An IMINT exploitation report (IMINTREP) from a satellite EO pass over a military airfield. Analysts annotate each detected feature and assign a confidence level based on imagery resolution, shadows, and pattern-of-life context.
IMINT // IMINTREP // OVF-XXXX-2024-0819 TS // NF
Collection DTG:051042Z NOV 2024
Sensor / Platform:EO-PAN, GSD 0.31m — NTM overhead pass
Target:KHAMIS MUSHAIT AB — Ramp Area CHARLIE
Coordinates:18°17'N 042°48'E — MGRS 37QEU 8241 5503
Solar Elevation:54° — shadow length usable for height calc
Change from Baseline:SIGNIFICANT — 6 new aircraft, 2 fuel bowsers active
FeatureCountID MethodAssessmentConf
Fighter aircraft, twin-engine8Shadow length 14.2m → matches F-15 (18.45m) or Su-30 (21.9m). Wing geometry → F-15SAF-15SA Eagle (RSAF)HIGH
Tanker aircraft, 4-engine2Fuselage width 6.5m, wing sweep 37°, refuelling boom visibleKC-135R StratotankerHIGH
Fuel bowser vehicles4Vehicle dimensions 8×3m, hose connections active (shadow detail)Active refuelling ops in progressMED
Hardened aircraft shelter (HAS)6Arched structures, 3 doors open, 3 closed — thermal IR pass confirms 3 warm engines3 ac sheltered, engines warm — possible alert statusMED
New revetment construction1Earthwork scarring, 2× D9 bulldozers, spoil pile SE corner — not present D-30 baselineForce protection upgrade — ballistic revetment for missile storage probableLOW
Compared to D-30 baseline: +6 aircraft (force generation), +2 fuel bowsers (surge ops), new earthwork (construction). Pattern consistent with surge preparation or pre-deployment loading. Previous SIGINT (IIR-2024-XXXX-0339) reported pilot tasking orders for extended deployment. Recommend 12h re-cue for departure confirmation.
A MASINT acoustic intelligence (ACINT) report from a fixed hydrophone array identifying a submarine by its unique propulsion signature — propeller blade rate, shaft rate harmonics, and broadband noise level.
MASINT // ACINT // SUBTRACK-2024-ATL-0047 TS // NOFORN // ACOUSINT
Detection DTG:061344Z NOV 2024
Array / Station:SOSUS Node YANKEE-7, North Atlantic, classified location
Track ID:ATL-SUB-2024-0047 (new track)
Initial Position:TDOA fix: 52°14'N 028°37'W — CEP 12nm (bearing only until cross-fix)
Course / Speed:225° ± 15° / est. 8 kts (Doppler frequency shift)
Depth Estimate:200–400m (Lloyd mirror effect analysis)
ParameterMeasured ValueLibrary MatchDelta
Shaft rotation rate (fundamental)4.2 HzVICTOR III: 4.1–4.3 Hz+0.1 Hz — within tolerance
Blade rate (7-blade prop × shaft)29.4 HzVICTOR III: 28.7–30.1 HzMatch
Machinery noise at 50 Hz−42 dB re 1µPa/√Hz @ 1kmVICTOR III library: −40 to −45Within bounds
Narrowband tonal at 112 HzPresent, −38 dBKnown VICTOR III cooling pump harmonicPositive ID indicator
Broadband noise level+3 dB vs libraryElevated vs baseline VICTOR IIIPossible maintenance issue or speed increase
Cavitation onset speedNot yet cavitating at est. 8 ktsVICTOR III cavitates above 14 ktsConsistent
Acoustic profile matches VICTOR III-class SSN (Soviet/Russian nuclear attack submarine) with HIGH confidence (6/6 primary parameters within tolerance). Unique tonal fingerprint at 112 Hz provides positive individual hull discrimination — assessed as KHARKOV (hull 945-03) based on 2019 ACINT reference. No prior intelligence indicated North Atlantic deployment. Immediate P-8A POSEIDON cue recommended for localisation and prosecution. IUSS cross-cue requested.
An OSINT analytical note fusing commercially available satellite imagery change detection, AIS vessel tracking anomalies, and social media activity to identify a covert military logistics build-up — without any classified collection.
OSINT // ANALYTICAL NOTE // AN-2024-RUSSIA-0341 UNCLASSIFIED // OPEN SOURCE
Produced By:OSINT Cell, DIA Open Source Enterprise
Date:07 NOV 2024
Sources:Planet Labs (commercial SAR + EO), MarineTraffic (AIS), Twitter/X, Telegram, Ukrainian MoD press releases
Subject:Possible logistics surge — Feodosia port, Crimea
D-7 baseline (31 Oct): 2 Ro-Ro vessels at Berth 4, standard commercial cargo configuration. D-0 image (07 Nov 1024Z): 5 vessels berthed simultaneously — maximum capacity. Shadow analysis: military truck silhouettes visible on aft deck of vessel #3. Vessel #5 matches hull profile of SPARTA III (known Russian military logistics ship).
SPARTA III (MMSI 273358960) transmitted AIS until 03 Nov 1600Z at position 44°18'N 033°22'E (approaching Feodosia). AIS then went dark — consistent with EMCON protocol for military logistics. Vessel re-appeared 07 Nov 0830Z transmitting from Feodosia berth position. 3-day dark period = transit under military emissions control.
Ukrainian OSINT account @InformNapalm posted 3× images 07 Nov (geolocated to Feodosia waterfront via background building match) showing military trucks being offloaded. 847 retweets within 2h — consistent with significant activity. Russian Telegram channel "Крымский ветер" posted "big shipment arrived, don't ask" — possible loose-end indicator from local source.
Convergence of 3 independent OSINT streams provides MEDIUM-HIGH confidence assessment of military logistics surge at Feodosia. Estimated cargo: mechanised infantry equipment, ammunition, or fuel (truck profile, vessel capacity). Recommend classified IMINT cue for berth detail and vehicle type confirmation. No classified sources required for initial nomination — OSINT sufficient for PIR cue.
LOGISTICS INDICATORAIS ANOMALYIMINT CUE — PRIORITY HIGH
A HUMINT Intelligence Information Report (IIR) from a clandestine source reporting on the decision-making environment inside a weapons programme — the only INT that can directly access intent and classified programme details.
HUMINT // IIR // [REDACTED CASE NUMBER] TS // HCS-P // NOFORN
Date of Info:Late October 2024
Date of Report:05 NOV 2024
Source:[REDACTED] — access to senior technical leadership, DEFENCE MINISTRY. Reliability: A (Completely Reliable). Credibility: 1 (Confirmed by other sources)
Handling:ORCON / No dissemination below SES / SES equivalent without source approval
In late October, senior officials within the [COUNTRY REDACTED] defence ministry held an internal review of the ballistic missile programme. The review concluded that the programme is approximately 18 months ahead of the schedule assessed by Western intelligence. The acceleration is attributed to acquisition of [REDACTED] components through a third-country intermediary in [REGION REDACTED]. Officials expressed confidence that a static fire test of the second stage engine would occur before year end. The Defence Minister personally approved continuation without notification to the [TREATY ORGANISATION REDACTED] monitoring body. There is internal disagreement about whether a covert test would be detectable by foreign technical collection; at least one technical official assessed it would be detected via [MASINT/SEISINT collection — REDACTED].
Source reporting is consistent with SIGINT indicators of increased programme communications traffic (IIR-XXXX-0312) and IMINT showing new test stand construction (IMINTREP-XXXX-0774). The 18-month acceleration assessment materially changes the NIE timeline. Recommend immediate update to SPECIAL INTEL annex and notification to POTUS PDB cycle. MASINT (seismic and NUCINT) collection posture should be raised to maximum sensitivity at likely test sites.
WMD PROGRAMMETIMELINE ACCELERATIONNIE UPDATE REQUIRED
A GEOINT site characterisation product combining imagery exploitation, terrain analysis, and precision coordinate mensuration — the standard deliverable for strike planning and facility assessment.
GEOINT // SITE CHARACTERISATION // SC-2024-XXXX-0118 TS // NOFORN // ORCON
Site Designation:SITE AMBER-7 — Underground Research Facility
Coordinates:35°44'22"N 051°31'08"E — WGS-84 / MGRS 39SWB 7421 8834
Imagery Date:031156Z NOV 2024 — GSD 0.31m EO-PAN
Analyst:NGA Production Centre, Reston VA
Site occupies a valley between two ridgelines (elevations 1,842m and 2,105m AMSL). Single access road: 6.2m width, paved, switchback grade — trafficable by standard wheeled vehicles up to MLC 30. Two probable tunnel portals identified on N face of escarpment at grid 39SWB 7419 8841 and 39SWB 7425 8838. Portal dimensions (shadow calc): 8m × 6m — consistent with heavy equipment / rail access. Spoil heaps SE of portals: estimated 40,000m³ — indicates significant underground excavation.
FeatureDimension / DetailAssessment
Portal A (N face, NW)8.2m W × 5.8m H, concrete surround, blast door evidentPrimary vehicle/equipment access — hardened
Portal B (N face, NE)4.1m W × 3.8m H, personnel door visiblePersonnel access / secondary egress
Power infrastructure3× high-tension lines from NE, transformer yard 200m EIndustrial power load — consistent with centrifuge or processing
Ventilation shafts6 shafts identified by disturbed ground 50–200m from portalsUnderground facility depth >50m — consistent with WMD hardening
Security perimeterTriple fence, 4 guard towers, vehicle chicanes, 30m exclusion zoneAbove-standard security — WMD or strategic programme probable
Precision aimpoint (Portal A centre): 35°44'21.4"N 051°31'07.1"E — mensuration accuracy ±0.5m CEP (stereo exploitation, GSD 0.31m). Recommended weapon: GBU-28 bunker buster or equivalent HPM device. Hardness estimate: 70–100 psi (reinforced concrete surround, blast door) — penetrating weapon required. EMP hardening probable given ventilation shaft filter visible on Portal B.
An ELINT parametric report characterising a newly-detected air defence radar — the primary input that creates or updates an Electronic Order of Battle entry. This is how a radar is identified, named, and catalogued.
ELINT // PARAMETRIC // ELREP-2024-XXXX-0556 TS // SI-G // NOFORN
Collection DTG:081904Z NOV 2024
Platform:RC-135U COMBAT SENT, Callsign FAST EAGLE 31
Emitter Location:TDOA/AOA 4-site fix: 37°18'N 058°42'E — CEP 400m
New / Known Emitter:NEW — no prior EOB entry at this location
Assigned Emitter ID:IR-ADS-2024-0883
ParameterMeasured ValueTolerance / Notes
Frequency (nominal)2,850 MHzS-band. Agile range: 2,700–3,100 MHz observed (16 hop values)
Pulse Width (PW)3.2 µs (search mode) / 1.1 µs (track mode)Dual-PW indicates TWS capability
Pulse Repetition Interval (PRI)3,333 µs (staggered: 3,250 / 3,416 µs)PRF staggering — ECCM capability
Scan Rate (azimuth)6 rpm standard / 12 rpm in alert modeMode change observed at T+14min — possible track initiation
Scan TypeCircular (search) / Sector (acquisition)Sector scan centred 270° ± 35° — cued west
PolarisationLinear vertical (search) / Circular (track)Polarisation switching — stealth-detection optimised
Peak Power (est.)~1.8 MW (intercept power back-calc)Long-range search radar — est. instrumented range 450km
Antenna rotationAzimuth 360°, elevation 0–60°3D radar — height-finding capability confirmed
Parametric profile most closely matches NEBO-SVU (NATO: "TALL RACK") VHF/UHF 3D long-range search radar, or a variant thereof. Key discriminators: S-band frequency, frequency agility profile, dual-PW TWS mode, and estimated power level all match NEBO-SVU production specifications within ±8%. Circular polarisation in track mode indicates anti-stealth optimisation consistent with known NEBO-SVU capability upgrades post-2019. EOB entry IR-ADS-2024-0883 created. Unit attribution: awaiting SIGINT COMINT cross-cue (RFI submitted). Recommend IMINT cue within 24h for visual confirmation and site characterisation.
EOB NEW ENTRY3D SEARCH RADARNEBO-SVU PROBABLEIMINT / SIGINT CUE SUBMITTED
A CYBINT malware analysis report attributing a network intrusion to a state-sponsored APT group — showing how technical indicators, behavioural patterns, and infrastructure analysis are fused to reach attribution.
CYBINT // MALWARE ANALYSIS // CIR-2024-XXXX-0229 TS // SI // REL FVEY
Incident Date:Intrusion first observed 19 OCT 2024, reported 05 NOV 2024
Victim Sector:Defence industrial base — [COUNTRY REDACTED] satellite manufacturer
Malware Family:COBALTSTRIKE Beacon + custom loader "SANDSTRIKE-v3" (new variant)
Attribution Confidence:HIGH (technical) — APT41 (China, MSS-linked)
IoC TypeValueAttribution Link
C2 IP Address103.27.108.244 (HK ASN)Previously attributed to APT41 in 2023 campaign (Mandiant)
C2 Domainupdate-service[.]cloudapp[.]netDomain registration pattern matches APT41 infrastructure cluster
Malware hash (SHA256)a3f9c8...d447e1 (SANDSTRIKE loader)Code similarity 94% to APT41 DEADEYE loader (2022)
PDB path artefactC:\Users\admin\Desktop\SandS_v3\Release\loader.pdbCyrillic filename artefact in adjacent strings — possible false flag or multilateral op
MutexGlobal\\{4A8F2B91-CC43-4d7e-B3FF-...}Exact mutex match to APT41 COLDBREW tool (FireEye 2021)
Staging directory%TEMP%\\SystemCache\\svchost32.dllKnown APT41 LOLBin staging pattern
T1566.001 Spearphishing Attachment (initial access — PDF lure themed as satellite procurement RFP). T1055.012 Process Hollowing (evasion). T1041 Exfiltration over C2 channel (encrypted HTTPS, 443). T1070.004 File Deletion (anti-forensics). Data staged in 7z archives before exfil. Dwell time: estimated 17 days before detection. Exfiltrated data volume: ~4.2 GB (likely CAD files and ITAR-controlled technical documents based on accessed directories).
Technical evidence strongly indicates APT41 (BARIUM/WINNTI) — PRC Ministry of State Security (MSS) contractor group. Three independent attribution pillars: (1) code similarity to known APT41 tools, (2) C2 infrastructure overlap with prior attributed campaigns, (3) targeting pattern consistent with APT41 focus on aerospace/defence IP theft. SIGINT cross-cue requested to corroborate operational communications. Assessment: HIGH confidence attribution. Likely objective: acquisition of satellite bus design data for PRC space industrial programme.
APT41IP THEFTMSS ATTRIBUTIONSIGINT CUE SUBMITTED
Twelve Multi-INT Operational Workflows

Each workflow defines which INT disciplines contribute at each phase, what data type is handed off, latency constraints, and the decision product at output. Click any card to expand the full workflow specification.

F3EAD Cycle: Find · Fix · Finish · Exploit · Analyse · Disseminate

Target development is the end-to-end process by which multi-INT collection is fused into a legally-reviewed, commander-authorised, effects-calibrated decision to act. Each phase is a distinct intelligence hand-off — and each requires a different combination of INT disciplines. No single source can carry a target from nomination to BDA alone.

Multi-INT Data Hand-Off Matrix — What Each Phase Needs and Produces
F3EAD Phase Primary INT Inputs Data Product Consumed Output / Hand-Off Product Latency Target Failure Mode if INT Missing
FIND
Nominate target
SIGINTOSINTHUMINT SIGINT activity indicators, OSINT geospatial cue, HUMINT source report Target nomination with initial grid ±500m, assessed entity type, PIR linkage Hours to days No nomination — target never enters development cycle
FIX
Confirm location
IMINTGEOINTSIGINT EO/SAR imagery, SIGINT TDOA geolocate, GEOINT terrain reference Precision coordinates ±10m CEP, confirmed physical presence, pattern-of-life baseline 15 min – 6 h Target fixed at wrong location — weapon misses or hits wrong object
CHARACTERISE
Assess capability
ELINTMASINTIMINT ELINT parametrics (radar type, mode), MASINT RCS/thermal, IMINT dimensions and hardening Target type confirmed, vulnerability assessment, hardness estimate, weapon selection input 1 – 24 h Wrong weapon selected — insufficient effect, or disproportionate effect
INTENT CHECK
Assess purpose
HUMINTSIGINTOSINT HUMINT source reports on use / occupancy, COMINT operator orders, OSINT open-source verification Dual-use assessment, civilian presence estimate, commander intent confidence level Hours to days Civilian or protected-site targeting — IHL violation, strategic-level consequences
WEAPONEER
Select effects
GEOINTMASINTIMINT GEOINT precision aimpoint (±0.5m mensuration), MASINT hardness estimate, IMINT proximity mapping Target Intelligence Package (TIP): aimpoint, weapon type, fusing, approach axis, CDE value Hours (deliberate) / mins (TST pre-built) Wrong aimpoint or weapon — structural miss or collateral damage excess
FINISH
Execute effect
SIGINTIMINT Real-time SIGINT activity confirmation (target still present), ISR sensor cueing for terminal guidance Weapons release — effect delivered against authorised target Real-time Target has moved (no SIGINT confirmation) — weapon hits empty objective
EXPLOIT
Collect at site
HUMINTMASINTSIGINT Sensitive site exploitation (SSE) by HUMINT teams, MASINT CBRN clearance of site, SIGINT capture of any residual traffic Exploited materials, biometric data, documents, device forensics — feeds new target development cycles Hours post-strike Intelligence opportunity missed — no insight into adversary network or follow-on targets
ANALYSE
Assess effect
IMINTSIGINTHUMINT IMINT change detection (BDA imagery), SIGINT adversary reaction traffic, HUMINT ground reporting on damage Battle Damage Assessment (BDA): effect achieved grade (D1–D5), re-attack recommendation, JTL update Minutes – 24 h Unknown effect — re-attack risk (wasted weapons) or unreported miss (target still operational)
DISSEMINATE
Update the picture
GEOINTOSINT All-source BDA fusion product, updated GEOINT baseline, OSINT open-source confirmation / denial Updated JTL, revised EOB, new intelligence requirements for follow-on cycle — loop restarts at FIND Hours Stale picture — commanders make follow-on decisions on outdated intelligence
F3EAD vs D3A — Two Targeting Models
F3EAD (Find-Fix-Finish-Exploit-Analyse-Disseminate) is the Special Operations Forces (SOF) model — optimised for high-tempo, iterative targeting of networks and individuals. Intelligence and operations are fully integrated; the loop can cycle in hours. D3A (Decide-Detect-Deliver-Assess) is the conventional fires model used by Army/joint forces for deliberate targeting of physical infrastructure and equipment. The intelligence inputs are identical; the timelines and authority chains differ.
Time-Sensitive Targeting (TST)
When a high-value target appears with a short window of opportunity, the full deliberate cycle collapses into a TST track. Pre-built target packages (including pre-computed aimpoints and CDEs) enable strike authority to be exercised in minutes. SIGINT real-time geolocate and ISR sensor cueing are the critical intelligence enablers. The legal review for TST is done in advance at the category level — not per individual target — with strict ROE governing execution authority.
Network Targeting vs Node Targeting
Modern targeting doctrine distinguishes between striking individual nodes (a radar site, a command bunker) and disrupting a network (a logistics chain, a C2 architecture). Network targeting requires CYBINT and SIGINT mapping of relationships between nodes — HUMINT for key-node identification — and GEOINT for physical network mapping. The decision to target a network node must account for reconstitution speed: an adversary can rebuild a radar in days but may take months to rebuild trained operators.
How Multi-INT Fusion Enables Higher-Order Operations

Each chain traces a causal pathway from a single-INT observation through fusion layers to a decision-grade product. These are the intellectual architecture of all-source analytical tradecraft.

Step 1 of 12