Threat actor
TigerSwan
Last fetched
TigerSwan is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.
Description
TigerSwan is a global firm founded in 2008 by James Reese, a retired U.S. Army lieutenant colonel and former Delta Force commander. The company led the surveillance operations and infiltration of the Dakota Access Pipeline (DAPL) protests at Standing Rock. Hired by Energy Transfer, the company behind the pipeline, TigerSwan used a range of methods to monitor and disrupt the Indigenous-led resistance movement. These tactics included the use of undercover operatives, aerial surveillance, social media monitoring, and the creation of detailed dossiers on activists. The firm also collaborated with law enforcement, sharing intelligence and supporting legal actions against protestors. Following its involvement at Standing Rock, TigerSwan sought to profit from its surveillance tactics by marketing its "counterinsurgency" playbook to other energy companies. The firm created detailed marketing materials and presentations, pitching its strategies to corporations like ConocoPhillips and Dominion Energy, which were involved in other contentious oil and gas projects.
Techniques by tactic
No ATT&CK techniques are recorded for TigerSwan in WhisperGraph.
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to TigerSwan today — this states the absence of a published link, not that TigerSwan has no infrastructure.
References
- https://theintercept.com/2017/05/27/leaked-documents-reveal-security-firms-counterterrorism-tactics-at-standing-rock-to-defeat-pipeline-insurgencies/
- https://drilled.media/documents/1ed15ccd-a1cf-4f20-aaff-483b4714ab57
- https://www.theguardian.com/commentisfree/2017/jun/28/surveillance-standing-rock-policing-native-lands
- https://grist.org/accountability/tigerswan-documents-dakota-access-pipeline-standing-rock-surveillance/
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from TigerSwan into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.