The accounts appeared to prioritise certain tweets. In this example, 71% of replies to an RSF tweet came from the network. These included identical replies posted at exactly the same time. 8/9

The most recent campaign focused on replying to posts by the RSF, Hemedti and RSF Live accounts. These accounts had also been dormant for years before being repurposed and rebranded as RSF supporters. They had a set list of replies used in response to RSF tweets. 7/9

The accounts also posted promotional RSF content, copied from RSF sources or media. Before the war, they presented Hemedti as a reformist general and potential leader of Sudan. They pivoted after April 15 and supported Hemedti's war effort. 6/9

The second campaign used new accounts, created in late 2022. In this image you can see a selection of the high profile accounts, some created within minutes of one another. They retweeted and replied to the RSF/ Hemedti. 5/9

After Twitter suspended the network the inauthenticity became more obvious. In this example, 71 retweets and 81 likes on an RSF tweet came from accounts in the network. After the accounts were suspended, the tweet had significantly less engagement. 4/9

Two campaigns were initiated before the war started. One compromised of 900+ potentially hijacked accounts used to amplify posts by the RSF/ Hemedti. Many were inactive for years before being repurposed and rebranded to promote the RSF. 3/9

In summary, the campaigns all had one goal: amplify the RSF & Hemedti, make them appear more popular than they are, and spread positive content about them.

The account numbers are likely imprecise; we did a lot of work manually when we lost API access. 2/9

In the five months since war broke out in Sudan,
@dfrlab.bsky.social has identified three influence campaigns on Twitter/ X attempting to promote Hemedti and the Rapid Support Forces.

Brief summary of our findings below 🧵👇 1/9

The accounts also used generic profile pictures, and changed their names and handles to appear more authentic. See taylortravis223 aka EzzDin Da'wood from Khartoum.

At first glance the accounts appeared to have been hijacked or sold. They had been inactive for over a decade, and showed evidence of belonging to real users back in the day. In 2012 Muhammed Shadi couldn't figure out how to use Twitter.

In one example, 71% of replies to a tweet from the RSF came from accounts in the network, some of which posted identical content at the same time.

The Twitter network, which is currently active, replied to posts by the Hemedti, RSF and RSFLive accounts using copied text. For example, here are 4 accounts using the same text to reply to different posts.