This is just a short snapshot of some of the work we have been doing, and will continue to do. You can find the English and Arabic versions of these pieces, as well as other Sudan content, here: dfrlab.org/staff/tessa-... 9/9

The accounts appeared to prioritise certain tweets. In this example, 71% of replies to an RSF tweet came from the network. These included identical replies posted at exactly the same time. 8/9

The most recent campaign focused on replying to posts by the RSF, Hemedti and RSF Live accounts. These accounts had also been dormant for years before being repurposed and rebranded as RSF supporters. They had a set list of replies used in response to RSF tweets. 7/9

The accounts also posted promotional RSF content, copied from RSF sources or media. Before the war, they presented Hemedti as a reformist general and potential leader of Sudan. They pivoted after April 15 and supported Hemedti's war effort. 6/9

The second campaign used new accounts, created in late 2022. In this image you can see a selection of the high profile accounts, some created within minutes of one another. They retweeted and replied to the RSF/ Hemedti. 5/9

After Twitter suspended the network the inauthenticity became more obvious. In this example, 71 retweets and 81 likes on an RSF tweet came from accounts in the network. After the accounts were suspended, the tweet had significantly less engagement. 4/9

Two campaigns were initiated before the war started. One compromised of 900+ potentially hijacked accounts used to amplify posts by the RSF/ Hemedti. Many were inactive for years before being repurposed and rebranded to promote the RSF. 3/9

In summary, the campaigns all had one goal: amplify the RSF & Hemedti, make them appear more popular than they are, and spread positive content about them.

The account numbers are likely imprecise; we did a lot of work manually when we lost API access. 2/9

This is the third example the DFRLab has identified of the RSF manipulating social media since the start of the war. Previous links in the thread below.
https://twitter.com/awildknight/status/1648651940773916677

Or, the network is a lot bigger and we only picked up on these accounts. We did this manually folks! No Twitter API access = more work and more uncertainty.

And yet, all 227 accounts were created on 3 different days in 2012. It's not common for hijacked accounts to all have been created on the same days. It's possible the accounts were initially set up to appear authentic before being deployed for inauthentic purposes.

The accounts also used generic profile pictures, and changed their names and handles to appear more authentic. See taylortravis223 aka EzzDin Da'wood from Khartoum.

At first glance the accounts appeared to have been hijacked or sold. They had been inactive for over a decade, and showed evidence of belonging to real users back in the day. In 2012 Muhammed Shadi couldn't figure out how to use Twitter.

In one example, 71% of replies to a tweet from the RSF came from accounts in the network, some of which posted identical content at the same time.

The Twitter network, which is currently active, replied to posts by the Hemedti, RSF and RSFLive accounts using copied text. For example, here are 4 accounts using the same text to reply to different posts.