Suspected source: Russian intelligence.
@DFRLab has been investigating. Top takeaways here.
medium.com/dfrlab/top-tak…
The full report on #SecondaryInfektion is online here: digitalsherlocks.org/ourwork
When we dug into it, we realised the assets on FB were the tip of the iceberg.
newsroom.fb.com/news/2019/05/m…
The content the operation posted there often focused on Russian geopolitical concerns.
![](https://pbs.twimg.com/media/D9ssmAkX4AEdf5t.jpg)
@DFRLab checked with the EC. The letter's a fake.
![](https://pbs.twimg.com/media/D9stgpRXYAEYct5.jpg)
![](https://pbs.twimg.com/media/D9swlmrXYAIhDwF.jpg)
#SecondaryInfektion prioritised security over clicks. Great way of staying hidden, but I've never seen so little bang for so much buck.
![](https://pbs.twimg.com/media/D9sxRoLXkAYMbG0.jpg)
Precise attribution is not possible, but this looks like an intelligence op.
This fake tweet attributed to @marcorubio was one of theirs. It started off as a meme posted by a burner account.
![](https://pbs.twimg.com/media/D9szAEwWsAEl6Fx.jpg)
Based on our research, @MarcoRubio tweeted to expose the fake. RT added that he "disputed" the original, but didn't correct.
![](https://pbs.twimg.com/media/D9s1SOQWwAA4owW.jpg)
It started with a letter in Spanish, claiming that extremist Remainers were plotting to assassinate... @BorisJohnson.
The letter claimed to be from the Spanish foreign minister, but couldn't even spell his name (it's "Borrell", not "Borell").
![](https://pbs.twimg.com/media/D9s2y77WwAAlNW-.jpg)
This one used a tweet attributed to @GavinWilliamson implicating the Real IRA in the Salisbury poisoning.
Posted by a burner account on Medium, again. All the indications are that the "tweet" was a fake.
![](https://pbs.twimg.com/media/D9s5yqYXUAEJ4Xn.jpg)
I'd love to know if the operators were House fans. Open sources, sadly, don't go that far.
![](https://pbs.twimg.com/media/D9s6bcDWwAEwRe8.jpg)
This time, a burner account even posted the story on a forum in Pakistan.
![](https://pbs.twimg.com/media/D9s89oyX4AYXAFc.jpg)
Created, posted, dropped, all the same day.
![](https://pbs.twimg.com/media/D9s-m4OXkA0MIyP.jpg)
reuters.com/article/russia…
![](https://pbs.twimg.com/media/D9tBW82WsAAqqjV.jpg)
Good hunting.
// Thread ends.