Thread by @BenDoBrown

A small network of fake accounts linked to an Iranian influence operation was posting about COVID & US Politics using accounts with bios & pics copied from UK media and activists & others disguised as 'fanatics'.

Here's my research on @ASPI_ICPC s3-ap-southeast-2.amazonaws.com/ad-aspi/2020-1…

First, this investigation originated out of Twitter's data from a influence network takedown in October (screenshot is of data in that report): transparency.twitter.com/en/reports/inf…. The new accounts are the ones that survived.

Second, this network was small and had minimal impact.

I looked a little deeper into the accounts in the takedown report and started to find some strange things. Under many of the suspended accounts, comments had been made using the same text with the same video - so let's look at who's posting them.

Here's an example of one of the accounts in the network, it's claiming to be in the UK media (left). BUT the profile bio is stolen from a real person on Twitter (right).

There are other accounts that also had their images & bios stolen - but I will maintain their privacy.

Another example of these tactics seen employed on another account in the network (left). It stole parts of the bio on the public figure on the right.

What about those 'fanatics' I mentioned in this network? These are a sample of them. Note the similar number of followers, same date of last post, and the profile with the description as 'ninja', 'fanatic', 'foodaholic'...

Those 'fanatic' accounts carry the hallmark which I identified after using an image reverse search on all of them, they used their profile pictures from stock photo websites

So what are they posting about? Most of the time they shared articles in no particular order, all related to US Politics, Black Live Matter protests and COVID. On one date, April 30, the whole network came together to post about a 'heartburn drug' & coronavirus

The text and the image was taken from this @washingtonpost tweet.

Looking at the number of tweets and average number of followers of accounts in the network could provide a way to asses and quantify the impact of this network. However, on the outset, looking at the average number of followers, likes & retweets, shows it was pretty unsuccessful.

If you'd like to see more on these findings, they are here in the report: s3-ap-southeast-2.amazonaws.com/ad-aspi/2020-1…
Very big hat-tip to @arielbogle, @elisethoma5 & @JakeWallis_ASPI from @ASPI_ICPC for the great peer reviewing of this piece.