Thread by @benimmo

JUST OUT: Adversarial threat report on brigading, mass reporting and coordinated inauthentic behaviour.

With a deep dive into the Chinese operation that created a fake “Swiss biologist” back in July.

I think of that one as Operation Swiss Rôle.

about.fb.com/news/2021/12/m…

There’s a lot here:

* Expanding Crowdtangle IO archive to more researchers
* First public takedowns of brigading & mass reporting networks
* CIB takedown from Palestine (Hamas)
* Two CIB ops focused on Poland / Belarus migrant crisis (one from Belarus KGB)
* Op Swiss Rôle

First, deep dive: in July, a fake “Swiss biologist” persona on FB and Twitter accused the US of bullying the WHO over COVID origins, and was picked up by Chinese state media with amazing speed.

H/t @mradamtaylor and @BBCTrending for their reports.

washingtonpost.com/world/2021/08/…

Hundreds of coordinated accounts - mostly fake - amplified the persona.

We found links to individuals in mainland China, including employees of Sichuan Silence IT Co, Ltd, and individuals associated with Chinese state infrastructure companies located around the world.

The authentic amplifiers had the same behaviour pattern: sharing distinctive pairs of URLs as text strings without further comment. They did this for months. A few slipped up and posted instructions on how to share and report back.

Interestingly, once you strip out the operation’s amplifiers, the fake persona got nearly zero real engagement. But, it was picked up by Chinese state media in less than a week.

We don’t know exactly how the op coordinated, but we know it was cross-platform. So we’re publishing a list of the link pairs, plus behavioral indicators, to enable further research.

This one’s for all my old friends in the #OSINT world.

about.fb.com/wp-content/upl…

Next up, two ops focused on the Poland/Belarus migrant crisis.

One had high operational security, but we believe it originated in Poland. The other was less high security, and came courtesy of the Belarusian KGB.

Both ops were recent. Both were based on fake personas. Each included negative content about the other’s country.

Given the situation on the ground, we took them both down fast.

Also on the CIB front, an operation run from Gaza that we linked to Hamas. It mostly focused on domestic politics, but had minor focus of Israel and Egypt.

It tried hard to look authentic - fake news outlets, backed by fake personas.

Finally, the first public disruptions of a brigading network and a mass-reporting network.

Brigading: the V_V network in Italy / France
Mass reporting from Vietnam.

Details in the report, and watch the inimitable @jc_stubbs and the @graphika_nyc team for more.