Read on Twitter
As fighting continues in Khartoum, @DFRLab discovered 900+ Twitter accounts that appear to have been hijacked and refurbished to boost content supportive of #Hemedti and the #RSF, making the paramilitary force appear more popular than they may be. 🧵👇 dfrlab.org/2023/04/18/pot…
Our team reviewed 4,882 accounts and found that some very old accounts, most of which had been dormant for many years, suddenly began tweeting between December 2022 and February 2023 at what appeared to be a random combination of words and a date 
After the random posts, accounts started liking content posted by Hemedti/RSF. However, almost none of the 900 accounts actually followed Hemedti or the RSF. Trying to appear authentic, accounts sometimes tweeted out Quran verses and inspirational quotes, often simultaneously.
Several indicators point to the possibility that many of the 900 accounts were originally operated by legitimate users and subsequently hijacked. Evidence includes previous usage with photos or other languages, mismatched usernames and screen names, and generic profile pictures
As tensions between Hemedti and Gen. Abdel Fattah al-Burhan, Sudan’s de facto ruler, escalated into armed conflict, the 900 accounts switched from only liking posts *by* Hemedti and the RSF, and instead began boosting content *about* them from journalists and media organizations.
Hijacking indicators, including dormant accounts tweeting a string of characters lifted from a digital marketing Wikipedia page before boosting Hemedti/RSF tweets, imply a larger network as the Wikipedia characters were tweeted by hundreds of other accounts not yet engaged.
.@awildknight contributed to this report. See the full investigation: dfrlab.org/2023/04/18/pot…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
