Today US DoJ announced seizure of two domains and the search of 968 accounts on X used in a "Russian-government backed campaign" to spread disinformation.
Affidavit includes all of the accounts requested from X 👇
The DoJ announcement said the campaign used elements of AI to create fictitious social media profiles purporting to belong to individuals in the United States, which the operators then used to promote messages in support of Russian government objectives. justice.gov/opa/pr/justice…
The affidavit for the accounts on X shows that all of the accounts were registered to email addresses that were either using the domain 'otanmail' or 'mlrtr' justice.gov/d9/2024-07/aff…
According to the affidavit, the development of the 'bot farm' was organised by the leader of the directorate of digital journalism within the Russian Government backed news outlet Russia Today (RT).
One of the accounts mentioned in the affidavit didn't use the two domains seized by DoJ, but rather an address provided by a disposable email service. The account @tblock1999xe is still available. Note the GAN-generated profile image.
This account, included in the RT network, appeared to post videos of Putin as replies to posts on X, specifically posts about Ukraine, Palestine or US politics. Not very great influence content, barely any traction, and pretty much just there to promote Putin.
In a joint release today, the FBI, Dutch AIVD and Canada's CCCS also published technical details of the Russian network architecture. It used Meliorator to generate accounts en masse through a Brigadir UI, then Taras to control the personas on X. ic3.gov/Media/News/202…
The developer of the architecture behind the network putting out RT content on X inserted code to allow for the server to bypass X verification methods, the ones put in place to prevent bot capabilities.
Relevant to share this interview from Head of RT Margarita Simonyan, shared by @JuliaDavisNews, via @Prune602.
Simonyan talks about how they create 'many sources of information not tied to them' and 'some mornings you wake up and 600 channels are gone'.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
I have received a number of messages asking about the location of this IL-76 (RA-76502) from Russian Aviacon Zitotrans (usually responsible for arms cargo).
It is not landing in Sudan (alleged in the comments), but is landing in Faya-Largeau in northern Chad. More in thread 👇
I identified an original and more clear version on TikTok (not hard if you want to find it). In it, we can see the registration number of the plane much more clearly, as well as the dune and cliffs in the background.
The registration, RA-76502 that had been owned by JSC Aviacon Zitotrans, named by US as "a Russian cargo airline that has handled cargo shipments for sanctioned Russian Federation defense entities".
This festive season I’m sharing a video every day for the next 24 days showing useful OSINT tools & techniques. Creating this OSINT Advent Series has been a lot of fun and I hope it’s helpful for the ever-growing OSINT community! 🎄👇
1. Searching Facebook with WhoPostedWhat.
2. Using AI to identify a car model in an image with Carnet.
Today is #WorldMentalHealthDay. As digital investigators we're often not experiencing what we see online, in real life, but it can still affect many.
So to keep doing the important documentation and investigative work online, here's a few practical steps you can take.👇
1. When sharing graphic content with colleagues and friends, remove those previews and give a little graphic warning indicator. There's always a little 'X' in the corner to remove preview.
2. Consider changing the settings on your social media platforms so you're not absorbing horrific content while doomscrolling. You don't have to filter it out, but at least stop the autoplay.
I was recently on a flight across Australia when I spotted this massive figure on the ground. It led me on a digital journey to find out what it was, how it got there and who made it.
I'm going to explain a bit more about what it is in this thread, and how I found out. 👇🧵
Without internet on the plane, I made a screenshot on my phone of the location (yes it was on flight mode) and later used flight tracking to pinpoint exactly where I saw it.
Using @flightradar24, I traced the path my plane took and found the spot!
Next stop: @googleearth 🗺️
I zoomed into the area and there it was — this huge humanoid figure etched in the Australian outback. Measuring 2.7km tall and covering an area of more than 1.7 square kilometres, it's a sight to behold.
Despite our reporting last week on the fake network of pro-Trump MAGA accounts, there appears to be many more accounts actively posting the exact same content. This one, @brenda_otto_ with 18k+ followers, is stealing photos from an Australian Instagram model in Queensland.
Here's another fake MAGA account, @Tracy_Miller044, stealing images from a fashion blogger (a popular one too).
@Tracy_Miller044 - if you want to reach out and talk about your work, why you're running these campaigns etc, I'm open.
Here is @Sarah_Hickey__
Sarah is stealing the photos of a Czech Instagram influencer to create a persona claiming to be a MAGA republican conservative with 40k+ followers and a blue tick (which means it's apparently not misleading).
A network of fake accounts are posing as young American women, posting pro-Trump content and disinformation, but they’re hiding behind, and manipulating, the images of European fashion influencers.
Our latest investigation at @Cen4infoRes. Details in this thread 🧵👇
Our full analysis can be seen at @Cen4infoRes here: . We also collaborated with @CNN to dig out the human stories behind those who had their photos stolen
One of the accounts is Eva. She lives in the US, and likes hanging out at the beach and posting to her 5000+ followers on X. Eva posts strong opinions against LGBTQ people and the US Democratic party and is a loyal supporter of former US president Donald Trump.