2.1 Audience
followers. This helped us understand the collective audience these assets
built and each asset’s relative influence and community. The resulting
network map revealed three major groups reflecting specic regions and
nations, including Iran, Arabic-speaking Middle East, and Afghanistan.
•
We used these network groupings as a foundation to review further the
covert Twitter and Meta assets and assign labels corresponding to their
audience. This included a qualitative review of asset behavior, such as the
fake personas they employed online, and a quantitative content analysis of
the assets’ most-used hashtags, key terms, and web domains.
•
This second review resulted in four labeled asset groups, each of which
appeared to encompass a contained campaign targeting audiences in one
country or geographic region. The activity sets related to Central Asia, Iran,
and Afghanistan were each distinct enough to merit their own labels. We
combined four less distinct Arabic-language clusters related to Iraq, Syria,
Lebanon, and Yemen as one group labeled “Middle East.”
•
Finally, we analyzed the assets in each group individually and collectively
to identify the tactics, techniques, and procedures (TTPs) they employed
to conduct their campaigns and the narratives they promoted.
2.1 Audience
The below network map (Figure 1 on the following page) shows the communities
in which these covert Twitter assets achieved a degree of influence, thus providing
a picture of the international audiences that engaged with the campaigns. The
major groupings in the map reflect three nations and regions: Iran, Afghanistan,
and an Arabic-speaking Middle East group comprising Iraqi and Saudi subgroups,
some of which contain a few accounts associated with Syria, Kuwait, and Yemen.
In addition to these major groupings, there were smaller community clusters in
the network containing mixed international accounts focused loosely on a variety
of international gures and organizations. We also encountered an unclustered
set of accounts with insufcient data for categorization.
Although we identied a Central Asia-focused campaign based on a review of
the assets’ activity, the map lacks a Central Asia community. The community’s
absence is likely due to the reportedly limited use of Twitter in Central Asian
countries, including Kazakhstan, Uzbekistan, Kyrgyzstan, and Tajikistan, where
Facebook, Instagram, WhatsApp, and Telegram are considerably more popular.
Accordingly, Twitter assets in the Central Asia group generated signicantly less
engagement than their counterparts on Facebook and Instagram.
For each of the covert Twitter accounts we identied, we calculated its “follower
footprint” in each community cluster, dened as the proportion of accounts in the
community cluster that followed it. There was a typical long-tail distribution in
the follower footprints, with a few influential accounts followed by a descending
list of accounts with progressively fewer followers. The distribution also featured
a large set of assets (about 20% of all the suspended covert Twitter assets) with
4
