October 12, 2023
InsightsInauthentic Account Network on X Amplifying Misleading Israel-Palestine Content
From the outset of Hamas’ attack on Israel and the escalation into war over the weekend, graphic footage, breaking news stories, and waves of updates on the ground have spread rapidly on social media platforms. This unfortunately includes disinformation and misinformation on social media platforms, which has made accessing accurate and unmanipulated information increasingly difficult.
Alethea has detected a likely inauthentic, coordinated cluster of at least 67 accounts on X posting near-identical content about the conflict and promoting misleading and out of context translations of statements from Russian President Vladimir Putin and Foreign Minister Sergei Lavrov. Alethea observed both pro-Palestine and pro-Israel content from these accounts, suggesting the network’s aim may be to stoke anger on both sides of the conflict or to simply capitalize on the current interest in the topic. Although Alethea was unable to attribute the network to a specific actor, many of the accounts in the network violated X's terms of service and have since been suspended by the platform.
Network Characteristics
Within the inauthentic network, the accounts vary in both characteristics and presentation. One account presents as affiliated with a news website, potentially fueling confusion over legitimate and reliable information sources. Others repurpose stolen and suggestive photos of women as their profile pictures, often with names commonly used by English-speakers, while some use profile pictures of men that were not immediately identifiable as repurposed or stolen. Alethea found that many of the profile photos used by the network were identified elsewhere online, predating the accounts’ creation.
Coordination detected within Alethea’s Artemis platform
The accounts post within minutes of each other and often share similar account creation times. Some accounts appeared to be repurposed NBA fan accounts, with their bio or display name presenting themselves as being Japan-based; however, the accounts’ recent activity has been completely focused on the conflict in Israel. A further investigation of the accounts seems to show them posting a variety of spam-related content in 2021 in multiple languages and then becoming active again in late September 2023 in Japanese, an indication that the accounts may have changed hands multiple times. Following Hamas’ attack, the accounts originally reported on the conflict in Japanese before switching to English. It is unclear if these accounts might have been compromised—i.e. either hacked or purchased—at some point since 2021.
Example of identical content being posted by multiple accounts within the network
Content and Narratives
In the mistranslated video of President Putin, he is speaking about the risk of nuclear conflict and stating that Russia would never use nuclear weapons first; the video appears to be in relation to the war with Ukraine and the accurate translation never mentions Palestine, Hamas, Israel, or America. Not only is the video mistranslated, but Alethea was able to verify the original source of the video as a YouTube Short published by USA Today’s official YouTube account on December 8, 2022, further confirming that it is unrelated to the current Israel-Palestine conflict.[1] The original poster of the mistranslated video appears to be an X user named @Agsidorova, whose post at 09:46 GMT on October 9, 2023, received at least 270 reposts, 850 likes, and 423K views or impressions.[2] Additionally, the reply section of @Agsidorova’s post is full of comments by @ezdubs_bot, an automated user with 130K+ followers that dubs videos in target languages requested by other X users.[3] The @ezdubs_bot has correctly translated the audio of the video to Arabic, English, German, Indonesian, and Japanese, among others, but the subtitles of the video are still incorrect, thereby furthering the spread of the misleading content.
Example posts from accounts within the cluster that promoted the mistranslated video of Putin and are using stolen profile pictures and similar usernames
Alethea also observed a second post recirculating an old video of Russian Foreign Minister Sergei Lavrov with a similar mistranslation.[4] The original video, verified by Alethea as coming from the official YouTube account of USA Today on April 27, 2023, shows Lavrov discussing the decline of freedom of speech in the United States and commenting specifically on Tucker Carlson’s departure from Fox News.[5] Like the video of Putin, the accurate translation never mentions Palestine, Hamas, or Israel and is not related to the current conflict in the region. The mistranslated video, which was also promoted by the inauthentic network, indicates that Russia would support Palestine as a response to the U.S. supporting Israel. Alethea observed the same automated user, @ezdubs_bot, present in the comment section of this video too.
Impact and Implications
As has been well documented, there is an immense amount of false information and misleading content circulating online related to the Israel-Hamas conflict and X, in particular, has been inundated with viral posts and false information. Combined, the accounts in this network and their misleading posts have accrued millions of views.
Crisis events and wartime periods create a perfect storm of chaos, uncertainty, and panic that allows threat actors to capitalize on and successfully spread disinformation and misinformation. It’s important to understand that this is an ongoing and evolving situation and that new adversary tactics, threat actors, and other false narratives may enter the fray in the coming days and weeks.
Endnotes:
[1] https://www.youtube[.]com/shorts/reCnsJlhqKU
[2] https://twitter[.]com/Agsidorova/status/1711317080966893725
[3] https://twitter[.]com/ezdubs_bot
[4] https://twitter[.]com/Ali7861216216/status/1711395118823944257
