Threat intelligence firm Record Future, which published the study this week, has developed tools for detecting and analyzing operations by nation-states, and has been tracking the new phenomenon.
Coining the term “fishwrap,” the group says the disinformation network could be acting independently — or as part of a foreign government.
“Somehow we haven’t seen any way that they are trying to monetize what they’re doing,” Recorded Future Co-Founder Staffan Truve told YFi PM.
“So our assumption is that the people doing this are either a state-sponsored actor,” or a politically inspired group, he said.
Recorded Future said it discovered this network when it used software designed to hunt for influence operations by foreign governments. The organization then began to spot a pattern.
“We’ve been seeing this roughly starting in March last year and including the European Union elections, so of course this could be a campaign as part of a larger attempt to manipulate the election results in the European Union,” Truve said.
He added that “it’s a classic fear, uncertainty and doubt campaign where they are spreading old stories...and the only motive we can really see is to spread fear.”
Ahead of the 2020 election, fears are widening about foreign powers using social media accounts to exploit political divisions. Over the last year, Twitter has suspended thousands of phony accounts, at least some of which were linked to Russia.
Record Future said the players behind the fishwrap scheme also use a special group of URL shorteners that can track how many people click on their bait. The firm tracked more than 215 social media accounts over the past year that were linked to this scheme, all of which used the same code that could track their effectiveness.
The URL technology could be used to help the suspects isolate words and images that draw in the most users or repeat users.
Truvé’s company found profiles like a user called “The Football Babe,” which reused images from the Paris terror attack in November 2015 to spread the news of a fake attack in March of this year.
“You get a fearful response,” Truve continued.
“You get people retweeting. It’s very hard to say what is the end result impact of this,” he added. “Since it is mostly targeting a European audience, most of these bold events they are talking about are terror events in the UK, Germany and France.”
But whatever the motive, a deeper dive by The Daily Beast found commonalities in the language used across Fishwrap.
While “drone” was the most frequently used word in tweets, with six thousand occurrences, words like “attack,” “Trump,” and “terror” were also recurring. And the implications of these accounts could have a big impact online.
“These guys are running a professional operation,” Truvé said. “They keep track of their results, see how many clicks they can get and of course there’s some demographics of the people who are following this and reading it,” he added.
“This could be in preparation for a future operation where once you’ve established followers to these accounts, you could start spreading genuinely fake news,” he warned.