Al Mayadeen English

  • Ar
  • Es
  • x
Al Mayadeen English

Slogan

  • News
    • Politics
    • Economy
    • Sports
    • Arts&Culture
    • Health
    • Miscellaneous
    • Technology
    • Environment
  • Articles
    • Opinion
    • Analysis
    • Blog
    • Features
  • Videos
    • NewsFeed
    • Video Features
    • Explainers
    • TV
    • Digital Series
  • Infographs
  • In Pictures
  • • LIVE
News
  • Politics
  • Economy
  • Sports
  • Arts&Culture
  • Health
  • Miscellaneous
  • Technology
  • Environment
Articles
  • Opinion
  • Analysis
  • Blog
  • Features
Videos
  • NewsFeed
  • Video Features
  • Explainers
  • TV
  • Digital Series
Infographs
In Pictures
  • Africa
  • Asia
  • Asia-Pacific
  • Europe
  • Latin America
  • MENA
  • Palestine
  • US & Canada
BREAKING
Sheikh Qassem: Our supporters make up more than half of Lebanon's population, and all of these people are united under the banner of protecting Lebanon, its Resistance, its people, and its integrity.
Sheikh Qassem: There will be no phased handing in of our arms. [The Israelis] must first enact the agreement before we start talking about a defensive strategy.
Sheikh Qassem: Be brave in the face of foreign pressures, and we will be by your side in this stance.
Sheikh Qassem: Stripping us of our arms is like stripping us of our very soul, and this will prompt us to show them our might.
Sheikh Qassem: We will not abandon our arms, for they gave us dignity; we will not abandon our arms, for they protect us against our enemy.
Sheikh Qassem: The US efforts we are seeing are aimed at sabotaging Lebanon and constitute a call for sedition.
Sheikh Qassem: If you truly want to establish sovereignty and work for Lebanon’s interests, then stop the aggression.
Sheikh Qassem: The United States, which is meddling in Lebanon, is not trustworthy but rather poses a danger to it.
Sheikh Qassem: The United States is preventing the weapons that protect the homeland.
Sheikh Qassem: The government’s latest decision [on the disarmament of the Resistance] is non-charter-based, and if the government continues down this path, it is not faithful to Lebanon’s sovereignty.

Hijacked tweets and the clashes in Sudan

  • By Al Mayadeen English
  • Source: Digital Forensic Research Lab (DFRLab)
  • 20 Apr 2023 16:19
  • 2 Shares
7 Min Read

At least 900 potentially hijacked Twitter accounts are being used to repost articles as part of a pro-RSF propaganda war against the Sudanese Armed Forces (SAF), as per a case study by the Digital Forensic Research Lab (DFRLab).

  • x
  • sudan fronts
    An online battle is being waged for the narrative alongside a battle that is being fought with live fire and tanks.

As politics in Sudan take a drastic shift after the emergence of a major divide within the country's armed forces that led to intense military clashes between the Sudanese Armed Forces (SAF) and the Rapid Support Forces (RSF), social media emerged as a powerful tool via which adversaries are fighting through narratives, disinformation, and bots.

Social Media: A Major Player

At least 900 potentially hijacked Twitter accounts are retweeting and liking articles published by the Rapid Support Force (RSF) of Sudan and Mohamed Hamdan Dagalo, the RSF's commander and vice-president of the ruling council of Sudan. The accounts have carried on amplifying RSF information from the start of the violent clashes, which erupted on 15 April 2023, as per a data analysis made by the Digital Forensic Research Lab (DFRLab) at the Atlantic Council.

The findings made public on Tuesday unmasked that an online battle is being waged for the narrative alongside a battle that is being fought with live fire and tanks.

#Sudan is plunged into complete chaos one day after clashes broke out between the #Sudanese Armed Forces (SAF) and a paramilitary group, the Rapid Support Forces (RSF). pic.twitter.com/C4zxUOWKEJ

— Al Mayadeen English (@MayadeenEnglish) April 16, 2023

After harvesting the user data for any account that liked recent tweets posted by Mohamed Hamdan Dagalo the head of the RSF and deputy leader of Sudan’s ruling council, dubbed Hemedti, and by the RSF, the Digital Forensic Research Lab was able to identify the accounts. Since neither the SAF nor its head Abdel Fattah Al-Burhan had active Twitter accounts at the time of data collection, the DFRLab was unable to undertake a study of a comparable nature on them.

The accounts all followed a similar pattern: many were reactivated in December 2022 after going dormant for years, tweeting a string of words plagiarized from Wikipedia pages, before boosting tweets from Hemedti and the RSF. In an effort to appear more authentic, the accounts also tweeted motivational sayings in Arabic.

  • Example of a tweet (top) containing a string of text lifted directly from Wikipedia articles (bottom). (Source: DFRLab @Dilean_Drakuli/archive, top; Wikipedia/archive, bottom)
    Example of a tweet (top) containing a string of text lifted directly from Wikipedia articles (bottom). (Source: DFRLab @Dilean_Drakuli/archive, top; Wikipedia/archive, bottom)

Many of the accounts included indications that they had once been used by actual users, such as links to their own Instagram profiles and tweets with personal information. Nearly none of the 900 discovered accounts followed either the RSF or Hemedti on Twitter, despite their efforts to promote the RSF and Hemedti.

As soon as the accounts began liking posts about the RSF and Hemedti published by journalists, news organizations, and other accounts with a few thousand followers, the behavior pattern altered as of March 30.

Related News

US army hijacks social media to recruit Gen Z amid Gaza bloodshed

National identity reborn; how Iran’s Gen Z tipped the scales of war

  • An example of two accounts in the network that broke the pattern of liking content posted by the RSF and Hemedti by liking a tweet about the RSF from Asharq News. (Source:  DFRLab @siinta_kamelia, left; @WatkinsFAITH698/archive, right)
    An example of two accounts in the network that broke the pattern of liking content posted by the RSF and Hemedti by liking a tweet about the RSF from Asharq News. (Source: DFRLab @siinta_kamelia, left; @WatkinsFAITH698/archive, right)

"On April 1, some of the accounts in the network liked a tweet that read, Our enemy in the first place is the Kizan army, not the rapid support, our enemy in the first place is the Kizan, not the Janjaweed….” Kizan refers to individuals from former President Omar Al-Bashir’s National Congress Party and those supportive of the former regime, while Janjaweed is a reference to the Arab militia that grew into the RSF," the report noted.

  • An example of two accounts in the network that liked a tweet claiming the enemy of the people is not the RSF. (Source: @SerulVr46/archive, top; @WatkinsFAITH698/archive, bottom)
    An example of two accounts in the network that liked a tweet claiming the enemy of the people is not the RSF. (Source:  DFRLab @SerulVr46/archive, top; @WatkinsFAITH698/archive, bottom)

On April 13, two days after the civilian-led transitional administration was supposed to take effect, there was yet another mention of Kizan. The hashtag أي_كوز_ندوسو_دوس# was tweeted by a subset of users, and it approximately translates to "Every Koz, we will trample over them." In this context, the single form of Kizan is Koz. Just after three in the morning, Central African Time, the accounts tweeted the hashtag. The subgroup has not liked or tweeted any further stuff since then.

Several accounts concentrated on retweeting one specific RSF tweet regarding an RSF general's visit to a children's hospital, in addition to liking RSF and Hemedti content. A total of 105 people retweeted the post, with 81 of those tweets coming from the identified accounts. Separately, two accounts responded to the RSF's tweets about Hemedti's most recent trip to Eritrea. The same wording appeared in both of them and said, "Sudan's next president, God willing."

  • Hijacked tweets and the clashes in Sudan
    Screenshots of identical replies from two accounts saying that Hemedti is Sudan’s next president. (Source: DFRLab  @SerulVr46/archive, left; @erolskylover/archive, right)

The accounts investigated by DFRLab continued to like posts on Twitter as hostilities between Hemedti and Al-Burhan grew more intense. It's possible that the potentially hijacked accounts are being used to boost the RSF and Hemedti's tweets and appeal to a more global audience with English-language tweets. The accounts also aim to promote the group's narrative about the ongoing clashes-- alleging that Al-Burhan is a radical Islamist and that the RSF responded to an attack initiated by the SAF.

Beam Reports, a Sudanese media site that specializes in fact-checking and misinformation investigations, has previously looked into several of the accounts that are being investigated by DFRLab. Other instances of possibly phony or fraudulent accounts that were being used to advertise the RSF on various social media sites have been uncovered by Beam Reports.

DFRLab reported in October 2021 on a Facebook network engaging in planned unauthentic activity to advance the RSF. Facebook deleted the network because of "coordinated inauthentic behavior on behalf of a foreign or government entity." The network had ties to Saudi Arabia and the United Arab Emirates (UAE). It is worth noting that Hemedti and the RSF have had a long-standing partnership with Saudi Arabia and the UAE.

Fact-checked: Twitter accounts hijacked 

Many of the nine hundred accounts that the DFRLab investigated have been repeatedly hijacked and used for different purposes after being managed by legal people at first, as per the report.

Here are the indicators: previous usage, mismatched usernames and screen names, Generic profile pictures, and suspicious posting times.

  • Screenshots showing mismatched usernames and screen names for four accounts. (Source: @AhmedmezoFouad/archive, top left; @Cindy_Wigiarti/archive, top right; @fatma_kudus/archive, bottom left; @CindyversCG/archive, bottom right)
    Screenshots showing mismatched usernames and screen names for four accounts. (Source:  DFRLab@AhmedmezoFouad/archive, top left; @Cindy_Wigiarti/archive, top right; @fatma_kudus/archive, bottom left; @CindyversCG/archive, bottom right)

 

  • Screenshots of two accounts using the same publicly available picture. (Source: TinEye, top; @cajijdijidjia/archive, bottom left: @cahyatisuhendar/archive, bottom right)
    Screenshots of two accounts using the same publicly available picture. (Source: DFRLab TinEye, top; @cajijdijidjia/archive, bottom left: @cahyatisuhendar/archive, bottom right)

Large scale operation

In response to a search on Meltwater Explore for the term "customers to a brand or product Requires extensive M," provided by user @Dilean_Drakuli, it was discovered that 614 users had posted it between November 1, 2022, and April 17, 2023.

The date and time in each tweet were identical to the times at which they were posted, even if the string itself remained constant. The number of accounts was significantly higher than when the DFRLab first ran this query on March 15, 2023, indicating some of the accounts in the bigger network may have already been deactivated.

DFRLab found a network of perhaps hacked accounts that were promoting the RSF and Hemedti, and it appears that this network is only a minor part of a bigger one. The network tweeted Wikipedia strings, and hundreds of other accounts also tweeted them.

  • =Sampling of some of the Twitter accounts repeating the same string of text. (Source: Twitter)
    A sampling of some of the Twitter accounts repeating the same string of text. (Source: Twitter)

The Wikipedia text followed by an upper case "M" was not always present in accounts that appear to be a member of this wider network. Instead, it appears that several letter mashups were employed as identities.

The aforementioned analyzed data exposed that the dominant forces in Sudan shifted their policies from cutting off internet connectivity to the weaponization of social media alongside an ongoing battle instead.

Read next: Sudanese army: Regional parties are involved in the current events

  • social media
  • RSF
  • Sudan
  • Twitter
  • Sudanese armed forces
  • Rapid Support Forces (RSF)
  • clashes
  • Sudanese army
  • Weaponization of social media

Most Read

Tom Artiom Alexandrovich, executive director of the defense division of the Israeli National Cyber Directorate, undated (Social media)

Israeli-born US prosecutor drops Israeli officer child sex crime

  • Politics
  • 19 Aug 2025
Almost instantly after the Helsinki Accords were signed, organisations sprouted to document purported violations, whose findings were fed to overseas embassies for international amplification. (Al Mayadeen English; Illustrated by Zeinab el-Hajj)

How ‘Human Rights’ became a Western weapon

  • Opinion
  • 23 Aug 2025
Israeli soldiers stand on the top of armoured vehicles parked on an area near the Israeli-Gaza border, as seen from southern Israel, Wednesday, Aug. 20, 2025 (AP)

Palestinian fighters target Israeli soldiers, vehicles in Gaza

  • Politics
  • 21 Aug 2025
Launch of a ballistic missile from Yemen toward the occupied Palestinian territories. (YAF military media)

Yemeni Forces announce firing hypersonic missile at Al-Lydd Airport

  • Politics
  • 22 Aug 2025

Coverage

All
The Ummah's Martyrs

Read Next

All
Israeli Prime Minister Benjamin Netanyahu speaks during a press conference at the Prime minister's office in al-Quds, Occupied Palestine, Sunday, Aug. 10, 2025 (AP)
Politics

Netanyahu deliberately derailing truce with Gaza occupation: Hamas

Irish President Michael Higgins arrives to deliver his speech during a 42nd World Food Day celebration at FAO headquarters in Rome, on Oct. 16, 2023. (AP Photo/Alessandra Tarantino)
Politics

Irish president renews call for UN military intervention in Gaza

US Ambassador to Turkey and Special Envoy to Syria Tom Barrack speaks during an interview with The Associated Press at the US Embassy in Aukar, northern suburb of Beirut, Lebanon, Monday, July 21, 2025 (AP)
Politics

US envoy, Netanyahu discuss restraining attacks on Lebanon, withdrawal

Smoke billows following Israeli airstrikes in multiple areas in Sanaa, Yemen, Sunday, Aug. 24, 2025 (AP)
Politics

Ansar Allah vow sustained Gaza support despite Israeli strikes

Al Mayadeen English

Al Mayadeen is an Arab Independent Media Satellite Channel.

All Rights Reserved

  • x
  • Privacy Policy
  • About Us
  • Contact Us
  • Authors
Android
iOS