Investigating Coordinated 'Social' Targeting of High-Profile Twitter Accounts

TL;DR

This paper investigates coordinated social media manipulation campaigns targeting high-profile Twitter accounts, revealing complex tactics involving bots, account hijacking, and strategic follower behaviors to influence political events.

Contribution

It introduces new tools and analyses for detecting coordinated campaigns and characterizes novel phenomena like follower spikes and account circulation on Twitter.

Findings

Identification of coordinated 'social' targeting campaigns.

Detection of unusual follower dynamics and account behaviors.

Evidence of bot networks and hijacked accounts influencing social discourse.

Abstract

Following the 2016 US presidential election, there has been an increased focus on politically-motivated manipulation of mass-user behavior on social media platforms. Since a large volume of political discussion occurs on these platforms, identifying malicious activity and coordinated campaigns is essential to ensuring a robust democratic environment. Twitter has become a critical communication channel for politicians and other public figures, enabling them to maintain a direct relationship with supporters. However, the platform has been fertile ground for large-scale malicious activity. As the 2020 U.S. presidential election approaches, we have developed tools to monitor follower dynamics of some of the most prominent Twitter users, including U.S. presidential candidates. We investigate numerous, strange phenomena, such as dramatic spike and saw-tooth waveforms on follower-count charts; cohorts of user accounts which 'circulate', i.e., re-follow high profile accounts numerous times; and other 'resurrected' accounts, which have recently re-engaged on Twitter after years of non-activity. So through various analyses in these contexts, we reveal multiple, coordinated 'social' targeting campaigns aimed at affecting the outcomes of socially critical events through the use of networks of social automations (bots), often optimizing their social capital through 'compromised' accounts, which have--unbeknownst to the greater world--been hijacked.