Twitter removes nearly 6,000 accounts spreading Saudi

Many of the tweets spouting anti-Qatar and anti-Iranian messaging, often in Arabic.

Twitter on Friday announced the removal of 5,929 accounts that researchers say had ties to a man accused of recruiting Twitter employees to gather information on Saudi dissidents.

In a blog post, Twitter’s Site Integrity team revealed that the accounts removed this week operated as part of a “significant state-backed information operation” originating within the kingdom of Saudi Arabia. The accounts represent the “core” of a larger network of 88,000 accounts, and primarily were dedicated to liking, retweeting and replying to tweets that were favorable to the Saudi government on issues such as officials’ appearances in Western media and Iranian sanctions.

Twitter attributed the activity to Smaat, a Saudi marketing firm that managed the accounts on behalf of its clients.

“We have permanently suspended Smaat’s access to our service as a result, as well as the Twitter accounts of Smaat’s senior executives,” the company said in the blog post. “Smaat managed a range of Twitter accounts for high-profile individuals, as well as many government departments in Saudi Arabia.”

Twitter also shared data about the accounts with independent researchers for their analysis.

Many of the tweets spouting anti-Qatar and anti-Iranian messaging, often in Arabic, with phrases referencing Tamim bin Al Hamad Al Thani, the prince of Qatar. “Tamimin, you are a liar like your father,” said one tweeted, translated by Renee DiResta, a Mozilla Fellow in Media, Misinformation and Trust, who had early access to the tweet database.

Others focused on Jamal Khashoggi, the Saudi Arabian dissident and Washington Post columnist who U.S. intelligence agencies have determined was assassinated by Saudi agents on Oct. 2, 2018. When Mohammad Bin Salman Al Saud, the crown prince of Saudi Arabia, appeared on “60 Minutes” to deny the government’s involvement in Khashoggi’s murder, the Smaat accounts tweeted aggressively on the topic, DiResta found.

https://twitter.com/noUpside/status/1208015988895055872

The takedown is the latest evidence that international governments are outsourcing their social media influence campaigns to third-parties. What separates this effort from Russia’s use of the Internet Research Agency, for instance, is an alleged effort to infiltrate Twitter itself. Smaat, the Saudi social media firm, was co-led by Ahmed Almutairi, a Saudi man wanted by the FBI for allegedly recruiting two Twitter employees to provide information about Saudi dissidents, according to DiResta.

Almutairi, also known as Ahmed Aljbreen, allegedly convinced two men, one from San Francisco and another in Saudi Arabia, to use their credentials to obtain email addresses, phone numbers and IP addresses that could reveal the location of Saudi government critics. The plot dated back to 2014, and involved the collection of information about Omar Abdulaziz, a Khashoggi associate, among others.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure