Attributed · high confidenceStatus: unknown
GTG-84002 "Deadshot": AI-assisted operation targeting UN accountability on Sudan
Attributed actor: UAE government officials (high confidence as stated by the source)
2025-2026 (disrupted between December 2025 and August 2026)
Although the operation was built so that it could not be traced back to the actors, our investigation linked it with high confidence to UAE government officials.
According to Anthropic, a single actor used Claude to maintain an AI persona that ran five coordinated lines of activity: a network of about 300 inauthentic influencer accounts; a front NGO that copied a real Swiss organization's identity and published state-authored human-rights reports; ghost-written testimonies intended for delivery by two people at the 62nd session of the UN Human Rights Council, written so that neither mentioned the UAE; profiles of 18 members of the European Parliament and prominent journalists; and counter-accountability dossiers on UN Special Rapporteurs who had criticized the UAE's conduct in Sudan. Anthropic banned the accounts on its platform and states it cannot confirm whether the testimonies or dossiers reached their intended audiences. AFP reported that the UAE did not immediately respond to its request for comment.
- Social media (platforms not named in the report)
- Claude (Anthropic)
Sources, tactics and targets (14)
Attributed by
Targets
- UN Human Rights Council proceedings
- UN Special Rapporteurs
- Members of the European Parliament
- Journalists
- Organisations described as Muslim Brotherhood-linked
Platforms
- Social media (platforms not named in the report)
- Claude (Anthropic)
Tactics (DISARM)
- T0143.002 Fabricated Persona: Network of approximately 300 inauthentic influencer social media accounts.
- T0097.207 NGO Persona: Front NGO publishing state-authored human-rights reports.
- T0143.003 Impersonated Persona: Front NGO copied a real Swiss organization's identity; the actor also borrowed the identity of a real Sudanese human rights organization.
- T0085.001 Develop AI-Generated Text: Ghost-written UN testimony and other content produced with an AI model.
- T0154.001 AI LLM Platform: Claude used to maintain the operation's persona across hundreds of sessions.
Front organisations
- Front NGO publishing state-authored human-rights reports (impersonated: A real Swiss organization (not named in the public report))
- Borrowed identity used for UN testimony (impersonated: A real Sudanese human rights organization (not named in the public report))
Last reviewed 2026-10-07
Not attributedStatus: unknown
Four AI-written "news" sites running a paid campaign on Sudan's war
Attributed actor: Not attributed (sites run through a Hong Kong-registered company; client unknown)
May to September 2026
I have not found evidence showing who hired whom. The operational coordination and one-sided paid campaign are clear. What we still don't know is the customer.
Marc Owen Jones documents four linked websites presented as independent news outlets, set up in May 2026, that began advertising in July 2026. He counted 558 ads across Meta and LinkedIn and found no ad critical of the RSF; detection tools scored the sites' content as AI-written. Advertising was paid through a Hong Kong-registered company set up by North Macedonian nationals. One site's Instagram and X accounts were suspended. The client behind the campaign is not identified.
- LinkedIn
- Facebook
- Instagram
- X
- Websites
Sources, tactics and targets (7)
Attributed by
Targets
- Professional audiences on LinkedIn
- Online audiences following the Sudan war
Platforms
- LinkedIn
- Facebook
- Instagram
- X
- Websites
Tactics (DISARM)
- T0097.202 News Outlet Persona: Four sites presented as independent news outlets.
- T0114 Deliver Ads: 558 ads across Meta and LinkedIn.
- T0085.001 Develop AI-Generated Text: Site articles scored as AI-written by detection tools.
Front organisations
- Four websites presented as independent news outlets
Last reviewed 2026-10-07
Not attributedStatus: active
Sockpuppet and bot networks on X shaping narratives about the Sudan war
Attributed actor: Not attributed (networks described as state-aligned)
December 2022 to November 2025
These systems are hard to attribute definitively, and their inherent ambiguity allows them to advance geopolitical interests while maintaining plausible deniability.
The report analyses more than 250,000 posts and identifies over 27,000 inauthentic accounts used to promote state-aligned geopolitical narratives about the civil war in Sudan. One network comprised about 310 main sockpuppet accounts supported by over 8,000 bot accounts, producing around 170,000 tweets and retweets between December 2022 and December 2024. Some assets have been suspended over time; the report found many still active.
Sources, tactics and targets (5)
Attributed by
Targets
- Arabic- and English-speaking audiences on X
- Online audiences following the Sudan war
Platforms
Tactics (DISARM)
- T0143.002 Fabricated Persona: About 310 main sockpuppet accounts in one network.
- T0049.003 Bots Amplify via Automated Forwarding and Reposting: Sockpuppets supported by over 8,000 bot accounts.
Last reviewed 2026-10-07
Not attributedStatus: unknown
Accounts using stolen photos of Somali women to promote the UAE and the RSF
Attributed actor: Not attributed (analysts see alignment with UAE foreign-policy goals)
January 2023 to September 2025
It is not clear who is running the operation, but UAE activities in Somalia are praised, and analysts believe the content is in line with the UAE's foreign-policy goals. [Translated from Arabic by Al Mogran.]
The BBC found more than 100 accounts using stolen photos of real Somali women. On X, 111 accounts published about 47,000 posts promoting the UAE and the RSF, with smaller copies on Facebook and TikTok and nearly identical posts in several languages. TikTok said the account impersonating one influencer was investigated and removed along with a number of others; Meta said it was assessing an account for inauthentic behaviour. The BBC says there is limited evidence to identify who runs the accounts.
Sources, tactics and targets (5)
Attributed by
Targets
- Audiences in Somalia and the Horn of Africa
- Online audiences following the Sudan war
Platforms
Tactics (DISARM)
- T0143.003 Impersonated Persona: Accounts used stolen photos of real Somali women.
- T0084.001 Use Copypasta: Nearly identical posts published in several languages.
Last reviewed 2026-10-07
Not attributedStatus: unknown
"Sama Sudan" Facebook network supporting the Sudanese army
Attributed actor: Not attributed (pages managed mainly from Türkiye and Syria)
2023-2024
This network consists of five main pages, followed in total by more than 787,000 followers, most of which are managed from Türkiye and Syria. [Translated from Arabic by Al Mogran.]
Beam Reports identified a network of five main Facebook pages with more than 787,000 followers in total, most managed from Türkiye and Syria, that published misleading content supporting the Sudanese army and attacking the Rapid Support Forces and civilian political forces. A larger set of accounts amplified the pages by sharing their content into Facebook groups; Beam notes some of these accounts appear to post automatically.
Sources, tactics and targets (7)
Attributed by
Targets
- Sudanese audiences on Facebook
- Civilian political coalitions
- Rapid Support Forces
Platforms
Tactics (DISARM)
- T0151.003 Online Community Page: Five core pages with more than 787,000 combined followers.
- T0119.001 Post across Groups: Accounts repeatedly shared network content into larger Facebook groups.
- T0049.003 Bots Amplify via Automated Forwarding and Reposting: Beam notes some amplifying accounts appear to be run automatically, posting roughly once a minute.
Last reviewed 2026-10-07
Not attributedStatus: unknown
Copy-paste reply network amplifying RSF messaging on Twitter
Attributed actor: Not attributed (network amplified RSF messaging; operator not identified)
April-July 2023
Evidence of a potential inauthentic network of Twitter accounts amplifying the RSF continues to emerge, suggesting coordinated efforts to enhance the image of the paramilitary group both before and after the current conflict broke out.
DFRLab found 227 Twitter accounts that replied to tweets by Hemedti and two RSF accounts using pre-written text. Many accounts appeared to have been originally operated by real users over a decade ago before seemingly being hijacked or sold to third parties; every account was created on one of three days in 2012. An earlier DFRLab analysis in April 2023 described potentially hijacked accounts promoting the RSF. DFRLab does not identify who ran the network.
Sources, tactics and targets (4)
Attributed by
Targets
- Arabic-speaking audiences on Twitter
Platforms
Tactics (DISARM)
- T0084.001 Use Copypasta: 227 accounts posted identical pre-written replies to RSF-linked tweets.
Last reviewed 2026-10-07
Attributed · high confidenceStatus: disrupted
RSF-linked Facebook and Instagram network
Attributed actor: Rapid Support Forces (RSF) (high confidence as stated by the source)
Removed September 2021
linked it to the Sudanese Rapid Support Forces, a paramilitary group operated by the Sudanese Government.
Meta removed 116 Pages, 666 Facebook accounts, 69 Groups and 92 Instagram accounts for coordinated inauthentic behaviour targeting audiences in Sudan, and linked the network to the Rapid Support Forces. The removal came about a month before the October 2021 coup.
Sources, tactics and targets (5)
Attributed by
Targets
- Domestic audiences in Sudan
Platforms
Tactics (DISARM)
- T0151.003 Online Community Page: 116 Facebook Pages removed.
- T0151.002 Online Community Group: 69 Facebook Groups removed.
Last reviewed 2026-10-07
Al Mogran
About