This is part of a series of investigative reports published in collaboration with Daraj media

Arabi Facts Hub 20.06.2023

The cyber army affiliated with Hezbollah closely monitored the election session that failed to elect a president to the Lebanese Republic. They launched a campaign against the candidate Jihad Azour through some fake accounts and others bearing the names of their owners on Twitter. Here are the details of this electronic campaign."

___________________________________________________________________________

A significant percentage of the accounts participating in the campaign are tweeting from Lebanon, but other tweets come from Iran, Iraq, and Yemen. Additionally, some accounts wrote phrases such as 'In the furnace of Nasrallah, Hezbollah, the axis of resistance and steadfastness, the country of resistance, the proud south.' in their location tabs.

Lebanese parliamentarians failed for the twelfth time to elect a new president for the country amid escalating sectarian disputes between Hezbollah and its opponents, which opens the door for a longer period of Lebanon being without a president. Concurrently, just before the session commenced, there was noted artificial electronic mobilization across cyberspace. A network of Twitter accounts associated with Hezbollah launched a series of hashtags expressing support for the party’s candidate Suleiman Frangieh.

This is not the first time that Hezbollah has used its cyber arm. A report published by the Alma foundation in 2022 revealed the role played by this unit, reportedly managed by Abdullah Qassir, assistant to the party's executive council. Qassir employs more than 100 people in his office in Beirut. This unit is active in attacking the party's critics, in addition to advocating the party’s campaigns through social media.

Several hashtags appeared, including #Suleiman_Frangieh, #Ehden_Massacre, #Intersection_Cutting_and_Disabling and #Azour_Agent_of_Collapse. None of them surpassed the threshold of 10,000 tweets, but they dominated the list of the most discussed topics in Lebanon on the 12th and 13th of June, according to Get Day Trends.

"A screenshot showing the hashtags #Suleiman_Frangieh and  #Azour_Agent_of_Collapse appearing in the list of the most trending topics on Get Day Trends."

The first two hashtags relied on an emotional rhetoric to express support for the presidential candidate closely affiliated with Hezbollah and Al-Assad regime in Syria. It reminded followers of the massacre of Ehden, which took place on June 13, 1978, when the Lebanese Forces attacked the town of Ehden, killing the father of Suleiman Frangieh, the leader of the Marada Movement, Tony Frangieh, along with his wife Vera Qurdahi and their daughter Jihan. This killing took place against the backdrop of mounting disputes over the relationship with Syria. At that time, Suleiman Frangieh survived the attack.

The hashtag #Azour_Agent_of_Collapse focused its attack on the rival candidate. By calling him Siniora's boy, tweeps invoked his role in the controversial Solidere deal when he was the Minister of Finance in Fuad Siniora's government. The hashtag also propagates allegations and accusations of corruption leveled against Azour, sometimes accusing him of stealing "thirty billion dollars" and other times involving "millions of dollars."

The most effective: who leads the campaign?

An analysis of a sample of 2557 tweets shows the participation of at least 596 accounts in coordinating the anti-Azour electronic mobilization campaign, according to estimates from the Gephi tool.

A screenshot of the interaction among the most influential accounts in the hashtag #Azour_Agent_of_Collapse – Gephi

The above diagram highlights the most influential accounts in the campaign, including: @rima_335i, @Ibmayada, @ali7_joud11, @zeinab_al_ali, @sourcecreadible, @nihaya02195930, @ali_angro, @y_o_m_n_a_1, @joury_safeidine.

Accounts of journalists and media personalities close to Hezbollah also participated in the campaign. This includes Hussein Mortada, who has worked for the channels Al Manar and Al Mayadeen, and teaches at the University of Damascus. He has photos with the Syrian President Bashar al-Assad. He has around 530,000 followers on Twitter, and manages the Sonar Media Center, which he usually uses to launch or amplify electronic campaigns. Mortada tweeted several times using the hashtag #Azour_Agent_of_Collapse, and his center Sonar produced promotional designs bearing his signature criticizing the candidate.

Within the intricacies of the interaction network, there was a notable node or focal point for the account @ekhbar2022, followed by at least 4,000 accounts. 

The node of this account is not as large as the other accounts, as depicted in the Gephi diagram, but it was remarkably influential, as observed in our monitoring of the Twitter interaction scene. Its impact consists of the reliance of many accounts participating in the campaign on the high-quality video clips it produced, bearing the account's logo. These clips were heavily used on the anti-Azour hashtag, gathering significant interactions

Ekhbar identifies itself as a "news platform dedicated to conveying and scrutinizing news." As of now, the person or entity behind the account is unknown, but it is followed by accounts that are supportive of Hezbollah, including that of Jawad Nasrallah, son of the party's Secretary-General.

Regional and virtual crossing: Who initiated the campaign?

On June 11, an account with the name Al-Multaqa Al-Muqawim called for participation in a campaign using the hashtag #Azour_Agent_of_Collapse across social media networks. The wave was scheduled to start at 8:30 PM on the same day. The account stated that launching the campaign is aimed at preventing the Lebanese people from being misled by the prospect of Azour’s presidency, which only emerged out of a temporary intersection of political contradictions. When initiating the campaign, Al Multaqa Al Muqawim used the same popular videos produced by Ekhbar.

Importantly, Al-Multaqa Al-Muqawim posted one of the most popular videos from Ekhbar at 6:12 PM on June 11, approximately an hour before Ekhbar itself shared the video at 7:14 PM. This suggests a connection between the administrators of both accounts or, at least, a high degree of coordination in launching the campaigns.

Our suspicions were further reinforced by a post carrying the same rhetoric on the Resistance Media Forum channel on Telegram. This post was also broadcast at 6:12 PM on June 11, an hour before Ekhbar’s post.

Activity in the Forum’s channel on Telegram, which has over 5,000 subscribers, appears to function as an operations room for preparing and launching electronic activities. All the hashtags associated with attacking Jihad Azour and their disseminated content appear in the Forum’s channel before appearing on Twitter and dominating the trending topics list.

Al-Multaqa Al-Muqawim’s account on Twitter has around 31,000 followers. It was created in July 2017, and is affiliated with The Association of the New Media Forum- Simia. The Association is headed by an individual named Ali Ahmed, who is frequently present in events linked to Hezbollah.

Previously, we uncovered that the platform initiated campaigns attacking opposition figures and public figures critical of Hezbollah. It has also engaged in campaigns outside Lebanon, in countries where Iran's influence extends, such as Yemen and Iraq, in addition to promoting Tehran. Among these campaigns: #Saudi_is_the_source_of_terrorism_and_destruction, #Yemen_disciplines_Emirates, #Wailing_of_neutrals, #Dear_Iran_thanks

Noteworthy, the hashtag #Victorious_Yemen, supportive of the Houthis, ranked fourth on the list of the most trending topics in Lebanon. For those following the trending list on June 13, it might be surprising at first to see a Yemen-related hashtag trending in Lebanon. However, the surprise fades away when we learn about an invitation in a post on Telegram to participate in the tweeting wave using the Yemen-related hashtag."

Exaggeration and repeated content

Some accounts, mostly created in the years 2020, 2021, 2022, display profile pictures of the Secretary-General of Hezbollah, Hassan Nasrallah, and the Iranian Supreme Leader Ali Khamenei, along with flags of Lebanon and Iran. Accounts that, based on our observation of their activity, appear to be automated, have contributed to the increased dissemination of hashtags criticizing Jihad Azour and the forces supporting him.

An examination of this type of accounts reveals that they publish thousands of tweets in a short period. For example, the account @maya10101995 broadcasted over 20,000 tweets within one year since its creation in March 2022.

In the current campaign, fake accounts have been fed with coordinated sentences to repeat and reproduce.

After the voting session: 51 votes in hand, 59 on the tree

After the failure of the last voting session, a new set of hashtags appeared, mocking the 'Intersection Trend' or the forces supporting Jihad Azour. Among them are #51_votes_in_hand_and_59_on_the_tree and #intersection_cuts

The first hashtag refers to the number of votes received by Suleiman Frangieh (51) during the parliamentary session, compared to the votes for Jihad Azour (59).

Following the style of the Houthi-affiliated "Tweet Bank" channel on Telegram, the Platform channel sought to provide a ready-made script for tweets supported by texts with elaborate and high-quality designs to be published with excerpts from the script. This script was provided by the Platform channel with each hashtag it launches.

Some accounts participating in the hashtag #51_votes_in_hand_and_59_on_the_tree displayed the Iranian flag, images of Iranian figures, and Hassan Nasrallah. They wrote phrases such as "Soldiers of the Khomeini Wilayah” and  “Khomeinists." Besides, their activity indicates that they are likely fake accounts used to amplify the hashtags.

Reverse Response

On the other hand, hashtags criticizing Hezbollah and Iran gained traction, especially after the failure of the major Christian forces to secure the vote in favor of Azour. One of these hashtags was #Erase_the_Shame_of_May7, which garnered 609 tweets with the participation of 223 accounts. The hashtag drew its name from what Lebanese journalist Dima Sadek said during her appearance on the program 'Haki Sadek' on the pro-Azour MTV channel, a day before the vote.

Sadek addressed the parliamentarians, saying: 'You are facing a historic task titled erase the history of shame called May 7.' The hashtag featured the reposting of excerpts from Dima Sadek's words by accounts supportive of electing Jihad Azour and others leaning towards supporting the Lebanese Forces.

Prominent and influential accounts active in the hashtag: @soursouk @kataeb_Ar, @charbelpfrem1, @Georgesnahas4, @TonyGhattas11, @17_techrin

Screenshot of the interactions on the hashtag #Erase_the_Shame_of_May7

According to previous statistics for #Erase_the_Shame_of_May7, the hashtag did not gain significant traction, and the participating accounts seem to belong to regular individuals. Meanwhile, the term 'Iranian occupation' returned to the list of the most trending topics in Lebanon a day after the voting session. Talk about the 'Iranian occupation' was associated with tweets criticizing Iran's role in Lebanon. Comments on this topic are intermittently active from time to time.

Screenshot of the peak times for tweeting on the Iranian Occupation – Get Day Trends

There were also tweets under the hashtag #Lebanon_under_Iranian_occupation. Some tweeps were Saudi accounts, while others expressed opposition to the Iranian regime

The analysis revealed a coordinated campaign by advertising groups closely associated with Hezbollah against the election of presidential candidate Jihad Azour. These groups exchanged content in a manner that reflects their close ties and the presence of a quasi-unified management for these electronic activities. It is noteworthy that journalists and media outlets supportive of Hezbollah and the Syrian government expressed their support for Suleiman Frangieh and participated in the campaign attacking Jihad Azour.

These groups relied on a network of fake accounts to support efforts to amplify and spread hashtags opposing Azour. The Telegram channels linked to entities and individuals loyal to Hezbollah served as a launching point and operations room for the activities of the counter-campaign against Azour. At the same time, there were similar campaigns to support Jihad Azour and attack the forces supporting Suleiman Frangieh, but they did not have the same strength and coordination as the other campaigns.