Suspicious Social Media Accounts Deployed Ahead of COP29

A network of 71 suspicious accounts on X has been deployed ahead of the UN’s COP29 climate change conference. The accounts aim to give the impression of grassroots support for the Azerbaijan government, according to NGO Global Witness.

Azerbaijan, host of the 29th Climate Conference of Parties (COP29) from November 11 to 22, 2024, has a track record of using coordinated inauthentic accounts on Facebook to target the country’s journalists and democracy activists as well as using bots and troll farms on X to criticize Armenia.

For instance, Meta identified and took down an Azerbaijan-backed cyber espionage and coordinated inauthentic behavior campaign on its platforms in 2022.

Global Witness, an NGO exposing environmental abuse, corruption and human rights violations, investigated Azeri-linked activity on X.

The organization found that the nature of conversations about Azerbaijan on the social platform from July to September has radically changed.

“Of content posted in July, seven of the top 10 most engaged posts were critical of Azerbaijan’s role in the conflict with Armenia. The most-used hashtags (other than #COP29) were #freearmenianhostages and #stopgreenwashgenocide,” Global Witness said in a report published on October 29.

“Now, however, the conversation has changed. Of content posted in September, all of the top 10 most engaged posts were from the official COP Azerbaijan account.”

Recent, Coordinated Network of Suspicious Accounts

Global Witness investigators found 93% of the 71 accounts were set up within the last six months. The suspicious accounts display the same images of nature in their profile and banner pictures, use the same hashtags (#COP29, #COP29Azerbaijan, #KarabakhIsAzerbaijan) and promote the messaging of the Azerbaijan government. Some of these accounts are identical.

The logo of the New Azerbaijan Party, the ruling political party in the country, was also used as a banner picture by some of the accounts.

The majority of posts from these accounts are reposts rather than original posts. In September, 70% of those reposts were of official Azerbaijan political accounts, primarily the COP account.

The reason Global Witness treats these accounts as a single network is that activity coming from all these accounts seems to be coordinated:

• The accounts are connected to each other: Over half of the accounts are linked to six or more of the other accounts. 87% are connected to at least one other account in the network
• They change appearance together: Four of the accounts all posted new profile pictures within five hours of each other
• They sometimes post in a coordinated, sequential fashion: The timing of their posts suggests that some accounts could be controlled by one person who logs in to each account in turn

Astroturfing Campaign Supporting Azerbaijan

Global Witness also observed a group of 111 newly created X accounts of different appearances than the previous set of accounts while amplifying the same messages.

“What we have uncovered here bears the hallmarks of an astroturfing campaign: a coordinated attempt at creating the impression of grassroots support for the Azerbaijan government’s presidency of COP,” Global Witness wrote. “By inflating the reach of government-aligned content, these accounts are drowning out independent critiques of the country’s damning human rights or greenwashing record.”

The NGO did not make any attribution for this campaign but contacted the Azerbaijan government and the COP29 organizers. Neither organization responded to requests for comments.

The NGO also urged X to:

• Investigate whether the Azerbaijan government or others are engaged in platform manipulation, in particular ahead of COP29
• Publicly state who they think is behind the suspicious accounts uncovered here
• Strengthen its safety and moderation efforts to prevent crucial debates such as those surrounding climate change from being overtaken by manipulation efforts