Thread by @SlickRockWeb

On July 22nd Wikileaks released 22000 DNC emails that had been previously hacked by Russian GRU agents. On Oct 7th Wikileaks dumped hacked John Podesta emails soon after the seemingly damaging Access Hollywood tape came out where Donald Trump talked about sexual misconduct @ollie

3million tweets from the Russian Internet Research Agency were recently archived & made available by the site @fivethirtyeight. We wanted to look at particular hashtags related to Green Party Candidate Jill Stein and #DemExit
fivethirtyeight.com/features/why-w… @ollie #infosec #osint #opsec

In the second wk of July 2016 #DemExit became a social media campaign & political movement in response to Bernie Sanders formally endorsing rival Hillary Clinton 4 president. Bernie Sanders supporters in particular were encouraged to leave the Democratic Party in protest #infosec

The first significant use of #DemExit on twitter appears 2 have been around May 31st 2016 & the first use by known IRA accounts was July 23rd. Of note is this occurred less than 24 hrs after Wikileaks released 22000 DNC emails that had been previously hacked by Russian GRU agents

It is noteworthy that the Russian IRA trolls were able to quickly mobilize accounts to use the #DemExit immediately after Wikileaks released the hacked DNC emails .. like this example. Google search data also shows July as the first spike in #DemExit

Additional #DemExit spikes occurred on Sept 17 & Oct 7, 2016. Oct 7th is noteworthy because its when Wikileaks released John Podesta's hacked emails soon after the seemingly damaging Access Hollywood tapes & the day US Intelligence confirmed Russia was behind the earlier DNC hack

There was a fair amount of overlap between IRA tweets promoting Jill Stein's candidacy and the #DemExit hashtag. On June 22, 2015 Dr. Jill Stein announces her bid for President running as the Green Party candidate. #infosec #osint #opsec

On Dec. 10, 2015 Dr. Jill Stein attends the 10th anniversary celebration of RT in Moscow. Russian President Vladimir Putin and retired Lt. Gen. Michael Flynn are also seated at the same table. This event would later fuel speculation and conspiracy theories #infosec #osint #opsec

On July 26th, 2016 Green Party presidential candidate Jill Stein posted a tweet using the #Demxit hashtag for the first time and encouraging people to leave the Democratic Party #infosec #opsec #osint

On July 31 eight of the pro-Jill Stein IRA accounts that we found from known data retweeted the following tweet by @mrnegromilitant over the period of an hour

https://twitter.com/mrnegromilitant/status/759620159375937537

July 31, 2016 appears to be the first big spike in pro-Jill Stein activity by the IRA trolls and subsequent spikes on Sep 17, Oct 6 and election day. Unlike the strictly #DemExit tweets the pro-Jill Stein tweets seemed far less coordinated to major events like Wikileaks dumps.

Both campaigns however spiked around Sep 17th, 2016 & its unclear whether this was planned or not. The only major events we could find were the pipe bombing in NJ, explosion in Chelsea neighborhood and mall stabbing in Minnesota. So obviously some terrorism fear was at play

What is clear is that Russian trolls from the Internet Research Agency were attempting 2 promote the narrative of voting for a 3rd party candidate like Jill Stein or not vote at all. They also continued 2 stoke #BLM unrest & even combined topics like Jill Stein #BLM and #DemExit

It should also be noted that these findings are based only on publicly known IRA data. Its our feeling that we are still only looking at tip of the iceberg. In fact some of our recent #Hamilton68 data goes back to 2016 including this accnt which is currently live #opsec #infosec