#CyberAllianceUncovered: El Mazo and anonymous networks unite to disinform

#CyberAllianceUncovered: El Mazo and anonymous networks unite to disinform

Published on 21 Nov 2023

Members and institutions of the State participated in disinformation campaigns with the support of coordinated anonymous networks.

Disinformation networks that usually coordinate in influence operations allied with Venezuelan state members and institutions to attack the opposition primaries, after X made changes in its policies against unfounded allegations of electoral fraud.


The Venezuelan opposition primaries took place on Sunday, October 22, 2023, however, both disinformation and conversation around these began much earlier. ProBox’s trend monitoring allowed to register the use of the first hashtag of 2023 on X (former Twitter) in Venezuela on the topic; #LaPrimariaVa. This was promoted by the National Primary Commission on February 15, the day of the official presentation event of the opposition’s electoral process. This was answered with a great amount of disinformation, hoaxes and attacks to the process and its candidates, which was increasing even days after its realization.


The highest number of messages on X was registered under the hashtag #Primarias2023, which remained trending for three consecutive days in Venezuela between October 21 and 23. That is, before, during and after the primaries. In parallel, the radical ruling party tried to divert the digital conversation around this event, positioning the hashtag #MegaFraud to discredit the process and, mainly, its results, as well as using the same original hashtag to contaminate the organic conversation. What started as a campaign of radical chavismo in social media, resulted in the opening of an investigation by the Public Prosecutor’s Office against senior officials of the National Primary Commission.


The following investigation reveals that social media accounts that are part of what ProBox has baptized as Anonymous Networks, act in a coordinated manner to misinform and defame (mainly the Venezuelan opposition) since at least 2019 in multiplatform operations, publishing and reusing tags, content and narratives in different social media, while they have also promoted and amplified Diosdado Cabello’s narratives in spaces such as X, demonstrating a possible connection between the two to disrupt Venezuelan digital content.


The online hoax machine of radical chavism


Although #MegaFraud was trending on October 22 in X since early morning hours, the insinuation that the process was misleading and the misinforming contents around the primaries can be traced since July 2023 with at least 10 monthly publications about it, as explained by C-informa previously.


These narratives were initiated from the TV program “Con el Mazo Dando”, hosted by Diosdado Cabello and broadcasted by the state-owned Venezolana de Televisión, from which the radical ruling party launched a digital battle against the opposition elections, promoting the first electoral trend against them on June 14 with #NiPorLasBuenasNiPorLasMalas. In his program, Cabello affirmed that “there is no way that the Venezuelan opposition can govern again” and how it “would be defeated”, if they were to participate in the upcoming presidential elections.


Thereafter, ProBox managed to record seven more trends promoted by Cabello on the subject during eight programs aired between June 14 and October 25. Using the State channel, Venezolana de Televisión, the Vice-President of the United Socialist Party of Venezuela (PSUV) dedicated the daily program tag to talk about the country’s elections, especially about the opposition primaries on October 22 as well as the disqualification of some of the candidates. In it, he implied that even if the opposition were to carry out its internal elections, if the winner were to be “disqualified” (i.e., with a sanction by the Comptroller’s Office suspending political rights, such as electing and being elected, due to administrative irregularities), he would not be able to participate in the presidential elections scheduled for 2024. This makes Cabello and his program one of the protagonists of the disinformative strategy surrounding the primary process.


The use of hashtags from “Con el Mazo Dando” to promote hateful and defamatory narratives against the Venezuelan opposition is not new. On July 28, 2021, the social network X (Twitter at the time) suspended the official account of this program for its repeated violations of the platform’s policies such as the publication of disinformation, discriminatory messages and hate narratives. However, a few months after Twitter was acquired by Elon Musk and became X, the @ConElMazoDando account was reinstated, specifically on March 25, 2023. Just in time to act against the opposition primaries.


The social network X had already announced on August 29 a policy change to “not censor political debate” by which it would no longer delete publications with narratives of fraud accusations or doubts about the vote count, which according to analysts “opens the door to theories of electoral fraud”.


Between January 2020 and October 2023, ProBox has recorded 179 trends promoted by Cabello in its program, accumulating around 3,829,581 tweets. The average of these messages made inauthentically in this period is 39.58%, having its highest level in 2020 when it managed to average at least 49.16% of inorganic messages; demonstrating how the coordination to amplify Cabello’s narratives have contaminated the Venezuelan conversation.


It is worth noting that another of Musk’s changes when transforming Twitter into X, was to close access to the social network’s API, which has meant that organizations and researchers, such as the members of C-Informa, cannot have access to data and information as before, making it difficult to study this platform, which is so necessary in countries with authoritarian and disinformative contexts.


So, with the changes implemented in X, since September 6, 2023, more than a month before the opposition electoral process, Diosdado Cabello was able to use this social network to qualify the primaries as “fraud”, promoting the trend #PrimariasEsFraudeYDesastre which accumulated approximately 1,706 tweets. The insistence in attacking the candidates and the elections did not remain only in X, C-Informa was able to identify that “no te vestir que no vas” (one of the phrases most repeated by Cabello), was used in publications on Instagram, Facebook and TikTok.


ProBox conducted a search of trends promoted in “Con el Mazo Dando” and keywords associated with the process (#PrimariasEsFraudeYDesastre, #PrimariasNoHay, #NoVasNiQueTeVistas, #AsiChillesOPataleesNoVas, Primarias oposición fraude, inhabilitados no van, inhabilitadas moralmente, Maricori no va) in a social listening tool -to monitor social media- to study in detail this conversation between October 2 and November 3, 2023.


The study yielded a sample of at least 1,175 mentions, highlighting October 19 (with 127 mentions), October 25 (120 mentions) and November 1 (108 mentions) as the days with the highest use of these words and tags.


It stands out on October 25, day of the first program of “Con el Mazo Dando” after the primaries, in which #AsiChillesOPataleesNoVas was promoted, denying any possibility that the winner of the opposition process, Maria Corina Machado, could participate in the presidential elections of 2024. This trend accumulated more than 11,500 tweets.


Likewise, the tags #NoVasNiQueTeVistas and #ConElMazoDando accompany the previous one as the most repeated in this search, with messages directly against Machado; many of these accompanied by an edited image to attack her, being the most repeated multimedia content in the conversation of these trends.


In addition, between January 1 and October 19, 2023, the organization Cazadores de Fake News (CFN) identified 17 disinformative contents directly linked to the opposition primary process, in addition to other contents about its candidates, which is close to 39% of the cases monitored by this organization. When delving into the specific narratives related to the primary elections, a predominant focus on the most mediatized candidates of the process was observed: María Corina Machado, Delsa Solórzano and Henrique Capriles.


CFN’s analysis also showed that although the disinformative content directly related to the process was found on different platforms, it was amplified in X by accounts belonging to sympathizers of Nicolás Maduro’s government. For this purpose, accounts associated with the operation of influence in favor of Alex Saab, influential accounts close to Venezolana de Televisión programs such as “La Hojilla” and “Con El Mazo Dando” were used to amplify the dissemination of hoaxes as part of this digital strategy.


Tweets from the accounts Mamba Negra and Marialex Cerezo (close to or sympathetic to the programs “Con El Mazo Dando” and “La Hojilla” identified by CFN) were part of the amplification of hoaxes, totaling more than 72,000 views in some cases. In all the identified contents, the hoaxes, narratives or disqualifications directly against María Corina Machado, such as “María Con Ira”, coincide with those promoted from Venezolana de Televisión programs such as “Con El Mazo Dando”, “La Hojilla” or “Zurda Konducta”.


The disinformative “Anonymous Networks” working with El Mazo


On October 13, the candidate of the Voluntad Popular party for the opposition primaries, Freddy Superlano, declined his candidacy in favor of María Corina Machado. This action triggered the positioning of #MariaCorinaEsLeopoldo in X, in reference to the founder of the orange party, with at least 817 messages according to ProBox’s trends log. Monitoring allowed identifying the initial tweet from the “Con El Mazo Dando” account at 12:39 pm, which was amplified by the “Ni Tan Tukky” account hours later. This has been previously identified as one of the main sources of multiple propaganda campaigns, disinformation and personal attacks on X, mainly against Juan Guaidó, Leopoldo López and other opposition leaders, posing as a humor and entertainment account.


The “Ni Tan Tukky” account (which currently has 332,632 followers) is part of what ProBox calls “Anonymous Networks,” which have been present in the socio-political conversation of Venezuela’s X-trends since at least 2019. Between January 1, 2020 and October 13, 2023, ProBox identified 217 trends promoted by this group of users with no verifiable identity, coordinated among themselves to position certain trends in the digital conversation (140 were registered in 2020, 68 in 2021, seven in 2022 and two in 2023).


Disinformation, personal attacks and propaganda are usually the three main narratives promoted by this group, which have been repeatedly used to divert the focus of attention in the conversation on social media about some relevant event in Venezuela or with the intention of manipulating public opinion in relation to a specific issue.


Initially, the account that ProBox identified as the main source of the trends of these Anonymous Networks was @niTanTukky (Twitter ID: 426040957); however, the baton of coordination passed to another account in June 2020, which has changed its username several times but which Probox has been able to identify to continue tracking its behavior – thanks to its Twitter ID (821098100571959296), which is unique and never changes – is the one that currently goes by the name @CazameEsteFake, having 1,560 followers. She also participated in the #MariaCorinaEsLeopoldo trend.


Another feature of the behavior of “Anonymous Networks” is that the messages with which they usually accompany the tag they want to promote have nothing to do with the text of the tag, most of the time it is “empty” content that only seeks to attract attention through this coordination to simulate that a large number of people are talking about a certain topic. In addition, once the tag is positioned as a trend, these users delete the published messages to try to eliminate the trace of the coordination and the real intention behind the campaigns they promote.


After identifying that for the first time Anonymous Networks echoed the same hashtag that was being promoted by “Con el Mazo Dando” on October 13 (#MariaCorinaEsLeopoldo), ProBox decided to perform the download of lists of users participating in this trend to then proceed to a cross-check with the users detected in #AsiChillesOPataleesNoVas promoted in Cabello’s program on October 25 with 11,500 tweets approximately, finding at least 14 coincidences. That is to say, 14 accounts that made tweets with the hashtag of El Mazo, also participated in the same hashtag attack against María Corina Machado.


By expanding this cross-listing of #MariaCorinaEsLeopoldo users with #CincoVecesSiYJuacata and #NoVasNiQueTeVistas, also belonging to “Con el Mazo Dando”, 26 matching users were found. These findings led to analyze the list of accounts identified in #AsiChillesOPataleesNoVas with other trends promoted by the Anonymous Networks, in addition to the hashtag attacking Machado. These were #GuaidoNoEsOposicion, #GuaidoVacacionesEnUsa, #JMarinCorrupto and #LosLujosDeLeopoldo; finding 25 users coinciding in these narratives of personal attacks and disinformation with Cabello’s tag.


A multiplatform operation


In C-Informa’s publication “Attack on the primaries: from Diosdado’s gavel to AI were used to disinform about the elections”, the Coalition explains how this disinformative operation and specific attacks were not only developed on X, but were also amplified on Facebook, YouTube, Instagram and TikTok. This happened mainly with the narratives driven by the Venezuelan Radical Officialism that started with the tags of the program “Con el Mazo Dando” in X and permeated to the other platforms. In addition, Medianálisis highlights how the falsification of a portal about the process and Venezuelan migration were two narratives of special interest in this disinformative campaign against the opposition elections prior to their realization.


In “La narrativa del ‘fraude’ contra las primarias convocó a viejos conocidos de la desinformación en Venezuela”, the coordination between Venezuelan disinformative actors that have been influential in the country’s digital sphere in previous campaigns is exposed, studying in special detail how after the electoral process, the narrative focused on discrediting the Primaries and invalidating María Corina Machado’s triumph.


On the other hand, the C-Informa Coalition has identified anonymous network accounts in TikTok such as that of “Prensa Walthers Altuve” (who has also been identified in Facebook) that have been in charge of promoting propaganda and disinformation campaigns of the Radical Officialism against the opposition and the primary elections. Among the publications with the highest reach in the last months is a video promoting the narrative that the primary elections were a fraud led by the Primary Commission and the NGO Súmate, with close to 37,000 reproductions, 1,190 likes, 245 comments and 759 shares.


This same mechanism was used in a publication in which part of a statement of Carlos Prosperi was used to link him with the narrative of “Con el Mazo Dando” against Maria Corina Machado. The same publication used the phrase “no te vestir que no vas”, falsely attributed as a statement of the adeco candidate against the candidate, which had at least 13,800 reproductions, 132 likes, 137 comments and 39 shares. It also stands out a publication to promote a disinformative campaign against Maria Corina Machado in which it is assured that she is guilty of the sanctions imposed by the United States, limiting the medical attention of low-income Venezuelans. This reached at least 26,100 reproductions with 1,110 likes, 118 comments, and 646 shares.


Diosdado Cabello also posted videos on TikTok assuring that Maria Corina Machado is not going to the presidential elections, replicating on this social network the same narrative of his X-tags of “no te vestir que no vas”, having a great reach from his personal account.


A video where he reiterates that “there is no possibility for a disqualified person to participate in the presidential elections” had more than 853,400 reproductions, 14,100 likes, 2,776 comments and 1,846 shares; and another one in which he assures that the primaries “were controlled by the United States” with more than 478,200 reproductions, 5,382 likes, 771 comments and 128 shares.


The TikTok account of “Con el Mazo Dando” also talked about the primaries, highlighting a publication of October 30, with the hashtag #AsiChillesOPataleesNoVas, which was also shared on X. This publication has more than 410,000 reproductions, 11,800 likes, 764 comments and 1,067 shares.


An operation on several fronts that intersect and collaborate with each other, pretending to be driven spontaneously by thousands of people, but which can be easily identified as a disinformation network that has previously acted to promote other propagandistic narratives, political attacks and disinformation.


This work is part of the deliveries of the Coalición Informativa “C-Informa”, a Venezuelan journalistic team that aims to confront disinformation and is integrated by Medianálisis, Efecto Cocuyo, El Estímulo, Cazadores de Fake News and Probox with the support of the Consorcio para Apoyar el Periodismo Independiente en la Región (CAPIR) and the advice of Chequeado from Argentina and DataCrítica from Mexico.

Go to all articles
  • Other related contents

  • 01

    #CyberAllianceUncovered: disinformation and gender-tinged online attacks

    Female opposition primary candidates had a higher number of gender-related hoaxes and attacks than male candidates

    Read more
  • 02

    #LupaElectoral: The instant popularity of the Essequibo

    Was the Essequibo massively popular?

    Read more
  • 03

    Blaming all ills on sanctions: Chavismo's disinformation strategy to face the economic crisis

    A lie embellished and nicely packaged as the truth

    Read more
  • 04

    CNN Business: These 'news anchors' are created by AI to spread disinformation in Venezuela

    Artificial intelligence as a disinformation tool in Venezuela

    Read more
  • 05

    Portals of lies: the international swarm of "independent media" at the service of chavista narratives

    The great assembly of disinformation in Venezuela

    Read more
  • 06

    Anatomy of Alex Saab's influence operation

    He went from being a businessman whose international accusations were ignored by the Venezuelan government in 2020, to a public personality defended with the full force of the State in 2022. His media metamorphosis is the product of an extensive influence operation whose history was reconstructed with the use of digital traces.

    Read more
  • Subscribe

    Subscribe to our weekly newsletter

    Subscribe