Venezuelan leftists took to Twitter in attempt to swing Colombian presidential election

Venezuelan leftist organizations orchestrated a disinformation campaign to drive social media narratives supporting a leftist Colombian presidential candidate who is currently polling ahead of the incumbent, according to research published Monday.

The Colombian presidential candidate, Gustavo Petro, is a former member of the M-19 guerrilla movement, a group which U.S. intelligence reports have said once served as a hired gun for the Medellin drug cartels.

An influential Twitter account known as @ChalecosAmarill — since removed by the social media platform — also advocated for additional presidential candidates with foreign policy positions promoted by U.S. adversaries, including in Russia, Venezuela and Cuba, according to the research from threat intelligence firm Nisos.

The @ChalecosAmarill account had more than 144,000 followers before Twitter suspended it on March 12. It supported leftist politicians and movements throughout Latin America, and strongly advocated for Julian Assange, the founder of Wikileaks, according to Nisos. @ChalecosAmarill received an average of 8,760 daily mentions and retweets on Twitter from February 2021 through February 2022, Nisos said.

The intelligence firm’s research highlighted how @ChalecosAmarill leveraged political unrest in Colombia to fuel its growth and support for Petro. The account received more than 8,000 mentions from Colombia-based Twitter accounts on May 5, 2021, which Nisos attributes to anti-government protests and a violent crackdown by police that day. The aggressive government response to the protests has fueled Petro’s rise. Recent polls show Petro overtaking incumbent Ivan Duque.

The @ChalecosAmarill account often “posted disturbing videos that strengthen its digital influence and activism,” the Nisos report says. “Although several of the videos and images are likely true, the context in which many are presented does not appear to be accurate.”

Nisos noted that the account retweeted and mentioned other Twitter users known for disseminating
disinformation, including Iran’s HispanTV, Russia’s RT (in Spanish- @ActualidadRT) and Inna
Afinogenova (@inafinogenova)- RT in Spanish’s deputy director.

According to the research report, the @ChalecosAmarill account is affiliated with now-suspended Twitter accounts belonging to Venezuelan national and left-wing supporter Rafael Nunez, who works for a digital marketing company owned by the former social media director of Venezuela’s Ministry of Communication and Information. U.S. officials ended diplomatic relations with Venezuelan President Nicolas Maduro in 2019, alleging the authoritarian leader had committed electoral fraud. More recently, Maduro has allegedly evaded U.S. sanctions by seeking help from Russia, China and Iran.

Nisos researchers say Nunez’s social media posts also show he is closely tied to an executive at Venezuela’s national telecommunications agency, CANTV. They concluded that there was a “high likelihood” that Nuñez and his associates were responsible for the content found on the @ChalecosAmarill’s Twitter account. They also said the account engaged with known bot networks running digital campaigns in favor of Petro, the Colombian presidential candidate.

Twitter removed the @ChalecosAmarill account without knowledge of the new Nisos research, Nisos’ Vice President Thom VanHorn told CyberScoop. A Brookings Institution report published in January said that social media companies have become more effective at taking down what Twitter calls “state-backed information operations” similar to the @ChalecosAmarill disinformation campaign — but also asserted that influence operations had “evolved in important ways” to avoid being detected by the platforms. Brookings reported that between 2018 and 2020, Facebook and Twitter announced that they had taken down 147 influence operations between them.

‘Political actors are increasingly outsourcing their disinformation work to third-party PR and marketing firms and using AI-generated profile pictures,” the Brookings report said. “Platforms have changed too, more frequently attributing takedowns to specific actors.”

Last November, Nisos published research which showed that hundreds of fake Twitter accounts targeted opposition candidates in Honduran elections. The accounts also reportedly urged citizens not to vote in the Nov. 28 Honduran presidential election. Nisos researchers attributed that effort to a network of 317 accounts which attacked two opposition candidates running against the incumbent National Party of Honduras’ candidate. According to Nisos, those Twitter profiles included authentic photos from Peruvian Facebook accounts to boost perceived legitimacy. Twitter removed the accounts after Nisos notified it of the problem.

VanHorn said Nisos is seeing more and more campaigns like the recently detected operations in Honduras and Colombia. He said the disinformation efforts are “everywhere,” not just in Latin America.

“They’re trying to achieve an objective and sometimes you’ll see them trying to achieve that objective by combining disinformation or misinformation with other things that are truthful,” VanHorn said. “It becomes hard for people to understand: ‘What can I believe anymore?’ Because the truth sort of elevates the lies.”