It Took Twitter a Whole Year to Shut Down This Russian Intel Account
When the cyberspies in Russia’s Main Intelligence Directorate have something to say, they often say it from behind a dramatic persona—think Guccifer 2.0 or the fake hacktivists of CyberBurkut. But judged solely on longevity, the GRU’s most successful false front is a notional 28-year-old University of North Carolina alum named Sophia Mangal.
Styled as a prolific freelance reporter with expertise in Syria, Mangal was first publicly exposed as a GRU front in January 2018. But the Sophia Mangal byline continued to show up on new pro-Assad internet propaganda for months afterwards. It finally appeared to go into retirement after a Daily Beast report in September of last year.
This week, though, Twitter suspended an account, created in 2014, that’s been using the Sophia Mangal name actively since at least August 2018. The suspension came after researchers at Stanford University identified the account in a new paper on GRU disinformation campaigns produced at the request of the Senate Intelligence Committee.
“We communicated to Twitter that the report was coming and discussed some of the personas to corroborate findings,” wrote Renée DiResta, research manager at the Stanford Internet Observatory, in an email to The Daily Beast. Twitter declined to comment.
Mangal is one of several “freelance reporter” personas clustered around the “Inside Syria Media Center” (ISMC), a supposed journalist collective focused on reporting the ground truth from Syria. Mangal was listed as a co-editor at ISMC when Facebook banned the center in August 2018 as part of a purge of fake accounts and pages connected “to sources the US government has previously identified as Russian military intelligence services,” according to Facebook.
The ISMC first came to public attention in 2017 through its aggressive efforts to place bylined English-language stories with U.S. publications. One of those publications, the California-based liberal news site Counterpunch, reported receiving freelance pitches “two or three times a week” for over a year from Mangal, whose first name varied between “Sophia” and “Sophie.”
Mangal’s byline could also be found on more than a dozen other sites, with her ISMC affiliation listed in her bio or the ISMC cited in the story text. “The crux of her works read like regime-sponsored press releases,” Counterpunch wrote at the time. “Virtually all exalted Russia’s military prowess and the tenacity of the Assad regime, as if she was embedded within the Syrian Army.”
Counterpunch became suspicious of Mangal while investigating another ersatz freelance writer called Alice Donovan, who duped Counterpunch into publishing five articles, despite not being a real person. Robert Mueller’s election interference indictment against 12 GRU officers last year listed “Alice Donovan” as one of the fake identities used by the GRU’s Unit 74455. According to Mueller, the Donovan Facebook profile—since deleted—was even used to set up a Facebook page for DC Leaks, a fake whistleblower site used to release some of the emails stolen by the GRU’s hackers.
Counterpunch reporters found that Donovan’s stories were often nearly word-for-word matches with those attributed to Mangal and other supposed ISMC reporters.
On her Linkedin profile Mangal described herself as “an American Patriot, a special investigative writer, and a contributor.” The most detailed version of Mangal’s bio has her as a former media and journalism major at the University of North Carolina at Chapel Hill. But after an extensive investigation, Counterpunch could find no evidence proving that Mangal, or any of the other names affiliated with ISMC, actually exists.
The Daily Beast reached out last year to the email addresses for Mangal and the ISMC, but received no response. Emails sent to the same addresses this week bounced.
Even after the Facebook ban, new Mangal stories continued to circulate on Facebook and elsewhere by way of a Moscow-based “e-journal” called Oriental Review. A characteristic story last year claimed the British government was “trying to cover up the tracks and destroy all the evidence” in the nerve agent poisoning of GRU defector Sergei Skripal, a conspiracy theory heavily promoted online by the Russian government through both attributed and covert channels.
Mangal’s byline appears to have been used for the last time on Aug. 28, 2018, in an article on Oriental Review that was picked up by Zero Hedge.
A cached screenshot of the “sophiamangal” account’s Twitter timeline from September shows it primarily driving traffic to the genuine, pro-Assad news site Al-Masdar News. The account had only 16 followers.
Got a tip? Send it to The Daily Beast here
Get our top stories in your inbox every day. Sign up now!
Daily Beast Membership: Beast Inside goes deeper on the stories that matter to you. Learn more.
