Research by The Washington Post, misinformation tracking firm Alethea and others found that the earliest confirmed Twitter posting of the image came from an account called @CBKNEWS121. In its less than two years on Twitter, CBK has posted a grab-bag of references to QAnon and other baseless conspiracy theories, current events, and memes and statements praising former president Donald Trump and Russian President Vladimir Putin. On May 3, it tweeted “I stand with Putin,” followed by a heart emoji.
CBK is in the new wave of Twitter accounts with blue check symbols that only mean the accounts were paid for but boost how often and how prominently their tweets appear. Taking advantage of other changes in Twitter standards and enforcement, some of the early amplifiers used the name of a real media organization to enhance credibility.
The hoax served the interests of some of the most significant forces behind viral misinformation — quick-buck artists and those who serve them, fringe attention-seekers and state propagandists — which can form long-running or ad hoc alliances that overwhelm the reduced watchdog staffing at the biggest social networks.
Alethea told The Post the CBK account probably was tied to a photo retoucher in the Los Angeles area named Nova Sayadian.
Its research turned up a Telegram account, @hsretoucher17, that heavily promotes @CBKNEWS121 content. A suspended Twitter account, @HSRetoucher, used the email address order@headshotretoucher.com. The Internet Archive shows that Twitter account, like @CBKNEWS121, featured content about conspiracy subject JFK Jr., along with QAnon imagery and slogans. Headshotretoucher.com had as a subdomain nsayadian.headshotretoucher.com.
One of the LinkedIn listings for people named “Nova Sayadian” is a profile for a photo retoucher based in the Los Angeles area. Attempts to reach him at his listed employer were unsuccessful, and he did not respond to a direct message on LinkedIn.
Direct Twitter messages to @CBKNEWS121 also went unanswered.
CBK’s tweet of the Pentagon hoax May 22 was seen more than 50,000 times before being deleted, and a video of that post drew more attention.
A little more than an hour later, the photo was shared with a much larger audience by Twitter accounts such as one known as Walter Bloomberg, which has no ties with Bloomberg News but has amassed more than 600,000 followers by tweeting out headlines from that news service in their first few minutes, when they are available only to paying subscribers. Other financial-themed accounts that piled on included a more recent handle, BloombergFeed, which is likewise unaffiliated with the media company. As the photo spread, the Dow Jones Industrial Average fell 85 points before quickly recovering. BloombergFeed was later suspended; attempts to reach its owner were unsuccessful.
Some of the financial posters also used the social media platform Discord, which has chatrooms devoted to stock movements and cryptocurrency trading, where day traders can latch on to real or imagined events and try to push a given holding up or down before cashing out.
Both overtly and covertly pro-Russian accounts piled on around the same time.
The best known was RT, formerly Russia Today, which had a warning label on Twitter identifying it as government-affiliated before platform owner Elon Musk dropped such labels. Other pro-Russian accounts that got in on the action usually report on the war in Ukraine, some from a consistently pro-Russian perspective.
One of the war-focused accounts, OSINTdefender, told The Post it acted after seeing a reference from the Walter Bloomberg account on another medium. The Walter Bloomberg account said it got the false information from OSINTdefender.
The State Department did not respond to a request for comment.
Misinformation experts said they were intrigued by the effort that went into amplifying the hoax, including the use of accounts that look legitimate or that often post factual information.
Russian media outlets and social media accounts often seize on anything that suggests or might promote divisiveness in the United States, including sowing fear and chaos. But they have also tested the power of fake disasters. In 2014, the Internet Research Agency “troll factory” in St. Petersburg used fake U.S. accounts to push real alarm over an explosion at a fictional chemical plant in Louisiana.
Misinformation experts John Scott-Railton of the Citizen Lab and Kyle Walter of Logically.AI said the stock-promotion world and the universe of Russian propaganda have overlapped before, as with the anti-establishment Twitter account and website Zero Hedge, which also touted the Pentagon hoax. Zero Hedge did not respond to an email seeking comment.
That is even more true in the cryptocurrency realm, Walter said, where promoters arguing for a decentralized system like to emphasize U.S. disasters and can openly root for Russia.
“There’s a lot of sharing of Russia stuff by crypto bros,” he said.
Sarah Bils, a former U.S. military technician, was identified in April as one of the people behind “Donbass Devushka” accounts that pretended to report from Russian-occupied Ukraine and that sold merchandise glorifying the Russian army. The accounts were also a key distributor of the U.S. secret documents leaked on Discord. Bils could not be reached.
Now that Twitter users can ask for paid subscriptions or tips, the pursuit of hot news will probably accelerate the spread of false information in multiple online worlds.
“It’s turning into a much more monetizable endeavor,” Walter said. “I would be shocked if we don’t see more of it.”
Jeremy B. Merrill, Drew Harwell, Will Oremus and Magda Jean-Louis contributed to this report.
