Detecting a coordinated campaign
A hashtag hostile to a company trends within hours. Analyze accounts, content and timing to decide whether it is spontaneous anger or a coordinated operation.
Briefing
The hashtag #BoycottAquaviva (a fictional mineral water brand) appeared yesterday at 6 pm and was trending nationally by 9 pm. It accuses the brand of “deliberately polluting groundwater”. The communications team wants to know how to respond. You exported the 10 most active accounts, the first messages and the hashtag’s timeline. Goal: characterize the campaign methodically, without publicly naming individuals.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Spot coordinated creation signals
- Detect duplicated content
- Analyze timing synchronization
- Separate seeding, amplification and genuine engagement
- Recommend a proportionate response
Tools used in real investigations
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.