CIB Modus Operandi
Building on the network first identified and mapped during the Dutch elections of October 2025 and subsequently tied to activity present surrounding the Hungarian elections in April 2026, Trollrensics and Alliance4Europe flagged new activity from connected assets ahead of the Swedish elections in September 2026.
The research began by studying the existing database of mapped assets, where we used the known modus operandi employed in other countries and tried to backtrack it within the Swedish context. The CIB network uses amplification techniques that leverage the X algorithm, by mass following and artificially boosting views of a given local account. The mass following is mostly concentrated around small, hyperactive accounts, artificially inflating apparent follower counts and social credibility; whilst rare cases of interactions with party and popular figures’ content have been seen in previous research, the network’s established method of manipulating X’s recommender algorithm mostly considers smaller accounts. The CIB accounts themselves rarely post and only on occasion interact with posts of their following. The amplification is usually skewed towards right-wing and pro-Russian content, as seen previously in the cases of disproportionate amplification of FvD in the Netherlands and pro-Orbán content in Hungary.
The accounts themselves also follow a specific formula when created; they tend to be fully localised for the target country, including a localised name and handle, stolen profile picture, and limited recorded activity on the account itself. Whilst the accounts tend to present as authentically local, when accessing the profile’s location, however, the origin of the account is put under question as the locations would indicate recurring geolocation clusters e.g. Nigeria, Ghana, Benin, Thailand. Accounts identified in the Swedish context displayed the same inauthenticity markers previously documented and described above; a mixture of profiles with Swedish-language bios, names, and handles, geolocated in Benin and Nigeria for the majority of the cases. One such example would be the account under the name Ingrid Karlsson (@IKarlsson29239), a seemingly Swedish account, found to be located in Benin. The account lacks any activity, uses a stolen profile image, and follows a large number of authentic Swedish accounts.
Fig.1: Example of a Benin-based asset localised to Sweden. Captured on 01/09/2026. Face blurred for privacy, as the image is suspected to have originated from an authentic user.
The recurrence of these assets across three separate national election contexts within roughly twelve months in the Netherlands, Hungary, and now Sweden underscores the persistent and reusable nature of this infrastructure. Rather than being built and discarded for a single election cycle, the network appears to function as standing amplification infrastructure that can be redirected toward new national targets with minimal retooling, raising the analytical priority of tracking it as a continuous cross-border threat rather than a series of isolated incidents.
Research Method
The investigation into the network’s activity ahead of the Swedish elections followed the same phased approach applied to the Hungarian and Dutch branches of the investigation. Phase 1 involved mapping the followers and following lists of two account categories: assets from the previously identified Dutch/Hungarian network observed following Swedish accounts, and Swedish accounts that appeared to be systematically targeted by the network (i.e., consistently followed and occasionally reposted from). Phase 2 isolated the subset of network accounts geolocated to Nigeria, West Africa, or South East Asia within the Phase 1 dataset and collected their followers and following lists. Phase 3 aimed to establish a more precise estimate of network scale by analysing the accounts collected by the end of Phase 2.
This continuity of method allows for direct cross-referencing between the Dutch, Hungarian, and Swedish datasets, enabling us to confirm whether accounts active in the Swedish context overlap with previously identified handles rather than treating the Swedish findings as a standalone network.
Investigating CIB presence in Sweden
We have begun with an authentic Swedish account (@MarkusStorang), which was mass-followed by Benin-located accounts present within the previously mapped database of assets. The account is located in Sweden, including a Swedish name, bio details, and images.
Fig.2: Screenshot of the initially flagged authentic Swedish account, captured on 01/09/2026.
The account in Fig. 2 has been mass-followed by the CIB network, which gives us some clues as to what framing the network is hoping to amplify across the platform. The bio of the account becomes an important clue, as we see the replication of those narratives in the broader focus of the network, as suggested by further data collected. The translated bio states:
“Please don’t link to traditional media,
We never see anything coming / #7klövern”
#7klövern (literally translated from Swedish as “The 7-Clover”) is a highly charged political term used in Sweden. The hashtag is used primarily on social media platforms like X by right-wing commentators, nationalists, and supporters of the Sweden Democrats (SD). The term was originally coined by the Sweden Democrats to lump all the other major established Swedish political parties together into a single, monolithic “alliance”.
After finding authentic Swedish accounts that were followed by the known CIB asset, we retrieved the locations of their followers. According to the previous experience with this operation, we knew it would be likely that other CIB assets would be following the same or thematically similar users. Based on this assumption and the dataset collected, we further analysed the locations of @Markusstirang’s followers. As per our expectations, we were able to find more Benin-based accounts, which were attributable to the CIB network based on behavioural and account markers consistent with previously reconstructed modus operandi. In the course of this investigation, we identified 8,505 total Benin-based accounts consistent with the network’s established markers; however, this figure should not be read as an exhaustive account of the network’s scale, but rather as a reflection of the accounts we were able to identify and process within the time available for this investigation.
The majority of the identified Benin-based accounts share a distinctive visual marker, specifically profile pictures depicting older women in hospital settings. This pattern was first observed during the Dutch investigation and is now recurring in the Swedish dataset, suggesting a shared asset-creation template across national contexts. A further identifying characteristic is the unusually high following count many of these accounts maintain. X caps new accounts at a maximum of 7,500 follows, yet numerous Benin-based accounts in our dataset exceed this figure several times, indicating either aged accounts or manipulation of platform rate limits. Mapping the following lists of these accounts offers valuable insight into the network’s operational focus. Given the established connection between the Benin-based accounts and Swedish X users, it was expected that accounts following Swedish users would do so predominantly or exclusively. To test this, a list of 24 Benin-based accounts was collected, and the locations of their followed accounts were mapped.
Out of the entire list of Benin-based accounts, we picked 24 accounts we were most certain were part of the CIB network. These 24 accounts constitute a purposive high-confidence sample and are not intended to be statistically representative of the full network. Once we processed the list of accounts followed by Benin-based assets and their locations, we did further analysis to understand which accounts were followed by the most Benin-based assets from our sample at the same time, as they are known to coordinate via cross-following specific accounts. As per previous experience with this specific CIB network, the majority of the accounts most followed by these assets post anti-left, right-wing, and polarising content focused on elections. Of the 24 accounts sampled, 14 follow almost exclusively Swedish X users. Of the remaining 10, one account has since been restricted by X since the start of our investigation. The remaining nine follow a majority-Swedish base with a partial secondary-country following. @BrigitteWattie4, for instance, splits its following roughly evenly between Swedish and Dutch accounts (50%/50%), a composition consistent with its Dutch-language bio and its likely repurposing from a Dutch-focused to a Swedish-focused asset.
Two accounts stand out for a distinct secondary focus on Serbia:
- @tarjarauti39512 (not all locations of its following have been mapped) follows 1,960 Swedish accounts and 331 Serbian accounts.
- @vladimirov93600 follows 704 Swedish accounts and 280 Serbian accounts.
None of the remaining 22 sampled accounts show a comparable Serbian following, making this pairing a notable outlier worth flagging for further investigation, potentially indicating either a shared operator managing multiple national portfolios or a transitional phase between target countries, given the proximity to the upcoming Serbian elections on the 1st of May 2027.
To return to cross-following data, to assess the extent to which the Sweden-facing branch of the network has embedded itself within domestic political and public discourse, we used the selected sample of 24 Benin-based accounts identified as operating within the Swedish information space and examined patterns of cross-following across this subset. A prime example of a clear target was an account under the handle of @cajsa123, which seems to be a genuine, active Swedish user who holds views against the Swedish Social Democratic Party (a centre-left progressive party taking part in the election). This user is followed by all of the 24 Benin-based accounts sampled. Some of the content posted by @cajsa123 is highly critical of Magdalena Andersson, the leader of the Social Democratic Party. What is interesting about these posts is that we are able to see the effects of the CIB network on the engagement data of the posts. In Fig. 3 and Fig. 4 below, we are able to see the large discrepancy between the likes, retweets, comments and views. We know this network is used for boosting specific narratives and overall views; however, we are also aware that a limited number of accounts actually interact with the posts and usually simply view and follow the accounts to generate views, which pushes those posts into the recommender algorithms. In Fig. 3, we see that the post has a discrepancy between the views and the engagement rates, with the views reaching 10,400 views, and only accumulating 709 likes.
Fig. 3: A post made by a genuine user @cajsa123 on X, criticising the Leader of the Swedish Social Democratic Party. Engagement and views appear to be skewed. Captured on 03/09/2026.
Fig. 4: A post made by a genuine user @cajsa123 on X, criticising the Leader of the Swedish Social Democratic Party. Engagement and views appear to be skewed. Captured on 03/09/2026.
Similar patterns can be seen in Fig. 4, where the views also vastly outnumber engagement, such as 5,200 views and 124 likes. These large gaps in engagement and viewership rates could be indicative of inauthentic user engagement with content on the platform. When analysing earlier posts from the same account, the views and engagement appear to be more proportionate, as per Fig. 5 and Fig. 6 below. The post viewership metrics for this account in 2025 reflect smaller numbers compared to recent posts. Whilst some posts exist with larger engagement and viewership at the end of 2025, they often consist of quote reposts of content with large origin viewership. Engagement with the older posts also appears to be more proportional to the number of viewership; average engagement percentages compared to viewership in selected posts stayed within 5-10% range compared to total post viewership, excluding outliers. The newer posts, excluding outliers, have been noted to generally be 1-4%.
Fig. 5 and Fig. 6: Two earlier posts from the same authentic Swedish user @casja123. Fig. 5, a post made on 15/11/2025 received a modest viewership and engagement in comparison to more recent posts. Fig. 6 shows a post made on 11/10/2025, which also shows a lower viewership rate compared to recent posts, including more authentic range of engagement. Both captured on 08/09/2026.
To view the broader picture of CIB activity in the Swedish information space, we recorded 3,344 instances where the same individual or entity was followed by multiple accounts within the selected 24 CIB asset pool. This method allows us to isolate targets that are not incidental to any single account’s activity, but rather recur systematically across the network, indicating a shared or coordinated following pattern. In reviewing this list, a number of Swedish political and public figures emerged as recurring targets of this cross-following behaviour. We analysed the top 100 of the accounts most followed by our sample, which returned a majority of accounts on the right wing of the political spectrum; however, we also noticed seven cases of left-leaning accounts, and 4 further individuals we could not clearly place on the political spectrum. This is not without precedent, as a similar minority pattern has been observed in previous iterations of this investigation across the Netherlands and Hungary, where a small number of left-leaning or neutral accounts also appeared within right-skewed data. We remain uncertain as to the precise motivation behind this behaviour. One plausible explanation is that the network itself does not necessarily discriminate on ideological affiliation alone, but rather follows accounts with a specific political aim in mind, to which they were tasked with, meaning the presence of left-leaning or neutral targets may reflect strategic considerations (such as monitoring, mapping, or targeting opposition voices) rather than an inconsistency.
This consistent finding also lends legitimacy to the “guns for hire” framing discussed above; if the network operates as contracted infrastructure available to whichever actor commissions it, its following behaviour would be expected to track the specific instructions and objectives of that client in a given election cycle, rather than reflect an intrinsic ideological aim. Several of them are profiled below alongside relevant background on their public affiliations and any documented reasons for potential targeting, aligned with the presumed modus operandi and political aims of the operation.
- Susanna Silfverskiöld, a Swedish political commentator with a background of working within the party’s parliamentary office as a copywriter, currently serves as a political advisor at the Swedish Prime Minister’s Office under Prime Minister Ulf Kristersson. Politically aligned with the Moderate Party. Built a large following on X as a right-of-center commentator. She is followed by 20 out of 24 tracked Benin-based accounts.
- Jan Ericson, a Moderate Party MP since 2006, sits on the Finance Committee and EU Committee. He is also followed by 20 out of 24 tracked Benin-based accounts.
- Lars Beckman, another Moderate Party MP since 2017. Described by Gelfe Dagblad in the Swedish press as the party’s most combative anti-media figure on X. He is followed by 19 out of 24 Benin-based accounts.
- Mats Skogkär is a conservative columnist (TT reporter for 15 years, then Sydsvenskan leader-writer 2003–2020, now at Bulletin). His current output at Bulletin (a right-leaning outlet) focuses on migration, integration, and domestic politics. He is followed by 18 out of 24 Benin-based accounts.
- Katerina Janouch is a Swedish author of Czech origin. The Guardian reported her citation by “Mediekollen,” a Facebook-based outlet linked to a Putin ally Vladislav Surkov. The post defended her controversial 2017 Czech-TV comments about crime and insecurity in Sweden. The EU’s East StratCom Task Force (EUvsDisinfo) has flagged related narratives as part of its Russian disinformation tracking. She rejects the characterisation. She is followed by 16 out of 24 Benin-based accounts.
- Jessica Stegrud, a Sweden Democrats politician, MEP 2019-2022, Riksdag member since 2022, sits on the Committee on Health and Welfare. She is followed by 15 out of 24 Benin-based accounts.
The left-leaning examples we have found are indicated as follows:
- Stefan Jämtbäck (@fembarnsfarsan) is a Swedish X commentator known for left-leaning commentary on gender, feminism, and Sweden Democrats policy (e.g., a widely-shared 2018 thread on SD’s abortion politics). Not a public figure in an institutional sense, but an established left-of-centre voice with a large following.
- An account under the name “Magnus Överengen” (@SaveTheOpabinia) appears to be a semi-anonymous commentator posting left-leaning, anti-right-wing content.
- Annika Strandhäll, Social Democrat politician; she previously served as Minister for Social Security and Minister for Social Insurance under the Löfven government, and is an MP.
- Gösta Hultén, a left-leaning journalist and human-rights author (co-founder of the Swedish Afghanistan Committee, Charta 2008).
- Ulla Andersson, Left Party (Vänsterpartiet) politician, who is a long-serving Left Party MP, historically the party’s economic-policy spokesperson and a prominent left-wing voice in Swedish politics.
It is imperative to note that this investigation does not accuse or imply that any of the individuals listed were involved in, or had knowledge of, the influence operation. Rather, their inclusion is intended to illustrate the operation’s far-reaching scope and its apparent efforts to manipulate X’s recommender algorithm in the lead-up to the election. A closer reading of this data sample points to two notable patterns.
First, there is a clear skew toward polarising figures rather than mainstream or consensus-oriented voices. The assumption, based on previous research of this network, is that the choice of users followed by the network falls onto accounts which are likely to generate the kind of high-volume, emotionally charged reactions that lend themselves to algorithmic amplification. This is consistent with the network’s modus operandi observed in the Netherlands and Hungary, where amplification consistently gravitated toward divisive rather than moderate content.
Second, and somewhat more curious, is the disproportionate representation of Moderate Party (M)-affiliated figures within the sample. Given that prior iterations of this network in the Netherlands and Hungary showed a clear preference for the most radical or Russia-adjacent party available in each national context (FvD, Fidesz). A target on Moderate-affiliated figures (historically a mainstream, governing conservative party rather than a radical-right one) is a deviation worth flagging. It may indicate an evolving targeting strategy ahead of the Swedish elections, as we are cautious about assuming that the network’s Swedish activity maps neatly onto a single party-political objective, as it can simply reflect which individual accounts happened to generate the most engagement within our sample.
To validate our findings in the initial 24-account sample, we repeated the cross-following analysis using an expanded sample of 100 Benin-based CIB assets. The results substantially corroborate the earlier findings, as all of the political and public figures previously identified in the 24-account sample remain present in the expanded following data, and each saw an increase in the raw number of CIB accounts following them as the sample size grew. This indicates that these were not artefacts of a small or unrepresentative subset, but genuine, recurring targets embedded consistently across the broader network. This consistency strengthens confidence that the figures profiled in this report reflect a deliberate and stable targeting pattern rather than statistical insignificance or coincidence generated by a limited sample.
The broader trend identified in the smaller dataset also persisted at scale, as the expanded 100-account sample continued to show a clear overall skew toward right-wing and Moderate-affiliated figures, consistent with our earlier findings. At the same time, the small cluster of left-leaning and neutral outliers identified earlier also remained present and did not disappear or dilute once the sample size increased. This suggests the outlier pattern is likewise a stable, yet secondary, feature of the network’s targeting behaviour in Sweden. Together, these results give us greater confidence in both the primary finding (a persistent right-wing/Moderate party target amplification) and the secondary finding (a smaller but consistent minority of left-leaning or neutral targets), and suggest that further scaling of the sample would likely continue to reinforce both patterns.
Findings: CIB Presence
Across the sampled accounts, several broader, Sweden-specific patterns emerged that merit inclusion in this report. Composition analysis of the accounts’ following lists showed that those focused on the Swedish information space typically had Swedish users between 50% and 90% of their total following. This can indicate a deliberate national targeting rather than generic activity, especially relevant given the timing ahead of the Swedish 2026 elections. While retweeting has been documented for some accounts in this network, the vast majority of the sampled accounts did not exhibit reposting behaviour, suggesting that follow-based amplification rather than active content sharing remains as the network’s primary lever within its Swedish branch. Beyond the Swedish-majority following, Nigerian-based accounts constituted the second-largest geographical cluster within these accounts’ followings and followers, reinforcing the previously identified overlap between this network and the broader West African-linked infrastructure documented in the Dutch and Hungarian investigations. This could also potentially indicate a cooperative nature between two service providers.
Another interesting finding is that some accounts were first flagged as early as 2024 by Trollrensics’ monitoring software, indicating that at least part of this Sweden-facing activity predates the current election cycle and reflects long-term, dormant, or switching infrastructure rather than assets stood up specifically for the 2026 vote. We further documented a clear instance of operational repurposing consistent with the network’s demonstrated reusability; one account previously active in the Netherlands, carrying a Dutch bio, has since changed its name and pivoted to following exclusively Swedish accounts, mirroring the same pattern of cross-border redirection observed between the Dutch and Hungarian phases of this investigation. Fig. 7 and Fig. 8 show the current account and location listed on X, while Fig. 9 shows the previous changes present in the account since its logging in 2024. Note the date of the change and its proximity to the elections.
Fig. 7 and Fig. 8: an account under the name Catherine Privet and handle @BridgitteWattie4, with a Dutch bio, Benin location, and majority Swedish following. Captured on 03/09/2026.
Fig. 9: Screenshot of the Trollrensics’ software dashboard showing changes made to the account (changes in name, profile picture, and cover photo), made on the 17th of July 2026. Captured on 03/09/2026.
Of the 24 accounts subjected to thorough investigation, the large majority follow exclusively or near-exclusively Swedish accounts, with a small number of exceptions following accounts from additional countries. @BrigitteWattie4 is one such exception, as they follow 1,966 accounts in total, of which 750 users are Swedish and 766 Dutch. Given that the account’s bio remains in Dutch, it was likely originally created to engage with Dutch X users and has since been repurposed toward the Swedish information space, consistent with the network’s demonstrated pattern of redirecting existing infrastructure toward new national targets rather than building new assets from scratch.
Another interesting phenomenon is the automated post made on the 5th of July 2022, from the @BridgitteWattie4 account. The post, written in French, celebrates one-year anniversary on Twitter (now X). Given the Dutch bio and the Swedish focus, should the account be run by a genuine user, the French language settings seem out of place. However, Benin is a Francophone country, which could be reflected in the account’s underlying application settings, leading to inconsistencies like this post in Fig. 10.
Fig. 10: a post made by @BridgitteWattie4 in French. Captured on 03/09/2026.
As previously mentioned, whilst Benin-based accounts are the most prevalent in Sweden, the network did not consist of Benin-based accounts alone but drew in a consistent combination of locations. Those included:
- Nigeria
- Côte d’Ivoire
- Gambia
- Ghana
- Other African locations
- Hong Kong
- Vietnam
- Indonesia
- Malaysia
Of these, Nigeria hosts by far the largest secondary concentration of network accounts. A notable subset of the Nigerian-based cluster consists of repurposed MAGA-affiliated accounts, geolocated to either Nigeria or the United States. While it is possible that a small number of these US-located accounts belong to real individuals, we treat the US-flagged accounts within this cluster as part of the Nigeria-based network rather than as an independent population, given the behavioural consistency involved.
The total number of CIB accounts flagged at the end of this investigation was an astounding 8,505 assets. However, given a longer time period to allow for monitoring and further research into the mapping of the accounts and their targets, we believe the total of assets operating in Sweden to be much higher. The proximity of the elections to the initial flagging of the accounts has led us to carefully pick our data samples and leads, which left a number of avenues for further research open. The total number has been derived from the behavioural markers and account properties, which identified the assets across the following and followers data, retrieved from the target group we uncovered in the first steps of this investigation. The exhaustive numbers of accounts, as well as their further behaviour post-elections, remain to be seen.
DSA Systemic Risk
The underlying algorithmic mechanisms that enable this bot network to operate is the promotion of content based on views and interactions. The network is displaying a relatively distinct pattern of behaviour that X should be able to track and mitigate. Considering the size of the operation and its focus on elections, X should have taken down the assets of the operation.
Following the initial flagging of the network in 2024, X did take down individual accounts, but the underlying systemic issues on the platform seemingly remained the same and the operation was not dealt with further.
Under Article 34 of the DSA, X must actively evaluate how its recommender systems and algorithmic mechanisms spread intentional manipulation or coordinated inauthentic behaviour. An algorithm that blindly promotes content based strictly on views and interactions, without guardrails against coordinated inauthentic behaviour, creates a structural vulnerability. Failing to identify and redesign systems that allow synthetic engagement to artificially boost election-related narratives is potentially a violation of Article 34.
Article 35 of the DSA requires VLOPs to deploy effective, reasonable, and proportionate mitigation measures tailored to specific systemic risks. Merely taking down individual accounts while leaving the infrastructure intact fails this obligation. Once a threat is flagged (as in 2024), the platform must, per the DSA article 35, adapt its defense strategies. Allowing a massive, election-focused operation to persist because the underlying systemic flaws were ignored constitutes a failure to mitigate known threats to civic discourse and electoral processes.
Conclusion
The evidence gathered in this investigation confirms that the CIB network first identified during the Dutch elections of 2025 and traced to the Hungarian elections of 2026 is now actively present within the Swedish information space ahead of the September 2026 general election. The network’s Sweden-focused branch follows the same operational logistics documented in both prior examples. The assets are fully localised, inauthentic accounts geolocated predominantly to Benin and Nigeria (alongside smaller subgroups of Western African and South-East Asian countries), concentrated on mass-following genuine Swedish users rather than content creation, the boosting of which is skewed toward amplifying right-wing and anti-establishment figures and content. The individuals identified as recurring targets of this cross-following behaviour are consistent with the network’s established preference for favourable polarising, high-friction voices capable of generating broader engagement on the platform. It should be stressed that the presence of these individuals within the network’s following data is not, in itself, an allegation of any affiliation, coordination, or awareness on their part; targeted individuals are, in all observed cases, unwitting subjects of the network’s amplification strategy rather than participants in it.
These findings reinforce the pattern established across three consecutive national election cycles; this network is not disposable infrastructure, but a standing, reusable network capable of being redirected toward new national targets with minimal retooling. The discovery of Sweden-focused accounts first flagged by Trollrensics’ monitoring tool as early as 2024 for a different case (the asset which is still active and operational at the time of writing) is a particularly significant finding. This points to the fact that at least part of this infrastructure was pre-positioned well ahead of the current election cycle, rather than assembled in response to it, and raises the concerning possibility that similar dormant assets may already be pre-positioned for future election cycles elsewhere in Europe, such as the curious focus of one of the accounts in Serbia. Despite this network’s activity having been publicly documented across three separate national contexts over roughly twelve months, platform enforcement remains negligible, with fewer than 1% of previously logged accounts restricted, removed, or banned by X. This persistent gap between documentation and platform action shows the need for more decisive and systematic moderation from X, rather than the ad hoc, partial account suspensions observed following the Dutch investigation.
This report should be understood as an initial mapping of the network’s Swedish operation rather than a complete account of its scale or intent. Further research is needed to establish a fuller picture of the network’s operational purpose in the Swedish context. In particular, a deeper, quantified analysis of who the network follows and in what proportion, a clearer estimate of what share of the broader CIB infrastructure is actively engaged with the Swedish information space relative to its Dutch and Hungarian counterparts, and continued monitoring in the lead-up to and following the September 2026 election to determine whether the network’s behaviour shifts, escalates, or is redirected toward a new national target once again.
. 
. 
