X removes 13,000 accounts linked to suspected foreign meddling before US midterms

X stated on Wednesday evening that it had removed more than 13,000 accounts involved in three suspected foreign influence operations. The platform linked these campaigns to Iran, Russia, and China, asserting that the networks used inauthentic accounts to post and amplify political content. This action targets candidates and public figures across the entire political spectrum in the United States.

The announcement arrives just before the US midterm elections scheduled for November 3. X described the removed networks as engaging in inauthentic behavior designed to manipulate political debate. The platform emphasized its role as a global town square for these discussions, stating that its job is to keep the conversation authentic, open, and safe for users participating in the upcoming electoral process.

Attribution and Policy Context

X did not publicly explain the specific evidence behind its attribution of these operations to Iran, Russia, and China. According to The Register, the platform points to these nations but provides no public evidence for attribution. This lack of transparency leaves security professionals without detailed indicators of compromise or technical proof of state sponsorship for the removed account clusters.

Separately, X highlighted its Civic Integrity policy, which addresses misleading information about voting logistics and content intended to discourage participation. Reports submitted under this policy are routed into requests for Community Notes. The platform says it uses this crowdsourced feature alongside traditional moderation and may label policy-breaking posts in critical cases to provide context to readers.

Moderation and Scrutiny

Community Notes has faced significant scrutiny regarding its effectiveness. When the European Commission launched formal proceedings against X under the Digital Services Act in 2023, it raised questions about the feature's ability to validate a post's accuracy. This regulatory pressure coincides with X's reliance on crowdsourced context following layoffs and senior departures from its moderation teams after Elon Musk acquired Twitter.

Foreign influence campaigns are not confined to US elections. MI5 chief Sir Ken McCallum said this week that Russia had attempted to interfere in the 2016 Brexit referendum. However, he cautioned against treating that interference as evidence that it changed the final result, highlighting the difficulty in measuring the actual impact of such digital operations on electoral outcomes.

What should you do?

Organizations and individuals monitoring political discourse should verify information from multiple independent sources rather than relying solely on social media feeds. Security teams should monitor for sudden spikes in coordinated posting behavior from new or low-reputation accounts. Users should remain aware that platform attributions may lack public technical evidence, requiring independent verification through threat intelligence feeds.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: Iran

• Monitor official statements from election authorities and fact-checking organizations for verified information about voting procedures and candidates.
• Review social media account histories for signs of coordinated inauthentic behavior, such as identical posting times or repetitive messaging patterns.
• Enable two-factor authentication on all social media accounts to prevent takeover by bad actors attempting to amplify false narratives.
• Stay updated on platform policy changes regarding civic integrity, as moderation approaches and labeling systems may evolve during election periods.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many accounts did X remove in this latest purge?

X stated it removed more than 13,000 accounts linked to three suspected foreign influence operations.

Which countries did X attribute these influence operations to?

The platform linked the operations to Iran, Russia, and China, though it provided no public evidence for these attributions.

What policy does X use to handle misleading voting information?

X uses its Civic Integrity policy, routing reports to Community Notes and potentially labeling policy-breaking posts.