Investigation Network Of 263 Cybertroopers Spurs Anwar S Fb Support

---

 


A Malaysiakini investigation has uncovered a network of at least 263 accounts engaging in a coordinated campaign to artificially boost support for Prime Minister Anwar Ibrahim on his official Facebook page.
The operation includes the Facebook account of Syukur Aiman Shukri, a state-level PKR Youth official.
The discovery comes two years after Meta removed a separate, 600-account network engaged in pro-government manipulation, which it linked to the police.
While the two networks operated under different administrations, and the police have denied involvement, the findings suggest that the use of coordinated inauthentic tactics to shape political discourse in Malaysia persists.
Experts who reviewed the findings said the patterns clearly indicate professional astroturfing – a campaign designed to create a false impression of grassroots support.
“(These patterns are) a strong indication of astroturfing, where a small organised set of actors tries to create the appearance of broad grassroots support,” said Nuurrianti Jalli, an expert on online propaganda at Oklahoma State University.
Over a three-month period, comments from this 263-account network comprised nearly one-quarter of all comments sampled by Malaysiakini from the prime minister's posts.
The shared script
The network relied on a shared script of pre-written phrases. These include generic praise like “bukti kerajaan Madani…” (proof that the Madani government is…) and specific talking points such as “gaji minima RM1,700” (RM1,700 minimum wage).
This tactic was designed to create an “illusion of consensus”, according to Ross Tapsell, an expert on Southeast Asian digital media at the Australian National University.
“If voters check the comments, they usually only read the first five to 10, and those comments form their opinion,” he said.
ADSA professional operation
The evidence of coordination goes beyond shared text. The network's most revealing pattern is its work schedule.
An analysis of over 6,000 comments showed the network's activity consistently peaks during weekday afternoons and evenings, with sharp drops on weekends.
In stark contrast, authentic users show the opposite pattern, with their highest engagement occurring during evenings and on weekends.
A compartmentalised structure complemented this professional schedule.
A network analysis revealed the operation is organised into 27 distinct clusters of accounts that frequently post within the same 10-minute windows.
This cellular structure indicates that different groups are activated in coordinated pockets, rather than acting as a single, spontaneous mob.
A network graph visualising the 27 coordinated clusters. Each circle represents an account, while its size represents how often it appeared together with other network members. Lines connect accounts that frequently post together.Unsophisticated machine
While the evidence pointed to a professional and organised campaign, experts who reviewed the findings noted that the operation itself appeared to be of low quality.
A linguistic analysis found the accounts’ vocabulary to be significantly more repetitive and less diverse than that of authentic users on the page.
Benjamin Loh, a researcher who studies Malaysian cybertroopers, described the operation as “lazy and clearly lackadaisical”.
“Cybertroopers of yore... were far more adept at varying their posts,” Loh said, comparing the current network to more sophisticated operations that existed before 2018.
The PKR connection
After the data established the existence of this machine, further investigation identified one of its operators as Syukur, the communications director for the Perlis PKR Youth wing.
When contacted by Malaysiakini, Syukur denied being a “cybertrooper” and stated that he acted independently out of genuine support for his party's president.
“I am a party man, not a cybertrooper,” he said in a text message.
“I comment on my own because I am a party person and the prime minister is the party president, so when he does good things, I comment in support.”
However, Syukur's claim that he comments "on his own" is inconsistent with the on-platform data from his account.
The investigation found that Syukur's account used the same pre-written scripts as the wider network and engaged in rapid crossposting.
On July 23, for example, his account posted six comments on five different posts in under two minutes, using the network's signature phrases.
Syukur Aiman Shukri’s account posting six comments in under two minutes on July 23, and another two in quick succession shortly afterwards.Furthermore, the data confirmed he was not acting in isolation. His account is a member of one of the 27 coordinated clusters, frequently posting in the same 10-minute windows as other network members.
These behaviours - using shared scripts and posting at around the same time with a larger network - are inconsistent with the spontaneous, individual support he described.
Denial and disappearance
The Prime Minister's Office (PMO) denied any knowledge of or involvement with the network, stating there is “no basis or necessity” to direct the MCMC to investigate.
In a response to Malaysiakini, the office confirmed that no taxpayer funds were used and stated that “neither the government, the party leadership, nor its youth wing has issued any directive or provided any funding for such an operation.”
The PMO attributed the activity to individuals exercising their freedom of expression.
However, evidence of shared scripts, professional work schedules, and a coordinated cluster structure contradict this explanation.
Furthermore, in the days following Malaysiakini's enquiries, a significant portion of the network was dismantled.
At least 76 of the 263 identified accounts (29 percent) were removed or made inaccessible.
The removals targeted the network's most important assets: 11 of the 13 high-priority accounts flagged in a dossier sent to Meta – including that of the PKR Youth official Syukur – were among those that vanished.
It remains unclear whether Meta removed the accounts or if the operators acted pre-emptively. Both possibilities point to inauthentic, coordinated activity.
‘Consequences for democracy’
Experts warned that such operations, regardless of their scale or sophistication, pose a risk to democratic discourse.
The Centre for Independent Journalism (CIJ) warned such behaviour can “distort perceptions of public sentiment, drown out dissenting voices, and weaken the public's ability to engage meaningfully in debate”.
Nuurrianti echoes this view. “That has consequences for how citizens interpret online debate and for the health of democratic discourse,” she said.
In response to Malaysiakini’s queries, Meta emphasised it has policies in place to prevent coordinated inauthentic behaviour (CIB), but has yet to find signs of wrongdoing on Anwar’s Facebook page.
“At this time, our review has not found evidence of violations of our CIB policy related to the prime minister’s Facebook page,” a spokesperson said.
This is despite the dossier detailing specific instances where CIB accounts have engaged in rapid crossposting and commenting from a shared script, as well as examples where the accounts have misrepresented their identity to lend authority to their comments. - Mkini

---