Unmasking Coordination: How Inauthentic Behavior Emerged and Diffusion During the Russia–Ukraine War on Twitter

This study aims to explain the diffusion pathways of coordinated inauthentic behavior during the Russia–Ukraine conflict. A dataset of 685,491 tweets containing the hashtag #russia on Twitter was used to construct a coordination network based on textual similarity and time synchronicity. By identifying leader-follower relationships, analyzing hourly time slices, and analyzing evolution metrics, four key insights were revealed. First, leaders constitute a stable core with an average of about 1741 nodes while peripheral followers fluctuate substantially, indicating a resilient core-peripheral structure. Second, diffusion advances across multiple fronts rather than remaining within single communities, with 67.05% of leader-follower ties crossing content clusters and the top 30 leaders posting across an average of 7.1 clusters and up to 9. Third, apparent synchronization is not driven by posting density alone but arises from rhythmic coupling between leaders and followers, as followers respond after an average delay of about 30 min and cluster peaks typically occur within less than 1 hour of each other. Fourth, diffusion capacity is not released once and for all but regenerates along a trajectory that moves from concentration to multiploidization and then to restructuring. Based on the results, we conceptualize coordinated inauthentic behavior as a strategically adaptive system with regenerative properties and provide governance implications.