Who Is Behind the 29 Claude Accounts?

Unraveling financial transactions, cloud storage orchestration, and algorithmic scripts behind an automated Bengali fake-news pipeline requires comprehensive multi-layered forensic auditing, technical specialists confirmed.

The analytical requirement gained urgency on Monday, September 14, following findings from Anthropic's September 2026 Threat Intelligence Report. Tagged internally as operation 'GTG-54006', an operator based in Gaibandha rotated 29 Claude accounts over 16 months using customized software to manufacture synthetic disinformation at scale. Cyber forensics specialist and International Crimes Tribunal Prosecutor Tanvir Hassan Zoha stated that resolving the technical and financial footprints remains the decisive investigative challenge.

"Determining which payment instruments, hardware units, IP ranges, email aliases, and telephone identities provisioned those twenty-nine accounts constitutes the baseline inquiry," Zoha asserted. He argued that simply terminating platform credentials fails to conclude the investigation; interrogating the authorship of 'fake_news_3.py', the hosting infrastructure of the YouTube bulk uploader, Google Drive cloud staging accounts, and external monetization trails is mandatory. "Resolving these footprints will definitively demonstrate whether this was an isolated ideological initiative, a paid commercial influence campaign, or a node inside an organized infrastructure," he added.

Per Anthropic's operational telemetry, the custom Python script 'fake_news_3.py' queried the Claude API in recurring programmatic batches, yielding 15 headlines, three elaborated text reports, and 15 image-generation prompts per run. Over 16 months, the automated workflow synthesized at least 1,500 headlines, 300 fabricated narratives, and 1,500 visual prompts. The ecosystem integrated cloud staging folders, IP obfuscation via third-party continuous integration (CI) tools, and automated scheduled video distributions through the YouTube API.

The generated narratives maintained an overtly pro-Awami League position, directing fabricated allegations against the BNP, Jamaat-e-Islami, the National Citizens Committee, the interim administration, and student movement coordinators. Crucially, Anthropic underlined that it found zero technical or financial evidence linking the Awami League or state entities to the command structure, discouraging characterizations of it as an officially directed party campaign.

That distinction matters: the content was generated and some of it was distributed, but its actual reach and political impact have not been established.

One person, a content factory
The broader lesson is technological. 

A single operator, 29 accounts, one custom Python program and several cloud and social platforms were enough to create a sustained content-production system capable of producing thousands of pieces of material.

Anthropic’s September report describes a broader shift in which AI reduces the amount of human labour required to run influence operations and makes them more scalable.

For Bangladesh, the risk is particularly significant. During elections, political crises, religious tensions or major social movements, the same infrastructure could potentially produce thousands of fabricated pieces of Bengali content with relatively little human intervention.

Digital investigators recommend cross-correlating payment records, authentication histories, browser fingerprints, network ASN routes, and API endpoint usage metrics. Systematically auditing code metadata, staging dependencies, and hosting servers remains critical for state cyber-defense teams to preempt automated generative disinformation frameworks across digital media spaces.
//DBTech/IH/SME/FOEM//