  The rise of social media has been accompanied by a dark side with the ease of
creating fake accounts and disseminating misinformation through coordinated
attacks. Existing methods to identify such attacks often rely on thematic
similarities or network-based approaches, overlooking the intricate causal
relationships that underlie coordinated actions. This work introduces a novel
approach for detecting coordinated attacks using Convergent Cross Mapping
(CCM), a technique that infers causality from temporal relationships between
user activity. We build on the theoretical framework of CCM by incorporating
topic modelling as a basis for further optimizing its performance. We apply CCM
to real-world data from the infamous IRA attack on US elections, achieving F1
scores up to 75.3% in identifying coordinated accounts. Furthermore, we analyse
the output of our model to identify the most influential users in a community.
We apply our model to a case study involving COVID-19 anti-vax related
discussions on Twitter. Our results demonstrate the effectiveness of our model
in uncovering causal structures of coordinated behaviour, offering a promising
avenue for mitigating the threat of malicious campaigns on social media
platforms.
