This week, hundreds of protesters set up camp outside the presidential palace demanding that the military overhaul the cabinet, in what would effectively amount to a coup.
Earlier this month, Facebook said it had shut a network of almost 1,000 accounts and pages with 1.1 million followers run by people the company said were linked to the RSF.
The network boosted RSF official media feeds and other content related to the militia, led by powerful General Mohamed Hamdan Dagalo who is deputy head of the ruling Sovereign Council and seen by some Sudanese as harbouring political ambitions.
Representatives for the RSF and Dagalo did not respond to requests for comment. The government had no comment on the RSF-related takedown. Dagalo, widely known as Hemedti, denies he is out for personal empowerment and has said in the past that he is committed to the democratic transition to civilian rule.
Facebook's director of threat disruption, David Agranovich, told Reuters the network was identified by the platform's own internal investigation.
The company also said it removed a second network in June, after being tipped off by Valent Projects, an independent research firm hired by Sudan's Information Ministry to look into activity linked to Bashir loyalists.
Facebook said the network comprised more than 100 accounts and pages and had more than 1.8 million followers.
The Sudanese government's efforts to fight what it describes as ex-regime loyalists working to undermine the transition has not previously been reported.
Loyalists were "working systematically to tarnish the image of the government", the ministry said in a statement to Reuters, referring to social media posts in the network identified by Valent.
In both networks, posts mimicked news media but offered skewed coverage of political events, according to Facebook and some independent researchers.
Those Sudanese with internet access - estimated at about 30% of the 45 million population - depend heavily on social media for news.
The military-civilian partnership that replaced now-jailed Bashir in 2019 has been pushed to breaking point in recent weeks in the aftermath of what authorities called a failed coup attempt.
Civilian officials have accused both Bashir loyalists and the military of stirring up unrest, including in the east of the country where tribal protesters have been blocking shipping at Port Sudan, exacerbating shortages stemming from a long-running economic crisis.
Military leaders deny the accusations and say they are committed to the transition to democracy.
While Facebook says it uses technical signals on its platform to target groups working to mislead users about their identity, researchers like Valent Projects say they rely on analysis of content, noting for example when a single post is shared simultaneously by different accounts.
Valent Projects said the network it identified was more than three times larger than Facebook's assessment, attracting more than 6 million followers and continuing to grow.
It was active as recently as this week, agitating for a military takeover as protesters gathered in central Khartoum, and last month in the aftermath of the coup attempt, said Valent Projects representatives.
"It looks like they were trying to give the impression of grassroots support for such a move," said founder and director Amil Khan.
When asked about the differing assessments, Facebook's Agranovich said the company was confident it had shut down the entire network and that other accounts Valent identified were not connected.
He said Facebook would continue to monitor for any revival of the network.
Some of the network's posts say Prime Minister Abdalla Hamdok is not a Muslim and accuse his staff of being paid in dollars, a charge they have denied.
Contributors promote the return of Bashir, jailed on corruption and other charges and wanted by the International Criminal Court on charges of atrocities in the Darfur conflict. Bashir has denied all charges.
The network amplified calls for civil disobedience in the east, said Zouhir Al Shimale, Valent Projects' head of research.
It also promoted protests ahead of the June 30 anniversary of the coup in which Bashir took power in 1989, according to the research firm.
"People in Sudan thought there was just going to be a massive demonstration because they saw so much activity," said Khan, citing a movement called Akhtona ("Get out of the way") in local Arabic dialect. In the end some 3,500 people showed up.
Contacted by Reuters, three administrators of pages that Facebook left running denied being part of a network.
"The ruling bodies today categorise any criticism of their oppressive policies and poor economic and political management as being related to the former regime," said one of them, who declined to be identified.
The information ministry said it took no legal measures against the pages or administrators. "The Sudanese government is committed to protecting freedom of expression," it said.
Two takedowns previously announced by Facebook, in December 2020 and May 2021, targeted accounts boosting Dagalo and the RSF, according to researchers at Stanford Internet Observatory and the Atlantic Council's Digital Forensic Research Lab.
In both networks Facebook said it found links to the Russian Internet Research Agency (IRA), the officially defunct group accused of meddling in the 2016 U.S. elections.
Anna Bogacheva, who the United States accused of carrying out IRA operations to interfere with elections and political processes, declined to answer questions about IRA when reached by phone.
Agranovich said the most recently targeted network linked to the RSF did not reveal foreign links, and appeared part of a growing trend of domestic influence operations.
(Editing by Aidan Lewis and Mike Collett-White) ((Mike.Collett-White@thomsonreuters.com; +44 7990 560 229;))