<![CDATA[Coordinated Inauthentic Behavior (CIB) on X threatens public discourse, yet single-method approaches fail to detect implicit coordination. This study proposes a conditional hybrid framework spanning four forensic stages: (1) automated classification using multilingual BERT text embeddings concatenated with 21 numerical features, (2) sockpuppet candidate generation via Sentence-BERT stylometric fingerprinting and cosine similarity, (3) graph-based coordination analysis using the Louvain algorithm, and (4) manual forensic confirmation with OSINT investigation. Trained on the Cresci-2017 benchmark which exhibits substantial temporal and linguistic domain mismatch from our 2025 Indonesian target domain, the BERT model achieved an accuracy, precision, recall, and F1-score of 1.00 on its held-out test partition prior to deployment. The framework was applied to 1,309 Indonesian Military Law (UU TNI) tweets from 720 accounts, which resulted in the identification of 114 suspicious accounts (15.8%) and the extraction of 28 candidate accounts from 6 groups. Manual validation by the authors through side-by-side timeline inspection confirmed one pair of accounts with synchronized and verbatim identical content. The absence of direct network interactions despite high stylometric similarity is interpreted as consistent with implicit CIB evasion strategies, but attribution to organized groups cannot be definitively established on the basis of platform data alone.]]>
