#SchuldenDE -- An anti-Ukrainian disinformation campaign on X (Twitter)

Executive Summary

▪ We discovered an active campaign on X (previously Twitter) that is spreading anti-Ukrainian and anti-German narratives. The campaign post identical memes, vidoes, hashtag (such as #SchuldenDE, "Schulden" means "debt") and texts in German and French.

▪ We identified 1341 highly coordinated accounts. A few accounts ("ring leaders") tweet frequently (like @TeresaJ65011882, @davidhopss, @jaypere11, @ssahidtowetto, @VinceCai3). The majority of accounts tweet with very low frequency.

▪ Those 1341 accounts are impersonating people from Germany. For example, account locations are all German cities, and descriptions are German quotes. The account creator is likely Russian-speaking. We discovered Russian websites with identical city names and quotes (even the misspelling is the same).

[Update, Aug 18, 2023] It seems that Twitter has demoted several hashtags including #SchuldenDE, because searching it on twitter.com gives no results. However, accounts that were spreading #SchuldenDE are still active.

Some anti-Ukrainian tweets from this campaign.

How we discovered those accounts

Method 1: identify "ring leaders"

We identified 5 accounts which we call ring leaders. Compared with other bots, those 5 accounts tweet the most frequently, and some of their tweets were liked hundreds of times.

Those high-engagement tweets are very abnormal. Why? Because most tweets from ring leaders receive fewer than 3 likes. The high number of likes are due to coordinated activities.

We identified 6 tweets with abnormally high like counts -- one with 635 likes (200X average)! For each tweet below, we collect all accounts that liked it. Following is a preview of ring leaders and their abnormal tweets.

A list of abnormal tweets with high like count.

The list of abnormal tweet urls we found:

Method 2: search for abnormal hashtag

To generate trending narratives, bots often tweet same hashtag(s). We identified a unique hashtag associated with this campaign -- #SchuldenDE, which means debt in German. We searched for all accounts that shared this hashtag recently. You can replicate our search on Twitter via this URL.

We use Information Tracer to collect and visualize the spread of #SchuldenDE. Below is one graph from Information Tracer that visualizes the cumulative interaction of #SchuldenDE. The x-axis is the timeline, and the y-axis is cumulative interaction (like and retweet). Bigger circle means more interaction.

The graph shows that: (1) the coordinated posting of #SchuldenDE happened on June 30, 2023 (2) the first few tweets were amplified (bigger circles) (3) the rest of the tweets were created one after the other, but received few interaction (y-axis doesn't change much).

A coordinated hashtag sharing event happened on June 30, 2023.

Method 3: search for combination of hashtags and narratives

Because bots also post generic hashtags, it is insufficient to only search for "#SchuldenDE". The challenge with searching other generic hashtags is that results are too noisy and false positives too high. To improve search precision, we iteratively build a complex query that searched for combinations of a generic hashtag, and a narrative spread by the bots.

Our full search query is (Russland #Maennerknast) OR (Deutschland #Maennerknast) OR (ukraine #Maennerknast) OR (Amerikaner #Maennerknast) OR (Selenskyj #Maennerknast) OR (Ukraine #Maennerknast) OR (Russland #YOLO) OR (ukraine #YOLO) OR (Amerikaner #YOLO) OR (Selenskyj #YOLO) OR (Ukrainer #YOLO) OR (Russland #Brandstiftung) OR (Amerikaner #Brandstiftung) OR (Selenskyj #Brandstiftung) OR (Ukrainer #Brandstiftung). You can try the same search query on Twitter via this URL.

Except for a few false positives, all matched accounts are bots.

Below is the Information Tracer visualization. We can see two coordinated sharing events happened on August 9, 2023 and August 10, 2023.

A coordinated hashtag sharing event happened on August 9 and 10, 2023.

Abnormal behavior of bots

By merging and de-duplicating accounts discovered from method one, two, three, we collected 1341 highly suspicious accounts that belong to #SchuldenDE Campaign.

For simplicity, we sometimes use "bots" to refer to those accounts. We do not mean those accounts are fully automated and operate with no human intervention.

We find several abnormal behaviors of those bots, especially the impersonation of people from Germany. Our evidence suggests that the bot creator can speak Russian. Following are the details:

1. Account location: the table below lists the most common locations extracted from account bio. All locations are cities in Germany.

location	counts
(empty string)	31
Düren	8
Zwickau	8
Goslar	8
Bad Oeynhausen	7
Sellin	7
Naumburg (Saale)	7
Meiningen	7
Straubing	7
Emden	7
Gera	7
Bad Arolsen	7
Wolgast	7
Clausthal-Zellerfeld	7
Vfyutqv	6
Lippstadt	6

"Vfyutqv" is very suspicious – it’s probably a misspelling of a Germany town. We identify a Russian website with the exact misspelling https://33tura.ru/goroda-germanii-po-kolichestvu-bukv.

Identical misspelling on a Russian website.

NOTE: after the original blog was published, we received an email from Francesca Visser who works at Institute for Strategic Dialogue. Francesca wrote us: When you have a Russian keyboard, the letters in Vfyutq would correspond to the Russian letters for the German city Manheim (Манхейм) as you can see in the keyboard pasted below. Thanks Francesca!

A Russian keyboard.

In addition, when we Google "Vfyutqv", we find @emingenc18, an account which also has "Vfyutqv" in its bio. @emingenc18 is already suspended by Twitter. Interestingly, Google Cache shows that the last tweet created by @emingenc18 has hashtag "#SchuldenDE".

More investigation is required to audit other active accounts with "Vfyutqv" in its bio, such as @alqawaqzh94.

@emingenc18 is already suspended by Twitter. Interestingly, Google Cache shows that the last tweet created by @emingenc18 has hashtag "#SchuldenDE". The quote in the bio also appears in Russian site khakassia.su. The last tweet says "I have something to say. The cost of supporting the Ukraine conflict has plunged our country into a total energy and economic crisis. #debtDE".

2. Account description: the table below lists the most common descriptions from account bios. All are famous German quotes.

Description	counts	Matched Russian website
(empty string)	53	N/A
Er fragt nach Äpfeln, und du antwortest von Birnen.	14	khakassia.su
Der Mensch denkt, der Gott lenkt.	14	khakassia.su
Alles was du im Leben brauchst ist Ignoranz und Überzeugung, und der Erfolg wird dir sicher sein	14	lingvotech.com
Bis wir 10 Jahre alt sind, sind wir alle Genies	14	lingvotech.com
Ein großer Nutzen von Worten ist es unsere Gedanken zu verbergen.	13	lingvotech.com
...	...

Via exact keyword search, we identified two Russian websites, which together have identical quotes as those posted by bots.

Identical quotes on Russian website http://etv.uksosh.khakassia.su/?page_id=191.

Other abnormal features of those accounts are low friends count, low followers count, no authentic followers, and posting/retweeting/liking the same texts/images/videos.

Conclusion

As the time of writing, this campaign is still active. We saw new accounts registered in recent month (like @AyaChristp95452, created May 2023). We are also tracking new hashtag combinations shared by those bots (like #Baerbock AND #Cannabis). Whoever operates this campaign is well financed.

We have reported this campaign and provided details of all 1341 accounts to X Threat Disruption Team.

Acknowledgement: Max Bernhard from Correctiv shared with me a few hashtags used in this campaign, which I took as the seed for this investigation. Thanks Max!