#SchuldenDE — An Anti-Ukrainian Disinformation Campaign on X (Twitter)

We discovered an active campaign on X (previously Twitter) that is spreading anti-Ukrainian and anti-German narratives. The campaign posts identical memes, videos, hashtags (such as #SchuldenDE, where 'Schulden' means 'debt' in German), and texts in German and French. We identified 1,341 highly coordinated accounts. A few accounts — 'ring leaders' like @TeresaJ65011882, @davidhopss, @jaypere11, @ssahidtowetto, @VinceCai3 — tweet frequently with some tweets receiving hundreds of likes. The majority of accounts tweet with very low frequency. Those 1,341 accounts are impersonating people from Germany: account locations are all German cities, and descriptions are German quotes. Our evidence suggests the account creator is likely Russian-speaking — we discovered Russian websites containing identical city names and quotes, with even the misspellings matching.

We used three methods to discover these accounts. Method 1: identify 'ring leaders' — the 5 accounts that tweet most frequently, some receiving hundreds of likes on individual tweets despite most tweets receiving fewer than 3 likes, indicating coordinated amplification. Method 2: search for the abnormal hashtag #SchuldenDE — Information Tracer visualized its spread and found coordinated posting occurred on June 30, 2023, with the first few tweets amplified and the rest creating a trailing burst with little engagement. Method 3: search for combinations of hashtags and narratives, using a complex query combining generic hashtags with narratives spread by the bots — (Russland #Maennerknast) OR (ukraine #SchuldenDE) and related variants — which identified accounts with very low false-positive rates. By merging and de-duplicating accounts from all three methods, we collected 1,341 highly suspicious accounts belonging to the #SchuldenDE campaign.

The impersonation evidence is compelling. All account locations are cities in Germany. All account descriptions are famous German quotes sourced from Russian websites — via exact keyword search, we identified two Russian websites containing identical quotes: etv.uksosh.khakassia.su and lingvotech.com. One particularly revealing data point: 'Vfyutqv' appears as a location in 6 accounts. It's a misspelling of a German city — and we found a Russian website (33tura.ru) with the exact same misspelling in a list of German cities. After the original blog was published, Francesca Visser from the Institute for Strategic Dialogue noted: when you have a Russian keyboard, the letters in 'Vfyutqv' correspond to the Russian letters for 'Mannheim' — further confirming the Russian-speaking operator. Other abnormal features include low followers count, no authentic followers, and posting/retweeting/liking the same texts, images, and videos across all accounts.

“Information Tracer identified 1,341 highly coordinated accounts spreading anti-Ukrainian and anti-German narratives via …”

As of the time of writing, this campaign was still active — new accounts were registered as recently as May 2023. We saw new hashtag combinations being shared by the bots (like #Baerbock AND #Cannabis). Twitter had demoted several hashtags including #SchuldenDE, but accounts that were spreading it remained active. We reported this campaign and provided details of all 1,341 accounts to the X Threat Disruption Team. This case illustrates how coordinated inauthentic campaigns targeting European political sentiment operate: using language barriers, local impersonation, and coordinated amplification to manufacture the appearance of grassroots opposition to support for Ukraine. This is a repost from the Information Tracer Blog by Zhouhan Chen, with thanks to Max Bernhard from Correctiv for sharing seed hashtags.