As Turkish forces continued to bombard the Kurdish militia allied with the United States in its counter-Islamic State campaign in northeastern Syria, Turkish accounts waged a parallel hashtag campaign on Twitter: #BabyKillerPKK.

The campaign was a reference to the Kurdistan Worker’s Party (PKK), a militant political organization in Turkey that the country and many of its allies, including the United States and European Union, have designated as a terror group. The Turkish government does not distinguish between the PKK in Turkey and the Kurdish People’s Protection Units (YPG) operating in Syria, viewing the latter as an offshoot of the former. The United States, in contrast, has been allied with the YPG in its counter-ISIS campaign but has also previously acknowledged a link between the PKK and the YPG, while never officially designating, or even referring to, the latter as a terrorist organization.

While other investigators in this space have now identified the same network, the DFRLab independently found evidence to suggest a portion of the hashtag traffic was driven by bot-like accounts. These accounts exhibited three of the key indicators of bot-like activity: a suspiciously high volume of activity, anonymous profiles, and amplification of other tweets promoting similar narratives.

In the methods it employed, the campaign resembled the June 2019 information operation that supported Libyan warlord Khalifa Haftar’s offensive to take Tripoli. Like the pro-Haftar campaign before it, this anti-PKK operation demonstrated that some actors choose to employ online astroturfing operations as complements to ongoing military offensives.

#BabyKillerPKK began trending on Twitter in Turkey on October 10, 2019, registering roughly 118,000 mentions over a period of 12 hours.

The accounts tweeting the #BabyKillerPKK also pushed a narrative equating the Syrian Kurds and the PKK, often referring to both simply as “YPG/PKK,” and cast both Kurdish entities as terrorist groups that regularly kill innocent civilians, including children.

Some of the accounts used graphic photos of children they claimed were murdered by Kurdish forces; others sought to contrast the “YPG/PKK,” which “uses babies and civilians as live shields” with the Turkish military, which “protects infants and civilians.”

While many of the users tweeting under the hashtag were authentic — some were even verified with tens of thousands of followers — a portion of the traffic appeared to come from bot-like accounts, some of which tweeted out the hashtag roughly a hundred times over the span of a few hours.

The benchmark for suspicious activity varies, but the DFRLab considers 72 tweets per day to be generally suspicious; all of the above accounts achieved that volume.

Volume of activity alone is not a conclusive indicator of automation, however, and a closer look at the accounts confirmed that they exhibited other indicators as well. Some of the accounts were incredibly primitive, with alphanumerical handles and no profile pictures, indicating that the operators had likely used automation software to generate the accounts without bothering to personalize them further.

Other accounts put in more of an effort to avoid detection, albeit not by much. While these accounts had uploaded profile pictures, those pictures were often either cartoons or generic Turkish nationalist symbols. In other words, they maintained anonymity.

Using Sysomos, the DFRLab then obtained a random sample of 4,502 unique accounts that tweeted the hashtag. Filtering the accounts by creation date revealed that 137 had been created in September 2019, while 125 had been created in October 2019. Of those accounts, many were created on the same date:

The most common account creation date was October 10, 2019: the day the hashtag began trending.

These accounts’ recent creation dates, coupled with the fact that they almost exclusively tweeted or retweeted #BabyKillerPKK and related hashtags, suggested that the operators likely created these accounts for the express purpose of boosting this campaign.

The DFRLab cannot attribute the #BabyKillerPPK campaign to a particular entity, although it coincided with the Turkish military’s offensive on Syrian Kurdish forces and overwhelmingly supported the Turkish government’s narrative. And while a number of the accounts exhibited bot-like behavior, it is possible that the campaign was run by a group of dedicated human users who acted in concert to boost the hashtag.

Regardless, these accounts’ activity, anonymity, and amplification suggested that the #BabyKillerPPK campaign was not wholly organic.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.