Thousands of Twitter accounts have been amplifying pro

It's the latest example of suspicious accounts tweeted in coordination with contentious geopolitical events.

A barrage of social media disinformation has accompanied Turkey’s military incursion into Kurdish-held regions of northern Syria in what is the latest example of friendly Twitter bots backing a government at a time of international scrutiny.

Thousands of Twitter accounts in recent weeks have sent tweets including the hashtag #BabyKillerPKK, according to findings published Wednesday by the Atlantic Council’s Digital Forensic Research Lab. The hashtag is a reference to the Kurdistan’s Worker’s Party (PKK), which the U.S. has designated as a terrorist organization despite the PKK’s ties to the Kurdish People’s Protection Units (YPG), a traditional U.S. ally.

Turkey does not make a distinction between the two groups, and Turkish-backed forces have assaulted Kurdish positions in the days since U.S. military personnel began withdrawing from the conflict at the direction of President Donald Trump. While Turkey’s military has launched airstrikes and backed militias that have killed civilians, bot-like Twitter accounts have sought to sway the world’s opinion in favor of Ankara, and Turkish President Recep Tayyip Erdogan.

This #BabyKillerPKK activity registered roughly 118,000 mentions over a period of 12 hours on Oct. 10, raising the hashtag to a trending topic in Turkey. That was roughly around the time that Turkish military forces intentionally fired shells within hundreds of feet of U.S. troops, according to a U.S. military assessment, the Wall Street Journal reported.

Tweets that included the hashtag referred to the PKK and YPG interchangeably to suggest both entities regularly murder children and innocent civilians, or used them as human shields. Some accounts tweeted the same hashtag hundreds of times within a few hours, though DFRLab stopped short of definitively saying the accounts were bots.

Researchers Zarine Kharazian and Alyssa Kann also did not directly attribute the activity to the Turkish government or any other organization.

“Some of the accounts were incredibly primitive, with alphanumerical handles and no profiles pictures, indicating that the operators had likely used automation software to generate the accounts without bothering to personalize them further,” they wrote.

Other accounts preserved their anonymity by using Turkish nationalist symbols, or images of Erdogan, as their profile pictures.

This activity follows previous activity from similar hashtags, like #TurkeyJustKilledTerrorists and #PeaceSpringOperation, which were amplified by accounts with more than 10,000 followers, Emmi Bevensee, a Mozilla fellow, previously found.

“These accounts almost exclusively (re-tweet) Erdogan propaganda, especially around the offensive, leading me to believe that they are likely [state-run] and possibly coordinated,” she tweeted. “Many have around a million tweets and thousands of followers.”

This activity, which seems unlikely to die down soon, only is the latest example of Turkish information warfare spreading through the internet. Last year, Turkish citizens opposed to President Erdogan united around the hashtag #tamam, which translates into English as “enough is enough.” Many of the roughly 1.5 million tweets sent over a period of 12 hours were organic, and appeared to be legitimate messages of support from human users, one disinformation researcher told CyberScoop.

That momentum may have accelerated when Erdogan, who has been in power for more than 15 years, declared that if the Tamam movement won enough support, he would step aside. Instead, the Erodgan administration dismissed the social media activity as the work of “keyboard heroes” and foreign meddling, though he failed to provide evidence the campaign was anything but organic.

Roughly one month after the Tamam hashtag became an international trending topic, pro-government accounts, including Erdogan’s personal page, tweeted #Devam, which means “carry on” in English.

Now, more than a year later, he appears to be doing just that.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure