I found 19,000 UAE-aligned bots promoting the Rapid Support Forces after their atrocities in El Fasher
Inside a large-Scale bot network promoting RSF narratives
In November 2025, very soon after the El Fasher massacre, a cluster of Sudan-related hashtags has repeatedly trended on X, in the UAE, Sudan and elsewhere in the Middle East. Together, they advance a strikingly consistent narrative. Abdel Fattah al-Burhan and the Sudanese Armed Forces (SAF) are blamed for starvation, the obstruction of humanitarian aid, and the continuation of the war.
The Rapid Support Forces (RSF), backed by the UAE, by contrast, are framed as disciplined, humane, and receptive to ceasefires. El Fasher, in particular, is portrayed as a city where “life is returning” under RSF control. In short, it was an attempt to whitewash the massacre.
Responsibility for Sudan’s suffering is repeatedly externalised onto a familiar set of regional actors - Egypt, Saudi Arabia, Qatar, Turkey, Iran, and Russia -each framed as enabling war, obstruction, or hypocrisy, while the Rapid Support Forces are normalised as peace-seeking and stabilising. Within this framing, the United Arab Emirates appears selectively humanitarian and absent from blame.
The activity centres on six closely linked hashtags:
This narrative appears across Arabic and French-language content, recurs across multiple hashtags, and resurfaces in sharp bursts of activity. An analysis of roughly 80,000 tweets posted by approximately 21,000 accounts across six coordinated hashtags suggests that this environment is being driven largely by automated amplification. Depending on the metric used, between 18,709 and 19,514 accounts show strong indicators of being bots, corresponding to approximately 89–93 per cent of the total active accounts on the hashtag. These estimates are intentionally conservative and reflect convergence across multiple indicators for triangulation rather than reliance on any single bot-detection metric.
These hashtags began trending around 4 November, shortly after the Al-Fasher massacre - which occurred on 26th October. The hashtags have collectively generated approximately over 91 million impressions. Alongside this, coordinated hashtag repetition, cross-posting in multiple languages, bespoke videos and infographics suggest a co-ordinated effort to create content. The same network, prior to El Fasher, was also specifically criticising Saudi Arabia, and has, since its focus on El Fasher, emphasised support for the independence of South Yemen, and praised the UAE as a true ally.
While not every participant was automated, multiple independent indicators show that the bulk of amplification came from accounts exhibiting coordinated, inauthentic behaviour.
Overall, the dataset reflects a propaganda effort to flood social media with positive information about the RSF, as well as negative information about those countries (and the Muslim Brotherhood) seen as supporting the SAF. The timing also suggests it was an attempt to limit and drown out criticism of the UAE given its support for the RSF. The broader activity of the network also aligns it with UAE foreign policy.
Context: El Fasher Massacre
In late October 2025, Sudan’s Rapid Support Forces (RSF) captured El Fasher, the capital of North Darfur, after a prolonged starvation siege, triggering what human rights experts now believe may be the single worst atrocity of Sudan’s civil war. Satellite imagery analysed by Yale’s Humanitarian Research Lab shows a city emptied of life: once-busy markets, roads and neighbourhoods fell silent within weeks, while newly identified burial and incineration sites suggest large-scale killing and the disposal of bodies. UK parliamentarians have been briefed that at least 60,000 people were killed, and as many as 150,000 residents remain unaccounted for, with no evidence they fled the city. El Fasher remains sealed off from journalists, humanitarian agencies and UN investigators despite RSF pledges to allow access; aid convoys are stranded outside amid the absence of security guarantees, and international experts have declared the city to be in famine.
Data Collection
The core analysis is based on a large corpus of approximately 80,000 tweets posted by around 21,000 accounts, collected across a cluster of Sudan-related hashtags between November 5th and November 19th. Other samples were also taken from these hashtags to obtain different metadata markers (yeah Elon made getting X data harder). These included samples focused on individual hashtags to examine ‘anomalies’ in account creation dates, account applications and degree distributions. The emphasis throughout was on triangulation: comparing results across multiple samples, methods, and indicators rather than relying on any single metric. The consistency of findings across these independent slices of data underpins the findings presented here. Samples of tweets were also scraped from high-likelihood bot accounts to analyse narrative themes. Different collection and analysis tools were used at each stage, depending on the task (NodeXL, Phantombuster, Exportcomments, Gephi, Tableau)
Visual take: Determining number of bots
On a manual visual inspection level, many of the accounts had identical bios, creation dates, tweeting syntax and patterns.
This can be summed up as perfunctory text, generic slogan content, similar hashtag placement often duplicate tweets, sometimes posting in doubles.
Other red flags include names with lots of numbers, generic photos, indicating accounts made at scale and in haste.
Even if you use the new ability on X to see where accounts are from, the results are bizarre. They also indicate how easy the location system is to game. The random sample of four bot accounts below show they are based in Spain, Switzerland, Costa Rica and Croatia. The distribution almost seems random, indicating whoever is running the campaign has some sort of distributed vpn system.
There are indications that whoever has mobilised the botnets has brought together different networks for this campaign, presumably to maximise reach. Not all bots are activated across every hashtag. For example, some of the bots tweet in French and Arabic, some Arabic, some just French - but behaviourally they appear similar. For the purpose of illustration, two clear botnets are demonstrated below. Type A is about hashtag amplification: it promotes the hashtag but includes a banal aphorism in the tweet, typically from an older account. Type B promotes the hashtag along with pointed political commentary, typically from a newer account.
Sequencing
Temporal patterns reinforce this picture. Hashtag activity occurs in short, dense, disciplined bursts, as if a campaign. The chart below shows a clear sequential-activation pattern indicative of a centrally coordinated bot network. Instead of organic overlap between themes, the activity forms discrete, high-volume waves, each tied to a different anti-SAF hashtag. As one wave collapses, the next begins almost immediately, creating a relay-like progression through slogans. The tightly bounded spikes, reflect scripted posting behaviour designed to inflate visibility and push hashtags into trending algorithms. Furthermore, each burst has similar number of posts (approx 13,000), which would not be expected from organic activity. The stepwise handover between hashtags highlights central planning, not spontaneous public engagement.
Such bursts are well-suited to platform dynamics that reward novelty and velocity. Concentrated posting is often sufficient to trigger trending mechanisms, after which visibility itself lends legitimacy to the narrative being promoted. New hashtags ensure the algorithm does not begin to ignore the network (which might be the case if they just used one hashtag).
Technical indicators
Network analysis provides the clearest evidence of coordination. Across the core datasets, approximately 21 per cent of accounts have a ‘degree’ of one, and around 74 per cent have a ‘degree’ of two (zero). A degree is simply the number of connections an account has to another. So a retweet would be one degree. In this case, 2 degrees almost always means it interacted with no one (this may seem counterintuitive but 2 = 0, because it creates a ‘self-loop’, where the account is interacting with itself, one in and one out). In practical terms, that means about 95 percent of all accounts show virtually no interaction with others.
This structure differs sharply from organic political discourse. Even polarised conversations typically show thicker mid-range interaction as users reply, retweet, and cluster. Here, the network collapses almost immediately after degree two. A very small number of accounts exhibit higher degrees—some exceeding 11, 21, or even 40 connections—consistent with a tiny coordinating core surrounded by thousands of accounts simply broadcasting the hashtag.
While retweeting may be an indication of organic activity, it is often not the case on these hashtags. In one instance, a single bot account with a photo of Ronaldo was retweeted by approximately 300 bot accounts, producing a sharp spike in visibility without any sustained interaction or follow-on conversation. So basically, this is bots retweeting bots. The below diagram also highlights what a network looks like where the accounts are amplifying a hashtag, but not really engaging with anyone or having a conversation.
Temporal anomaly (creation-date)
Account-level indicators further support the conclusion that automation dominates this network. Out of a sample of 5,881 unique accounts active on the ‘Al-Burhan’s Army Rejects the Ceasefire’ hashtag, 4,787 (81.4 per cent) were created within a five-month window. One month alone contributed approximately 2,500 newly created accounts, a pattern consistent with coordinated batch creation of accounts for influence operations rather than gradual organic growth.
App anomaly
Tweet-source data adds another layer to confirm the overall volume of bots. Across a sample taken across all hashtags, 96% of tweets were sent via Twitter Web App. While this client (application you send your tweets from) is not inherently suspicious, it is usually the botmaster app of choice, and its near-exclusive use at this scale is not typical of organic political discourse and frequently observed in automated or bulk-posting environments. In most typical contexts, twitter for iphone or twitter for android form the majority of clients, as people tweet from their mobile.
Narrative and stance
Content analysis across thousands of tweets reveals a high degree of narrative discipline. Regardless of your own views on this, the narrative is very specific: The Sudanese Armed Forces (SAF) and Burhan (head of the SAF) are consistently framed as the primary agents of suffering, and those responsible for rejecting a ceasefire. Hunger is described as deliberate policy rather than wartime consequence. Aid obstruction is depicted as intentional, with repeated claims that humanitarian convoys are bombed. Burhan is portrayed as illegitimate, power-seeking, and subordinated to Islamist elements and foreign patrons. Cities associated with SAF control are described as spaces of despair and decay.
By contrast, the RSF is framed as disciplined, humane, and responsive to ceasefires. Tweets emphasise protection of civilians, moral responsibility, and willingness to pursue peace. RSF-controlled areas are associated with stability, recovery, and order. Systematic discussion of RSF abuses is largely absent from the dataset.
One widely shared video shared thousands of times even included the text ‘Brave RSF Fighters’.
One interesting narrative strand concerns El Fasher's “rebirth”. Under the hashtag #عودة_الحياة_للفاشر (life returns to El Fasher), the city is portrayed as emerging from trauma into normalisation. Tweets describe open markets, children playing, smiling residents, and the resumption of daily routines. Religious and cultural imagery is often used to signal continuity and calm. Trauma is acknowledged, but primarily as a prelude to recovery.
Many of the bots shared infographics that appear to be centrally produced and co-ordinated in terms of messaging and aesthetic. As with the rest of the content, they focus on emphasising that the El Fasher massacre is the fault of SAF and the Islamists. These infographics generally appear to be exclusively created to be promoted on the network.
Geopolitics
The network also promotes a consistent geopolitical framing. Egypt is accused of supporting Burhan militarily and enabling or participating in attacks on humanitarian aid. Saudi Arabia is framed as backing Burhan financially and politically, with media outlets accused of sanitising SAF actions. Qatar is criticised for alleged media manipulation and support for Islamist narratives. Turkey, Russia and Iran are accused of supplying weapons and pursuing regional influence through Sudan.
By contrast, content toward the UAE is fairly sparse, but when it exists it is sympathetic. There are retweets highlighting UAE official statements, humanitarian aid pledges, and calls for civilian protection. One of the repeatedly shared videos was celebrating the visit of UAE-based journalist Tasabeih Mubarak to RSF-controlled areas, reinforcing a softer image of engagement and concern.
Yemen and the STC
Notably, the same network has been observed operating in other regional contexts. In December 2025, it was responsible for a large-scale automated campaign promoting UAE-aligned Southern Transitional Council (STC) narratives in southern Yemen, where thousands of bot accounts amplified hashtags advocating Southern independence and portraying STC control as a counter-terrorism and stabilising force. This reuse of the same infrastructure across multiple conflicts underscores that the Sudan campaign is not an isolated episode, but part of a broader, reusable influence operation aligned with UAE regional interests. It is also promoting anti-Saudi hashtags such as #العدوان_السعودي_على_الجنوب (The Saudi aggression against the South).
Mixed histories
The operation does not appear to target Arabic-speaking audiences alone. A substantial subset of content is produced in French, often using French-language hashtags such as “El Fasher se Releve and Le retouer de la vie a Elfasher (life returns to El Fasher).
Some accounts show prior histories of amplifying anti-immigrant or anti-Muslim narratives in European contexts before pivoting into Sudan-related content. It is not clear if this is related, but it is interesting given the increasingly documented alignment between UAE/Israel -aligned propaganda and European far right anti-Muslim and anti-immigrant narratives.
Indeed a strange example of the above is that many of the accounts were retweeting an account called @pepercastor. Pepercastor is a bot account with a storied history. Previously a pro-pride pro-recylcing account that spread vaccine hesitancy - it has now deleted its old history, and transformed into a right-wing xenophobic account. Again, bots promoting bots - but are they the same network?
It is important to note that some of the accounts also show histories of promoting pro migration content or pro-Palestinian content. It’s not sure if this part of just trying to make the the accounts look ‘authentic’ (one for example, retweets a lot of heavy metal posts) or if its from prior/related campaigns, and these are for hire bot networks.
Anti UAE Bots
In addition to massive UAE-aligned botnet critical of the RSF, I identified some anti-UAE bots in my data collection. This subset of fake accounts, many of whom adopted Irish personas, used hashtags like “UAE_Kills_Sudanese_People”". A look at the hashtags revealed a smaller number of bots spamming the trend, but not in the same volume as mentioned above. Indeed, the focus of this analysis has emphasised the aforementioned network because of its sheer scale, but this would be worth exploring further too.
Conclusion
Taken together, the evidence points to a massive, politically aligned influence operation being pushed by approximately 19,000 bots. In the weeks following the El Fasher massacre, roughly 80,000 tweets from around 21,000 accounts generated more than 91 million impressions, with an estimated 89–93 per cent of that activity driven by automated or highly coordinated accounts. These networks worked to rehabilitate the RSF as humanitarian and peace-seeking, externalise blame onto the SAF and its regional backers — Egypt, Saudi Arabia, Qatar, Turkey, Iran, and Russia — and mute scrutiny of the UAE despite its ties to the RSF. The reuse of the same infrastructure across Sudan and southern Yemen underscores that this was not an isolated campaign, but part of a broader, reusable influence apparatus aligned with UAE regional interests. That this scale of synthetic activity was sufficient to repeatedly push hashtags into trending lists also highlights how easily X’s systems can still be gamed: basic velocity, repetition, and account volume remain enough to manufacture visibility, even in the absence of genuine engagement. In an information environment already distorted by war and limited reporting, such amplification attempts to define what appears visible, credible, and true. Finally, 19000 is a lot, and is the largest botnet I have heard of in some time.
Thank you Marc, very thorough. I really like the graph with the cone effect. Do you mind sharing which layout or plugin you used to produce that?
I am going to read this after I clean my room.