How the September 2022 Azerbaijan-Armenia clashes played out online

By Givi Gigitashvili and Esteban Ponce de León

Note: this article includes graphic descriptions and blurred-out images of war crimes.

The September 2022 renewal of military clashes between Azerbaijan and Armenia also played out online across social media platforms and messaging apps. On Twitter, manipulated anti-Armenia hashtags portrayed Armenia as the aggressor. Telegram channels shared graphic footage of war crimes, in some cases turning them into digital stickers to make them more shareable. And both governments attempted to restrict access to information, with TikTok facing disruptions, and false narratives spreading in Azerbaijan that claimed Armenia owned the top VPN companies in an attempt to dissuade domestic usage.

Azerbaijan reignited its feud with Armenia on September 13, launching an attack on the border region. That day, Armenia’s Ministry of Defense reported that Azerbaijani armed forces shelled Armenian military positions in Goris, Sotk, and Jermuk. Armenia stated that 204 service members and three civilians were killed in the strikes, while Azerbaijan reported around 100 casualties. Armenian Prime Minister Nikol Pashinyan announced that Azerbaijan had gained ten square kilometers of Armenian territory between September 13 and 14. These gains come in the wake of previous clashes in May 2021, in which Armenia said Azerbaijan gained forty square kilometers of territory.

The day of the renewed attacks, US Secretary of State Antony Blinken urged Azerbaijan to cease its military operations along the Armenian border. State Department spokesperson Ned Price noted that the US had seen “significant evidence of Azerbaijani shelling inside Armenia and significant damage to Armenian infrastructure.” Freedom House also called for Azerbaijan to stop its attacks on Armenia. On September 18, US House Speaker Nancy Pelosi visited Armenia and condemned the attacks. “The fighting was initiated by the Azeris and there has to be recognition of that,” she said. Before Azerbaijan began shelling Armenian military positions, both parties had accused each other of planning and organizing a large-scale provocation.

Analyzing anti-Armenia and anti-Azerbaijan hashtags

After Azerbaijan launched the attack, the DFRLab observed pro-Azerbaijan accounts on Twitter amplifying anti-Armenia hashtags attempting to portray Armenia as the aggressor. Meanwhile, an Azerbaijani hashtag campaign amplified by the youth wing of the ruling New Azerbaijan Party (YAP) sought to discredit Azerbaijani journalists and opposition figures who opposed the attacks on Armenia.

The DFRLab analyzed two clusters of hashtag activity that emerged around the time of the September 2022 clashes, including one set of anti-Armenia hashtags and one set of anti-Azerbaijan hashtags. For each set, we collected Twitter posts using eight hashtags between September 1 and 26. The most common anti-Armenia hashtag was #StopArmenianAggression, followed by #StopArmenianTerror. Notably, during Nancy Pelosi’s visit to Armenia, pro-Azerbaijan accounts began amplifying the hashtag #NoPelosi, the fourth most widely amplified hashtag among the pro-Azerbaijan hashtags during the observation window. In the other set, the most popular hashtags were #SanctionAzerbaijan and #AzerbaijanIsATerroristState. The anti-Armenia hashtags garnered more than 261,000 mentions during the time period, while the anti-Azerbaijan hashtags were mentioned more than 156,000 times. As these figures aggregate total mentions per hashtag, it’s worth noting that a single tweet can include multiple hashtags, so the number of individual tweets involved would be lower than the total number of mentions.

According to our analysis, the spike in anti-Azerbaijan and anti-Armenia hashtags occurred within days of each other. On September 13 and 14, anti-Azerbaijan hashtags received nearly 40,000 mentions, while on September 15, anti-Armenia hashtags skyrocketed, receiving more than 50,000 mentions in a single day. Initially, anti-Armenia hashtags received more volume each day than the anti-Azerbaijan ones, but after September 20, the latter had more sustained volume, though at significantly lower levels.

Following the September 15 Anti-Armenia hashtag spike, the DFRLab investigated traffic manipulation on hashtags that trended that day using the Coefficient of Traffic Manipulation (CTM). CTM measures the likelihood of inauthentic traffic flow, defined as “an attempt by a small group of users to generate a large flow of Twitter traffic, disproportionate to the number of users involved.” CTM is expressed by the following equation:

CTM = (R/10) + F + U

R equals the percentage of retweets, F is the percentage of tweets from the fifty most active accounts, and U is the average number of posts per user.

A DFRLab report on CTM published by the Oxford Internet Institute found that organic, non-manipulated control samples scored a CTM of twelve or lower, while CTMs above twelve suggest manipulation.

All six of the top trending anti-Armenia hashtags on September 15 received CTM scores higher than 55, indicating that traffic on these hashtags was highly manipulated. The DFRLab’s analysis found that the #StopArmenianAggression hashtag registered the highest CTM score on September 15 (65.49), while #DontBelieveArmenia registered the lowest score (57.27).

The DFRLab conducted a social network analysis to compare the activity in each group of hashtags. According to the results, Twitter accounts mentioning anti-Armenia hashtags generated more posts than those amplifying anti-Azerbaijan hashtags, suggesting that a small group of accounts likely tried to manipulate traffic on selected hashtags.

As seen in the social network graph below, each node in the network represents an account tweeting one of the anti-Armenia or anti-Azerbaijan hashtags analyzed. The directed edges (pink and green lines) indicate the flow of information discussing such narratives. An edge from one node to another indicates that the former has retweeted, quoted, mentioned, or replied to the latter. The size of the node represents the number of tweets published by the Twitter account using either anti-Armenia or anti-Azerbaijan hashtags. The Twitter accounts shown in the graph below were the most active accounts pushing those hashtags.

Hundreds of the Twitter accounts promoting hashtags were created in mid-September 2022. Of all the accounts utilizing the hashtags, around 7.2 percent of those pushing anti-Armenia hashtags were created that month, in contrast to 3.3 percent of those promoting anti-Azerbaijani hashtags.

Campaign seeks to discredit critical voices

On September 17, Azerbaijani social media accounts launched a campaign to discredit Azerbaijani public figures who were critical of the recent violence. The campaign used the hashtags #xainləritanı (#knowthetraitors), #xainlər (#traitors), #xainitanı (#knowthetraitor), and #xainitanıyaq (“know who is a traitor”). Facebook posts and tweets published with these hashtags contained images of Azerbaijani journalists, opposition politicians, and activists who have criticized Azerbaijan’s military actions. Some of the individuals targeted include Tofig Yagublu, a leading member of the opposition Musavat party; journalists Tural Sadiqli, Afgan Mukhtarli, and Sevinj Osmanqizi; and opposition activist Gultekin Hajibeyli. Posts and tweets shared images of these individuals with a red stamp stating, “xaini tanıyaq!” (“know who is a traitor!”).

On September 17, the youth wing of the ruling New Azerbaijan Party (YAP) posted a Facebook video featuring Azerbaijani opposition politicians and journalists criticizing the country’s actions against Armenia. The video’s opening scene includes the hashtag #xainləritanı (“know the traitors”). The Facebook page of the YAP youth wing also published Facebook posts with the hashtags #Xainitanı and #xainitanıyaq on September 19, 23, and 26.

The DFRLab used Meltwater Explore to determine when the campaign emerged on Twitter. We found that the #xainləritanı hashtag was first posted by @thezzw at 11:00am Baku time on September 18. Given that the initial YAP youth wing video appeared on Facebook the previous day, this suggests that the campaign first launched on Facebook and then made its way to Twitter.

Twitter user @ceyhuna17665017 accounted for the highest number of mentions of the #xainləritanı, #xainlər, #xainitanı, and #xainitanıyaq hashtags between September 18 and 26. The user’s bio does not contain any personal information, but the profile picture features a YAP logo. The other top accounts that amplified these hashtags include @masimvugar, @aynurab89088606, and @seyyad12021991; they frequently retweet YAP accounts and promote the president of Azerbaijan. A Meltwater Explore query showed that mentions of these hashtags spiked on September 19, surpassing 800 mentions in one day; mentions rapidly decreased on September 20.

The #xainitanı hashtag also appeared on YouTube, where a user named Vusal Mustafayev used the #xainitanı hashtag in video titles. These videos were similar to those on Facebook and Twitter, compiling footage of Azerbaijani politicians, bloggers, and journalists who were critical of the Azerbaijani government.

Telegram channels share brutal footage of war crimes; some images turned into Telegram stickers

On October 1, the pro-Azerbaijan Telegram channel ХАЧЕРУБКА 18+ (“Khacherubka 18+”) posted a graphic video with the caption, “Having defeated the enemy’s post, the formidable fighters of the Azerbaijani shot all terrorists.” Armenia’s human rights ombudsperson, Kristinne Grigoryan, tweeted that the video was authentic and showed the willful killing of Armenian prisoners of war by Azerbaijani forces. Grigoryan told Human Rights Watch (HRW) that the killing occurred on September 13, between 6am and 7am local time. HRW also analyzed the footage and released a statement confirming it depicted the extrajudicial execution of at least seven Armenian prisoners of war by Azerbaijani forces. The US State Department and the UK Embassy in Armenia condemned the execution of Armenian soldiers and called for Azerbaijan to investigate the matter.

On October 2, the Twitter account Nagorno Karabakh Observer conducted a terrain analysis to determine that the video was likely filmed near Lake Sev. Later on October 20, Bellingcat published a detailed geolocation of the execution video and concluded it had been filmed northeast of Lake Sev.

The DFRLab used Google Earth Pro and PeakVisor to confirm their conclusions. The video is filmed at a location with large rocks, possibly used to create a small fortification for the soldiers. There is also a mountain ridge visible in the background of the footage. Google Earth Pro shows that the spot where the executions took place is located along the mountainous Armenia-Azerbaijan border. The DFRLab then used the PeakVisor landscape recognition tool to identify the mountain ridges visible in the background; a large mountain visible in the background is Small Ishkhanasar.

Other graphic footage also emerged around the time of the clashes. For example, pro-Azerbaijan Telegram channels disseminated another extremely graphic video that reportedly depicted the mutilated and tortured corpse of female Armenian soldier Anush Apetyan. After viewing the footage, Edward Asryan, chief of the general staff of the Armenian Armed Forces, described the war crime as “the ultimate level of cruelty.”

There is also footage claiming to show Armenian war crimes against Azerbaijani soldiers. Some of these clips have surfaced on the aforementioned pro-Azerbaijan Telegram channel ХАЧЕРУБКА 18+. Another pro-Azerbaijan channel, Caliber, posted footage allegedly showing an Armenian soldier abusing a dead Azerbaijani soldier. The text accompanying the video implied that the video showing Azerbaijanis killing Armenian soldiers might have been faked, and that it is Armenians who are instead committing war crimes:

We saw the video of the alleged execution of Armenian soldiers. Allegedly — since there is no evidence that this is not a performance, it is difficult to identify the participants in the scene from the video (due to helmets and poor filming quality, no faces are visible — a “strange” coincidence).

Meanwhile, on September 19, Arman Tatoyan, former Armenian human rights ombudsman, claimed that Azerbaijani Telegram channels were creating digital “stickers” from the photos of tortured and dismembered Armenian service members and civilians. Tatoyan said the Telegram stickers first appeared on September 14, totaling 119 different stickers reportedly downloaded over 20,000 times within five days. He and his team reportedly found the stickers on September 18 and then reached out to Telegram, which he said blocked the stickers.

Tatoyan shared a screenshot of twenty-five Telegram stickers that were labeled in Azerbaijani, “f*cking Armenian corpses,” and reportedly affiliated with a Telegram bot called fstikbot, an automated tool for generating sticker collections. The DFRLab traced five of the twenty-five images through reverse image searches using Google and Yandex. All five images appeared to date from the 2020 Armenian-Azerbaijani war and showed images of Azerbaijani soldiers posing near dead Armenian soldiers.

The DFRLab used the Combot Telegram Stickers Catalogue to search for the same Azerbaijani phrase used in the screenshot. The query resulted in two sticker collections labeled Ermənilərin leşləri and Erməni leşleri, both of which translate to “Armenian corpses.” While neither sticker collection was an exact match to the thumbnail collection shared by Tatoyan, they featured numerous images in common with Tatoyan’s screenshot. This suggests that Telegram may have indeed removed the sticker collection referenced by Tatoyan, but that individual graphic images and collections still reside on the platform.

Additionally, a search query conducted with the Telegram app for variations of these phrases resulted in seven channels containing the words erməni leşləri (“Armenian corpses”). The largest of these groups, with more than 4,000 subscribers, dated back to the 2020 war but had not been updated since December of that year. Two of the groups were launched in September 2022 around the time of most recent clashes, but only had 83 and 15 members respectively. Most of the groups contained very graphic footage of dead Armenian soldiers, though two of them appeared to use the phrase erməni leşləri as clickbait to expose would-be subscribers to advertisements.

The DFRLab also attempted multiple searches in Armenian, Russian and Azerbaijani to identify channels dedicated to showing dead Azerbaijani soldiers but so far has found none.

Blocking TikTok in Armenia and Azerbaijan increases demand for VPN services

On September 13, Armenian media reported that mobile providers had blocked access to TikTok, but the app remained accessible via cable internet. The DFRLab used OONI Explorer to analyze the connectivity of TikTok’s website in Armenia and found that DNS tampering/spoofing began on September 13 at 4:03pm local time. OONI Explorer also showed that DNS spoofing of TikTok’s website took place in Azerbaijan on September 14. Azerbaijan’s State Security Service announced that it had temporarily suspended TikTok in Azerbaijan because the information published on the platform “casts a shadow on the successes of our army, contains military secrets, and aims to create a wrong opinion in the society.” During the Nagorno-Karabakh war in 2020, Azerbaijan also temporarily blocked access to several social media platforms, including Twitter and Facebook.

Following the restriction on TikTok, demand for virtual private networks (VPNs) spiked in both countries. According to Top10VPN.com, on September 14, there was a 750 percent increase in demand in Azerbaijan; in Armenia, between September 13 and 14, there was an 84 percent increase in demand. The DFRLab used Google Trends to review searches for “VPN” in Azerbaijan and found a spike in searches on September 14.

As demand for VPNs increased in Azerbaijan, posts began to appear on Facebook and TikTok sharing lists of popular VPN services. However, in an apparent attempt to dissuade people in Azerbaijan from using VPNs, some posts claimed that the listed VPNs belonged to Armenia. A CrowdTangle query revealed fifteen posts that appeared in Facebook groups and pages on September 14, garnering around 950 interactions. Posts sharing this narrative also appeared on Twitter and TikTok. It is worth noting that a similar campaign was launched during the 2020 Nagorno-Karabakh war as the Azerbaijani government blocked social media platforms.

Givi Gigitashvili is Research Associate, Caucasus, with the Digital Forensic Research Lab.

Esteban Ponce de León is a Research Associate, Latin America, with the Digital Forensic Research Lab.

Cite this case study:

Givi Gigitashvili and Esteban Ponce de León, “How the September 2022 Azerbaijan-Armenia clashes played out online,” Digital Forensic Research Lab (DFRLab), November 7, 2022, https://medium.com/dfrlab/how-the-september-2022-azerbaijan-armenia-clashes-played-out-online-d373e330a156.