Thread by @conspirator0

What do Michigan GOP congressional candidate @Seely4Congress and New Hampshire GOP state senate candidate @LougNH have in common? Both were recently followed by swarms of recently-created accounts with random-looking names. #KeepOnAstroturfin

cc: @ZellaQuixote

The recently-created accounts that followed the two GOP candidates en masse are part of an astroturf botnet consisting of (at least) 25762 accounts created in June and July 2022 with display names consisting of random lowercase letters.

Here are follow order by creation date plots for @Seely4Congress and @LougNH. The followers from the botnet show up as horizontal streaks (highlighted in red).

The accounts in this botnet have repetitive biographies, with each biography appearing on dozens of accounts in the network. We've seen previous botnets with random lowercase names and repetitive biographies that may be predecessors to this network:

Unlike previous incarnations of this network, the accounts in this botnet don't just follow and like, they also tweet. All tweets thus far were (allegedly) posted via the Twitter Web App, and the content is a mix of retweets and replies.

Who do the accounts in this botnet retweet and reply to? Mostly cryptocurrency/NFT accounts. The replies are repetitive, with many duplicated verbatim by dozens of accounts.

Here are the numeric IDs of the accounts in this network, for those who are interested:
pastebin.com/A7ZsVuqB
pastebin.com/iNF3v8d2

Update: 25661 of the 25762 accounts in this network (99.6%) have been suspended.