Thread by @conspirator0

Are you pining away your weekend wishing you had more Crypto Experts and Forex Queens in your life? This botnet might be right up your alley. #SundaySpam

cc: @ZellaQuixote

We found a network of 58 accounts with names consisting of "cryptoexp" or "fxqueen" followed by a series of numbers. This network began life using its own custom automation software (cryptwizard), which it replaced with Twuffer and Twittimer following a hiatus in late 2019.

What does this botnet do? Its mission appears to be to link Telegram channels related to cryptocurrency and forex trading; thus far 9852 of 10020 tweets (98.3%) link one of two channels, generally accompanied by hashtag spam.

These bots repeat tweets both within and across accounts, with the network largely divided into two clusters, one focused on cryptocurrency and one focused on forex trading.

All 58 accounts have female profile pics, and many of the pics are used on more than one account. You'll likely be unsurprised to learn that every single photo is borrowed from elsewhere on the internet.

In what is perhaps an attempt at obfuscation, the reused photos are cropped slightly differently on different accounts - we aligned @cryptoexp24764C and @cryptoexp38560A's photos based on the position of the lamp as an example.

On a closing note, these are far from the only cryptocurrency bots out there. Shown here is roughly four days worth of tweets containing #crypto, #bitcoin, #BTC, #XRP, or #ETH; at least 18.8% were sent via automated means. (~3% is average for most searches in our experience.)