Nothing to see here, just 3077 accounts that all tweet with the same app (presently "Mobile Web (M2)" and simultaneously switched what app they tweet with multiple times since the beginning of the month.
cc: @ZellaQuixote
cc: @ZellaQuixote
The 3077 accounts in question do nothing but post Arabic-language tweets containing clips from Saudi news site 24mediagroup(dot)net. Most tweets (and the associated clips) are copied verbatim across hundreds of accounts.
As is common with botnets, the 3077 accounts in this network were mostly created in batches. These batches feature extremely repetitive naming schemes (examples shown in table.)
This botnet is active 24/7, although output does drop for ~3 hours per day between roughly 6 PM and 9 PM PDT. Individually, the accounts are low volume, usually tweeting twice a day, with the times shifting from day to day.
This botnet embarked on its current mission in 2018, but some of the accounts have activated previously. Past activity also appears to be of the newsbot variety, and used custom apps. The accounts hosting the media in the old tweets (@Saudi_24 and @sport24_tv) are now suspended.
