What's up with all these strangely-named apps that were used to tweet (or retweet) #Trump2020 tweets with images in the wee hours the night of June 13th/14th? #MondayMotivation
cc: @ZellaQuixote
cc: @ZellaQuixote
Answer: a set of 36 custom apps with similar-looking names (lots of capital letters, stars, Greek letters, and brackets) were used by 136 accounts to retweet a Japanese #Trump2020 tweet posted by @neto_uyoko.
These 136 accounts are all bots, automated via the aforementioned 36 custom apps (used for retweeting) as well as twittbot and BotBird (used for original tweets.) Is this the entire botnet, or can we find more accounts?
By exploring the retweets of the tweets retweeted by the 136 bots we originally found, we found a total of 286 accounts that we believe to be part of this botnet. Most were created between 2017 and 2020 and have 8 character names consisting of random digits and lowercase letters.
Each of the 36 custom apps used by this botnet is used by at most 9 of the 286 bots. (Twittbot and Botbird are automation services available to the public and are exceptions.) Almost all of the tweets in languages identifiable by Twitter are in Japanese.
85.7% of the tweets sent produced by these bots are retweets. They also produce original tweets, which are mostly strings of emoticons and are among the tweets retweeted by the network, although none of the botnet members are in the top 50 accounts retweeted.
Neither of us knows Japanese, so we're not going to say much about the content amplified by these accounts, but we will make one more observation: #Trump2020 is a recent addition to this botnet's repertoire, courtesy of @neto_uyoko. We'll keep an eye on it.
