Thread by @conspirator0

What's up with all these accounts with July 2020 creation dates and stated locations in the US retweeting @ARTEM_KLYUSHIN's tweets (in Russian) about the 2020 US election? #Spamtastic

cc: @ZellaQuixote

We found 95 accounts that we believe to be part of a retweet network amplifying @ARTEM_KLYUSHIN (and others), all created in July 2020. Many list a US state on their profile, usually in all lowercase, and none has ever liked a tweet.

All of the accounts in this network theoretically tweet via the Twitter website ("Twitter Web App"). Although this hypothetically indicates the tweets are human-posted, there are multiple ways of automating websites so the accounts could well be automated.

The accounts in this network do three things:

• retweet accounts, primarily @ARTEM_KLYUSHIN and cryptocurrency accounts
• reply to cryptocurrency accounts
• tweet short phrases/aphorisms

The accounts in this network follow each other profusely (and notably follow very few other accounts), with each account following an average of 23 other members of the network.

As is the case more often than not with bot/sockpuppet networks on Twitter, these accounts use stolen pics. We had better luck with Google than TinEye or Yandex this time around.

(semi-related thread about a much larger, albeit dormant, botnet following @ARTEM_KLYUSHIN)

https://twitter.com/conspirator0/status/1291345714275061761

We took another look at @ARTEM_KLYUSHIN's account, and noticed several recent tweets with almost no retweets but lots of extremely generic-looking English replies from accounts that look suspiciously like those in the network described in this thread.

By exploring the follower networks of the repliers, we found a total of 225 accounts that we believe to be part of the network (including the 95 July 2020 creations we originally found). All but the oldest were created in batches, with the recent batches being larger.

All 225 accounts (allegedly) tweet via Twitter web products, with the earliest traffic being via "Twitter Web Client", followed by "Mobile Web (M2)", followed by "Twitter Web App". Volume has increase substantially over the last couple months.

Who do these accounts reply to? As with the accounts they retweet, it's mostly cryptocurrency accounts and @ARTEM_KLYUSHIN. We'll keep an eye on this network here and there and update this thread further if we notice anything else interesting.