THREAD: One of the fun things about studying botnets is seeing the creative ways their herders automate them to try and pass for human.
It doesn't always work. Say hello to Dracula's Botnet.
graphika.com/posts/draculas…
It doesn't always work. Say hello to Dracula's Botnet.
graphika.com/posts/draculas…
The @Graphika_NYC team found this one while we were studying pro-China spam network Spamouflage, which worked across YouTube, Facebook and Twitter.
A bunch of similar-looking Twitter accounts boosted video posts from the network.
(For details, see graphika.com/reports/spamou…)
A bunch of similar-looking Twitter accounts boosted video posts from the network.
(For details, see graphika.com/reports/spamou…)
These were two of them: Amy and Andrea.
Note the similar visual style, the same style of handles, the low follower numbers and the weird, incomplete sentences in their bios.
Note the similar visual style, the same style of handles, the low follower numbers and the weird, incomplete sentences in their bios.
Where did those bio phrases come from?
I'm so glad you asked. They were copied from Bram Stoker's "Dracula."
Someone scraping the e-book to generate text?
I'm so glad you asked. They were copied from Bram Stoker's "Dracula."
Someone scraping the e-book to generate text?
It wasn't just the bios, either. These were the first two tweets from the two fair ladies.
Dracula again, but it must have been badly coded, because every space is replaced with a cross.
Ironic, given the vampire theme.
Dracula again, but it must have been badly coded, because every space is replaced with a cross.
Ironic, given the vampire theme.
It's not the first time we've seen bots quoting immortal (or undead) literature. One favourite quoted Jane Austen; I discovered it while at @DFRLab.
But it's the first we've seen bots in the Spamouflage network using this tactic.
medium.com/dfrlab/botspot…
But it's the first we've seen bots in the Spamouflage network using this tactic.
medium.com/dfrlab/botspot…
(Talking of literature, this was an epic headline from Spamouflage, before it went offline.
"The water of the American people can no longer carry the boat of the presidential government.")
"The water of the American people can no longer carry the boat of the presidential government.")
Using the words-and-plus-signs as a signal, we started looking for more of these accounts.
We found some live ones, and traces of hundreds more. It looks like batches were created repeatedly since June, but they kept on tripping the auto-detectors.
We found some live ones, and traces of hundreds more. It looks like batches were created repeatedly since June, but they kept on tripping the auto-detectors.
Some of the live assets were posting Spamouflage-style content, in Chinese, and focusing on US-China relations and Covid-19.
But don't go thinking that Spamouflage was +creating+ these bots...
But don't go thinking that Spamouflage was +creating+ these bots...
... others in the network were posting unrelated content in a mix of languages, including French and Korean.
And some of the behaviour was pure spam: replies with a load of @-mentions (handles obscured in this image).
This looks like a rent-a-bot network: standardised accounts with widely varying content in many languages, and little attempt to look more human than you'd need to fool the algorithm. Or try to.
None of these accounts had significant followings (many had none at all). And they kept on getting caught and suspended.
They were basically a numbers game, artificially inflating the retweets to make the tweet look more popular.
They were basically a numbers game, artificially inflating the retweets to make the tweet look more popular.
But they're an important reminder: influence operations are a continuum. Today's spambot can be tomorrow's disinfo enabler - or the lead that gives away an operation.
So keep watching for things like Dracula's Botnet. Vampires don't light the daylight.
So keep watching for things like Dracula's Botnet. Vampires don't light the daylight.
