Thread by @conspirator0

One of the accounts that this reply spam botnet we recently documented replied to (@oliverzok) began its Twitter life with an infusion of over 1000 batch-created bogus followers. We decided to explore the rest of the network. #SundaySpam

cc: @ZellaQuixote

https://twitter.com/conspirator0/status/1319439893727236096

To find the rest of the network, we downloaded the followers of other accounts followed by the batch-created followers of @oliverzok, and repeated the process for the accounts they follow, and so on.

We found 1835 accounts that we believe to be part of this fake engagement network. All were created between January and March 2017, have been dormant since late 2017, and tweeted exclusively via the Twitter Android app back when they were active. All their tweets are retweets.

This fake engagement network mostly follows commercial accounts, although one of the accounts it follows is @RyanShakur100K, a large #MAGA account. This account is also followed by other bulk follow networks we've studied - at least 117K of its followers are bogus.

As with the accounts it follows, the majority of the accounts retweeted by this fake engagement network are commercial/promotional accounts. Cryptocurrency and music appear to be major themes.

Does this fake engagement network use stolen profile pics? It certainly does, and indeed frequently reuses them across multiple accounts. Based on the reverse image search results, it's possible the same pictures have also been used on networks of fake Facebook accounts.