Thread by @conspirator0

What do 2022 Congressional candidates @BlakeHarbinGA (R), @DavidGiglioCA (R), and @RajiRab2020 (D) have in common? All three have recently been followed by thousands of newly-created accounts with lowercase display names and zero tweets.

cc: @ZellaQuixote

The new followers of the three Congressional candidates are part of a botnet consisting of (at least) 38105 accounts with random-looking names created in December 2021/January 2022. None of the accounts has ever tweeted, though most have liked dozens or hundreds of tweets.

The accounts in this botnet have extremely repetitive biographies, using only 1085 unique biographies across 38105 accounts.

What do these accounts actually do?

The accounts in the botnet do two things: like and follow. The accounts whose tweets the bots like are mostly cryptocurrency accounts, although @JuanOrlandoH, the President of Honduras, turns up prominently.

The botnet also mostly follows cryptocurrency accounts. As mentioned earlier, three 2022 US House candidates have followers from this botnet:

@BlakeHarbinGA (GA Republican, 7855 followers)
@DavidGiglioCA (CA Republican, 8563 followers)
@RajiRab2020 (CA Democrat, 10835 followers)

Here's a slideshow of follow order by creation date plots for various accounts that have a lot of followers from the botnet. The mass-created bot followers from the network show up as horizontal streaks (colorfully highlighted).

This botnet shares multiple characteristics (random names, no tweets, lots of likes, repeated biographies) with a couple of botnets we found in fall 2021, and may be a new incarnation of the same operation.

https://twitter.com/conspirator0/status/1431410532846866435

https://twitter.com/conspirator0/status/1440436082982621185