Ben Nimmo Profile picture
Writer, linguist, diver. Global Threat Intel Lead @Meta. Investigating, analysing and exposing influence ops. RT ≠ endorsement.

May 27, 2018, 11 tweets

#BotSpot

H/t @josh_emerson for the initial tip on this one: an apparently Russian commercial botnet boosting political messages in Mexico.

medium.com/dfrlab/electio…

There have been claims already of Russian bots interfering in the Mexican election.

Most of the scans we've run haven't shown anything of the sort.

Always important to remember: not all bots are Russian. And even genuine Russian bots aren't always there for interference.

But then you come across retweets of stuff like this: a post from the Mexican Green Party.

By Петр Смирнов and Игорь, apparently.

Петр looks weirdly like Kris Allen. Odd, that.

And his username is an alphanumeric scramble. All looks a bit dodgy, really.

Meanwhile, Игорь has a really wide range of interests and languages. Japanese, Arabic, Russian and Spanish... and all of them retweets.

At its peak, the Green Party tweet had 697 retweets. An awful lot of them came from accounts with Cyrillic usernames.

Some of them gave locations in Russia or elsewhere in the former USSR, too.

That said, a lot claimed locations in Venezuela, too. They were clearly part of the same network, because they posted identical retweets.

But they posted Russian-language ads (not retweets) for local services in the former USSR: Clenbuterol in Ukraine, property in Russia, jobs in Belarus.

For a Venezuelan bot, that would be an odd market choice. Looks more like a Russian-language bot assuming a Venezuelan ID.

Main thing: this looks like a commercial botnet. The range of languages and subjects is too wide, and the political posts are too interspersed with other stuff.

Not an influence operation.

But we can expect to see more and more crossover between commercial and political bot use.

This was a Russian, apparently commercial, botnet which got switched to German politics just before the election there:

medium.com/dfrlab/german-…

This was an apparently American (possibly Devumi) botnet amplifying political posts in South Africa, during the ANC leadership race.

Keep your eyes open for more of this. It's going to continue. / Thread ends.

medium.com/dfrlab/electio…

Share this Scrolly Tale with your friends.

A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.

Keep scrolling