Thread by @josh_emerson

The flow of russian disinformation, and how russian cyber warfare works:

GRU hacks, russian media writes about it, russian bots take to twitter.

The bots I am looking at tweeted about "Cyber Berkut".

ncsc.gov.uk/news/reckless-…

GCHQ attributes Cyber Berkut to GRU.

In just what happened to be an odd coincidence I happened to be looking at russian bots when @rob_barry did a thread about "CyberCaliphate"

At some point in march 2014 after the russian invasion of crimea GRU setup Cyber Berkut and started attacking various Ukrainian infrastructure and websites.
motherjones.com/politics/2014/…

RT runs a stroy about it:
rt.com/news/nato-webs…

then the twitter bots step in, 2000+ of them.

"We have hacked correspondence of #US Army Attache Assistant in #Kiev and discover a plot against #Ukraine"

"Here is the proof that Ukrainian revolution financed by US #CyberBerkut #Ukraine #antimaidan #revolution "

more information about CyberBerkut here

Russian propaganda machine claims US covertly testing chemical warfare in Ukraine:
toinformistoinfluence.com/2017/08/26/rus…

.@ThreatConnect did a decent write up of their spearphishing attacks on @bellingcat's @AricToler and @EliotHiggins

threatconnect.com/blog/russia-ha…

those bot were setup to boost what look like russian troll accounts.
@nocensnews
they didn't like @SenJohnMcCain

Ukrainian livejournal trolls were most of what the accounts did on the list of 3700 accounts twitter gave congress.

This accounts facebook page was removed by facebook

facebook.com/nocensnews

haha they didn't like @bellingcat much either.

US Department of State cites incompetent sources:
g-shufrich.livejournal.com/11827.html

An archive of the @cyberberkut1 twitter handle shows that facebook page as well.

another what looks to be a russian troll account they boosted: @pauw_p

"his" facebook is banned as well.
facebook.com/brent.depauw.1…

probably russian @freeukraineanon

@XcpT0r

definitely a russian troll account:

@linnik_l
Независимый журналист, блогер #Украина #Харьков #ДНР #ЛНР #ХНР #Новороссия #SaveDonbasPeople

how do I know for a fact these are russian trolls?

this is what the average account looked like on the list of russian twitter handles congress got:

what do the bots look like?

very familiar

i have tweeted about this botnet many times before.

in fact i just gave twitter 5,000 of them to suspend

this botnet is the glue that holds all the other russian bots together.

those bots followed these 300 russian accounts

https://twitter.com/josh_emerson/status/966825665822642176

they follow these arab bots

https://twitter.com/josh_emerson/status/931128873575731205

they followed the mexican bots

https://twitter.com/josh_emerson/status/1042621127720415232

they followed these now confirmed russian bots.

https://twitter.com/josh_emerson/status/929947483047890944

they followed these bots, now suspended

https://twitter.com/josh_emerson/status/1042758360410607616

and they followed these bots

https://twitter.com/josh_emerson/status/1030065627581566977