Botnets Have Infiltrated The Twitterverse

The rise of the Twitter bot has plagued the online world in recent years. These are Twitter accounts that are automated and require little or no human intervention. Many are entirely legitimate, publishing headlines and links to news stories.

But others are malicious. These Twitter bots produce spam, provide fake followers for anybody willing to pay, and can manipulate debates and public opinion in insidious ways that are hard to track and prevent. The effects of large swarms of Twitter bots, so-called botnets, are largely unknown.

That’s why Twitter has an ongoing program to detect and remove malicious bots. But as soon as a new technique becomes available to identify these accounts, bot-masters modify and upgrade their charges to avoid detection.

The truth is that nobody knows how many Twitter bots are out there or how big the botnets have become.

Except now, thanks to the work of Juan Echeverria and Shi Zhou at University College London. These cybersecurity experts have stumbled across a Twitter botnet consisting of more than 350,000 automated accounts, a network of almost unimaginable proportions, that has existed undetected since 2013. They call this network the “Star Wars botnet” and say that its longevity raises serious questions about the potential impact of botnets and the way they are tracked and monitored.

Echeverria and Zhou discovered this botnet almost by accident. Interested in finding automated accounts, the researchers began by downloading details of six million English-speaking Twitter accounts that they randomly selected. That’s about 1 percent of the total number of Twitter accounts.

Twitter allows the most recent 3,200 tweets to be downloaded along with any geo-tags attached to the tweets. This allowed Echeverria and Zhou to map the locations of all these tweets. That’s when they noticed something strange.

For the most part, the geographical distribution of tweets matches the global population distribution. In other words, tweets are more common in densely populated areas like cities. But the researchers also noticed a significant number of tweets, some 23,000 of them, that were geo-located in uninhabited regions close to Europe and the US, such as in deserts and in oceans.

When plotted on a map, these locations were bounded by sharp edges and corners that formed two rectangles, one around the US and the other around Europe. “We conjectured that the map shows two overlapping distributions,” say Echeverria and Zhou. They thought that one set of tweets must be from real users and so coincided with the population distribution.

But the other must have been created by Twitter bots randomly choosing locations in the two rectangles. The goal, thought Echeverria and Zhou, was to convince other Twitter users that the tweets were created in the two continents where Twitter is most popular.

A simple assessment of the 3,000 accounts that created these tweets showed they had much in common. These accounts had never published more than 11 tweets, they never had more than 10 followers and less than 31 friends. They were all produced by Twitter for Windows phones.

But reading the tweets, Echeverria and Zhou realized that they all contained random quotations from Star Wars novels with hashtags inserted at random.  A typical tweet is: “Luke’s answer was to put on an extra burst of speed. There were only ten meters #separating them now.”

At this point, Echeverria and Zhou conjectured that they had stumbled across a single botnet, presumably controlled by a single bot-master. This botnet was obviously large since 3,000 bots had appeared in a random search. And that raised an obvious question: just how big was this botnet?

To find out, the researchers trained a machine-learning algorithm to recognize Star Wars bots and set it loose on a much larger database of 14 million English-speaking Twitter users.

The results were a shock. The machine-learning algorithm, with the help of some manual filtering, found some 350,000 accounts that had the same characteristics. These accounts had never tweeted more than 11 times, had fewer than 31 friends and were all produced by Twitter for Windows Phone.

What’s more, this entire botnet was created in just a few days in June and July 2013. At the time, it produced 150,000 tweets a day.

Then it stopped. “When the creation of new Star Wars bots stopped on 14 July 2013, all the bots suddenly fell silent and remained so ever since,” say Echeverria and Zhou.

But the accounts have not been closed down or deleted. They could all tweet at a moment’s notice, should the bot-master so decide. Echeverria and Zhou say the bots have avoided detection because they were deliberately designed to keep a low profile. “It seems the Star Wars bots were deliberately designed to circumvent many of the heuristics underlying previous bot detection methods,” say Echeverria and Zhou.

The bots do this by tweeting quotes from novels to avoid machine-generated language, which can be easily detected. They never tweet urls or mention other Twitter users. And they have tweeted only a few times each to avoid detection for over or under use.

So what might these fake Twitter accounts be for? Although the accounts have been silent for some time, this makes them valuable since they are less likely now to be labeled as fake. For this reason, pre-aged bots have significant value on the black market.

Echeverria and Zhou say that about 15,000 of the Star Wars bots have followers from outside the botnet. “The only plausible explanation is that these bots have already been sold as fake followers,” they conclude. So whoever owns this botnet is already cashing in.

But it is possible that the entire botnet could be for sale. “What if someone offers a good price for purchasing the control of the whole botnet?” ask Echeverria and Zhou.

Clearly, the discovery of this giant botnet raises important questions about the extent to which the Twitter-verse has been infiltrated by bots that can influence the dynamics of conversations, opinions, and even elections. The work leaves open the crucial question of who set up this botnet and why.

And the story doesn’t end there. For anyone who thinks this is as big as secret Twitter botnets are likely to get, Echeverria and Zhou have bad news. “We have recently discovered another botnet with more than 500k bots, which will be reported shortly,” they say.

Technology Review:            The Global War of Narratives and the Role of Social Media:     

You Should Not Trust The Media:
 

« Lloyds Bank Cyber Attack
Cyber Security Protection For Business »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

DTEX Systems

DTEX Systems

DTEX Systems is the global leader for insider risk management. We empower organizations to prevent data loss by proactively stopping insider risks from becoming insider threats.

Torsion Information Security

Torsion Information Security

Torsion is an innovative information security and compliance engine, which runs either in the cloud or your data centre.

VivoSecurity

VivoSecurity

VivoSecurity is a pioneer in cyber risk quantification based on data science. Our products and services help organizations achieve optimal information security and GRC programs.

OneSpan

OneSpan

OneSpan (formerly Vasco Data Security) is a global leader in digital identity security, transaction security and business productivity.

KOS-CERT

KOS-CERT

KOS-CERT is the national Computer Incident Response Team for Kosovo.

MrLooquer

MrLooquer

MrLooquer provide a solution to automatically discover the assets of organizations on the internet, determine the level of exposure to attacks and help to manage risk accurately.

Redbelt Security

Redbelt Security

Redbelt is a cyber security consultancy. We integrate people, systems, services and products to transform how your information security is delivered.

Gradcracker

Gradcracker

Gradcracker is THE careers website for Science, Technology (including Cybersecurity), Engineering and Maths university students in the UK.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Haven Group

Haven Group

Haven Group and its companies are a cyber security one-stop-shop for our clients offering a full range of cyber security services to our clients in a unified and united way.

DoQubiz Technology

DoQubiz Technology

DoQubiz is using the idea of security through obscurity to develop their proprietary Fractal Security Engine that implements a highly resilient data protection protocol.

Association for Uncrewed Vehicle Systems International (AUVSI)

Association for Uncrewed Vehicle Systems International (AUVSI)

AUVSI is the world's largest nonprofit organization dedicated to the advancement of uncrewed systems and robotics. Focus areas include cyber security for uncrewed systems and robotics.

Cyber Risk International

Cyber Risk International

Cyber Risk International offer CyberPrism, a B2B SaaS solution that empowers businesses to perform a self-assessment of their cyber security program.

Effectiv

Effectiv

Effectiv is a real-time fraud & risk management platform for Financial Institutions and Fintechs.

Dedagroup (Deda)

Dedagroup (Deda)

Dedagroup provide application solutions and IT services to bring innovation at the core of business processes.

Siguria Kibernetike (Cyber Security)

Siguria Kibernetike (Cyber Security)

Siguria Kibernetike is a company based in Tirana that offers full service in the field of cyber and physical security.