Twitter-hosted Fake News Campaign Targets Public

Every minute, hundreds of links to stories about terrorist attacks, cyber attacks, bomb threats, and other violent, vitriolic content are being posted on Twitter by a vast network of spam bots, in what appears to be a coordinated attempt by a state actor to foster division and unrest among the public.

It started when a select few reporters saw a similar pattern months ago with many bots on Twitter sharing the same content by utilizing the same unique link-shortening website (like bitly. com, but used exclusively by the Twitter bots in question apparently). In the wake of the report the journalists put out, Twitter deleted the bot accounts and the link-shortening website they used (bioecology. xyz) shut down and could no longer be accessed.

Fast-forward to about a month ago--a group of Intelligence Analysts (including yours truly) noticed a very similar bot network operating on Twitter. It followed the exact same pattern as the last one, except the link-shortening website they use is different (crambi. com). If you go on Twitter and search for "crambi. com", you will see dozens of profiles posting hundreds of Tweets per hour utilizing crambi for their links.

What's ingenious is the way the bots avoid detection and deletion. First off, they have normal-sounding names, as well as general themes for what images (both profile and background) they use. For example, some of them appear to be people who are interested in sports at first glance (https://archive. fo/SWDQZ), but if you actually look at their content, it's all links to terrorist attack stories that might be months or years old and shortened via crambi. com.

Other profiles seem to be even more undercover--generally avoiding spamming divisive content and focusing more on using crambi for other themes (like posting about different occupations or locations). Here are some examples: https://archive. fo/gHKvJ, https://archive. fo/013Se, https://archive. fo/68xe1. This could be a way to avoid having crambi. com be too closely associated with purely negative news/news links, thus putting it in the cross-hairs for scrutiny.

There's a few things that all the bot accounts have in common, besides the aforementioned common themes and actions. 1) They were all created in March of 2019. 2) They all started tweeting around June 28th or June 29th. 3) They all have anywhere from 450 to 600 tweets (as of right now). 4) They all tweet about the same amount around the same intervals. 5) They have very little outside engagement (followers/following, shares, likes, comments) on their content.

Here is a short list of a few accounts I found, but there are dozens of them actively posting at any given moment: https://archive. fo/gHKvJ, https://archive. fo/013Se, https://archive. fo/68xe1, https://archive. fo/BGrDu ,https://archive. fo/Drg7q ,https://archive. fo/SWDQZ ,https://archive. fo/TO8ea ,https://archive. fo/g4pxM ,https://archive. fo/VBJbc ,https://archive. fo/sxGFp.

The usage of link-shortening websites like crambi to link to old news is a method of avoiding getting flagged as fake news and deleted by Twitter and other sites. The events in the stories that the bots link to did actually happen, but they are not current.

It's obvious that whoever designed the bots is relying on the fact that most people do not read beyond a news story's headline. Anyone clicking on these links will know that the stories are almost never current. The reason for spamming links to old stories about this kind of content is that it serves as a wedge to divide, confuse, and disorient the people it is aimed at. I suspect that it is a continuation of the same fake news campaigns seen carried out by Russia ahead of the U.S. 2016 elections. The spam bots used in that case would routinely post divisive content, whether it be of a political nature (right or left), or more similar to this case. The idea is that whoever this is aimed at (I suspect the U.S. public and others in Western countries again) will feel more alienated and distressed over time. The Russians call this psyop technique "Active Measures", and it has been carried out time and time again since the days of the Soviet Union.

Perhaps the spookiest thing about this is the fact that crambi and its "users" are probably just the tip of the iceberg. There are likely many other link-shortening sites used by other spam bots currently being used on Twitter in the same manner.