Researchers Discover Huge Crypto Scam Botnet on Twitter

Researchers have uncovered a large botnet that mimics legitimate accounts on Twitter to spread a cryptocurrency "giveaway" scam.

AccessTimeIconAug 7, 2018 at 2:42 p.m. UTC
Updated Sep 13, 2021 at 8:15 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Researchers have uncovered a huge botnet that mimics legitimate accounts on Twitter to spread a cryptocurrency "giveaway" scam.

As reported by ITPro, the discovery was made during a research effort by Duo Security that looked at 88 million Twitter accounts from May to July and used machine learning to identify bots, malicious or otherwise, on the social media platform.

The team notably found a single network of over 15,000 bots in a three-tiered structure that spread the fake cryptocurrency giveaway, and further evolved as time passed in order to avoid detection.

The Duo team described how the botnet works in a paper to be presented at the 2018 Black Hat cybersecurity event on Wednesday.

Typically, they write, bots first create a spoofed (or copycat) account for a genuine cryptocurrency-related account that would copy the name and profile picture of the legitimate account.

To spread the fake giveaway scam, the bots would reply to tweets posted by the legitimate account, containing a link to entice Twitter users to the scam.

Adding to the complexity, many spoof accounts followed what the researchers termed "hub accounts" and suspect are followed "in an effort to appear legitimate".

The botnet also employed "amplification bots" – other fake accounts that are used to give "likes" to scam tweets to "to artificially inflate the tweet's popularity [and] make the cryptocurrency scam appear legitimate."

The paper states:

"[Searching for connected bots] resulted in a 3 tiered botnet structure consisting of the scam publishing bots, the hub accounts (if any) the bots were following, and the amplification bots that like each created tweet. The mapping shows that the amplification bots like tweets from both clusters, binding them together."

Intriguingly, the team found that the discoveries allowed them to connect the bots in a way "that can result in the unraveling of the entire botnet."

While Twitter has been making moves to clamp down on such cryptocurrency scams, Duo writes in its conclusion that the work shows that botnets are still active and can be discovered by "straightforward analysis."

"We don't consider the problem solved," they said.

Going forward, Duo plans to open source the techniques described in the paper in the hope that new techniques can be developed to identify malicious bots, and help "keep Twitter and other social networks a place for healthy online discussion and community."

Network image via Shutterstock

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk offers all employees above a certain salary threshold, including journalists, stock options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.