Twitter has purged thousands of accounts tied to a bot network that was caught using the ongoing COVID-19 outbreak as part of a political propaganda campaign.
The social network took action Thursday after multiple researchers flagged more than 9,000 profiles that appeared to be spreading content promoting the political interests of the United Arab Emirates (UAE) and Saudi Arabia, according to the Atlantic Council's Digital Forensic Research Lab (DFRLab).
The researchers found instances of the accounts politicizing the novel coronavirus outbreak in its messaging, which was broadly critical of Turkish President Recep Tayyip Erdogan.
In one example from February, DFRLab said the botnet was sharing a video of an Arabic speaker voicing solidarity with China as the disease was spreading—a move likely "intended to highlight the UAE government's cooperation with China" and reinforce the political leadership's talking points.
"While posts related to the coronavirus were not the primary goal of the network, a close look at the accounts suggests they were used for broader political messaging, demonstrating how information ops can be repurposed for different uses," analysts wrote, Buzzfeed News reported.
The propaganda network was first discovered in December last year by researchers at the Stanford Internet Observatory, which said in a blog post this week that it had also found Facebook Pages tied to the group that had "leveraged the COVID-19 pandemic" to push its political narratives.
ÚÛÙÛ ÙÙÚ¯ÙÚº ک٠ا٠اراتÛÙÚº Ú©Û Ø·Ø±Ù Ø³Û Ø§ÛÚ© ÙÚÚ©Û Ú©Ø§ Ù¾ÛØºØ§Ù #coronavirus. #CoronavirusOutbreak #COVID19 #China #Ñoronaviruses #coronavirusec #WuhanVirus #Wuhan #WuhanChina #ÙÙØ±ÙÙØ§ #ÙÙØ±ÙÙØ§_ÙÙØ±Ùس pic.twitter.com/MGT5IFZnI3
— Ù ØªØØ¯Û عرب ا٠ارات (اردÙ) (@uaevoiceurdu) February 17, 2020
In a statement, Twitter confirmed the discovery of a network of accounts linked with Saudi Arabia, and said a total of 5,350 accounts had been removed from the website. Twitter said the campaign had been operating out of multiple countries, including Saudi Arabia, Egypt and the UAE.
The individuals behind the scheme were "amplifying content praising Saudi leadership, and critical of Qatar and Turkish activity in Yemen," the official Twitter Safety account wrote Thursday.
"Political botnets remain an ongoing problem for platforms like Twitter, as they are cheap to deploy and easily replaceable when taken down," DFRLab wrote in its own analysis this week.
"In this particular case, the bot [network] is the latest in an ongoing pattern of inauthentic networks supporting the interests of the UAE and Saudi Arabia, though it is unknown whether those governments directly managed the campaign," the blog post added.
"With the emergence of the coronavirus, though, it is highly likely we will see additional bot-driven rhetoric exploiting the pandemic for political purposes, both in the Middle East and worldwide."
While the Twitter accounts were suspended pre-pandemic, these linked domains leverage COVID-19 to push their agenda: (screenshots below translated) pic.twitter.com/unniYOW26W
— Shelby Grossman (@shelbygrossman) April 2, 2020
The novel coronavirus health crisis has already been exploited by hackers and cybercriminals in recent weeks, being found as lures in phishing scams and malicious computer software.
In one case, a post on Facebook was being advertised towards older citizens that claimed to provide a "special grant to help pay medical bills," but would actually siphon off personal data.
Most of the COVID-19 scams prey on emotions, experts say. "Attackers seem to lack any sort of sympathy and to them anything and anyone is fair game," independent cybersecurity researcher Sean Wright told Newsweek earlier this week. "They will use any means to further their own gain, and often this will typically mean using current developments, such as the one we are facing at the moment."
