A Botnet Used By Russian Trolls Is Still Sitting Dormant On Twitter, And It Promoted Taco Bell And Coachella

“Why is the IRA pushing Taco Bell and Coachella?”

Twitter today released what it says are data sets containing “all the accounts and related content associated with potential information operations” it has found on its platform since 2016.

But not long after the data was made public, researchers found bots that Twitter didn’t identify in the data set, that were part of a network used by the Russian Internet Research Agency — the so-called troll factory that helped sow discord and spread misinformation during the 2016 election. Oddly, the accounts promoted Taco Bell and Coachella.

This suggests that even Twitter itself has not been able to identify all of the IRA-linked accounts on its platform.

Jonathon Morgan, the CEO of New Knowledge, a security company that monitors social media misinformation and online influence operations, told BuzzFeed News that his software identified strange phrases used by some of the IRA accounts released by Twitter. They appeared to be more promotional than political.

“Free Lunch for a Year at Taco Bell,” some accounts posted. “FREE pass to the 2013 Coachella Music Festival!” others tweeted.

That prompted Morgan to look into where these messages originated, and examine why the IRA was promoting Taco Bell and Coachella. He searched on Twitter and found posts identical to the ones in Twitter’s database. He concluded that the Russians may have rented a part of a network of bots, or automated accounts, to help push out their messaging.

“With these types of quasi-commercial bots, it probably means someone went on a black market or a gray market and they purchased a certain number of tweets from a certain number of accounts,” Morgan said.

Although the Taco Bell and Coachella tweets are from 2013 and many of the accounts remain dormant for now, some are still active and just post headlines alongside images. Morgan said it’s common for an account that is part of a botnet to stay dormant until someone pays for its use.

The tweets about Coachella and Taco Bell included a link to a clothing store called AmericanTrends.us, which was run out of Indonesia at the time, according to domain registration records. (The online store doesn’t currently list anything for sale, but the website is still live.)

Many of the accounts reviewed by BuzzFeed News were created back in 2012 and 2013. That age makes them more valuable on the bot market, and it also helps them seem more legitimate to anyone who comes across them. (Newer accounts tend to be viewed with more suspicion.)

“Accounts that are around for a long time and have intermittent posting behavior — it’s a lot easier for those to blend in with the crowd,” Morgan said.

He isn’t the only one who found live accounts connected to the IRA after Twitter’s data dump. Josh Russell, an independent researcher who tracks troll and bot activity on Twitter, tweeted that at least some of the accounts he previously identified as Russian remained online as of today. Twitter soon removed them after Russell posted a thread about it.

“If you know what to look for you can find a LOT of live IRA accounts on Twitter right now,” Russell told BuzzFeed News through Twitter DMs.

Twitter did not immediately respond to requests for comment from BuzzFeed News.

Morgan told BuzzFeed News that what this really signals is that social media networks, which seem to be trying to clean up their platforms, are full of “spam among spam among spam.”

“We obsessed about Twitter manipulation when it was ISIS and we obsessed about it again when it was Russia,” Morgan said, “but I kind of think the underlying story is that most of what we believe in as a social internet, it’s just like a foundation — it’s a big pile of shit.”

Topics in this article

Skip to footer