Russia Bot Network in the Fediverse

Threat Intel
, , ,
1

Indicators:

Indicators of compromise (IOCs) that identify accounts as likely being part of the network include:

• a single follow (the bsky.brid.gy @ bsky.brid.gy account), or first follow is the bridge
• an out-of-character bio line
• linking to pro-Russia Telegram channels, or Russian news sources
• posts that cut off mid-sentence
• disposable email domains used for the account registration
Some servers are not removing these accounts, you can review what the accounts look like, and the content they post, on this page.

The accounts are created and left alone for a short period, and will have no posts for up to week, sometimes more. Messages will often be posted in the predominant language of the local service.

Once in use, the account will likely follow a dozen or so accounts on servers that are listed on the AUD Denylist and/or a handful of the highest recommended accounts. Sometimes the local accounts are followed first, then the bridge.

Source: IFTAS

Details:

Suggested Mitigations for Fediverse Server Admins and Mods:

  • Disabling account creation invites as it bypasses account approval in current Mastodon implementation
4 Likes
2

Some good in-depth analysis of the ongoing propaganda network sponsored by the Russian government across the fediverse and Bluesky. (Thanks Catalin Cimpanu for tooting about!)

1 Like