Nearly Half of Twitter Accounts Pushing To Reopen America May Be Bots

According to a new study from Carnegie Mellon University, researchers have found that bots may account for between 45 and 60% of Twitter accounts discussing covid-19. The normal level of bot involvement for U.S. and foreign elections, natural disasters, and other politicized events is usually between 10 and 20%. MIT Technology Review reports: Many of those accounts were created in February and have since been spreading and amplifying misinformation, including false medical advice, conspiracy theories about the origin of the virus, and pushes to end stay-at-home orders and reopen America. They follow well-worn patterns of coordinated influence campaigns, and their strategy is already working: since the beginning of the crisis, the researchers have observed a greater polarization in Twitter discourse around the topic.

A number of factors could account for this surge. The global nature of the pandemic means a larger swath of actors are motivated to capitalize on the crisis as a way to meet their political agendas. Disinformation is also now more coordinated in general, with more firms available for hire to create such influence campaigns. But it's not just the volume of accounts that worries [Kathleen M. Carley, the director of the University's Center for Informed Democracy & Social Cybersecurity]. Their patterns of behavior have grown more sophisticated, too. Bots are now often more deeply networked with other accounts, making it easier for them to disseminate their messages widely. They also engage in more strategies to target at-risk groups like immigrants and minorities and help real accounts engaged in hate speech to form online groups. "Unfortunately, there are no easy solutions to this problem," the report concludes. "Banning or removing accounts won't work, as more can be spun up for every one that is deleted. Banning accounts that spread inaccurate facts also won't solve anything"

"Carley says researchers, corporations, and the government need to coordinate better to come up with effective policies and practices for tamping this down."

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Nearly Half of Twitter Accounts Pushing To Reopen America May Be Bots
id: 7b2b149f-c55e-4389-8610-e4e0843a951b
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Nearly Half of Twitter Account" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Nearly Half of Twitter Accounts Pushing ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Nearly Half of Twitter Accounts Pushing *"

CommonSecurityLog
| where Message has "Nearly Half of Twitter Accounts Pushing "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc