The Mexican botnet has been very busy. We’ve been tracking bot-related activities in order to translate and publish some of the typical shenanigans Mexican twitterbots do on a regular basis. Thanks to LoQueSigue we have some excellent graphics and videos exposing Mexican twitterbots. Once you can visualize what the bots look like it’s fairly easy to tell what they are doing.

Mexican tweeps call the twitterbots “peñabots” although it is unknown who is controlling the army of bots in Mexican twitter. Tweeps assume the government is aware of them if not involved. They have been active for several years but have ramped up activities since the Iguala attack in September 2014.

Mexican twitterbots have been spamming hashtags, creating fake trends and smearing protesters.

Spamming Hashtags

The #EPNNotWelcome trend was spammed by bots rendering the hashtag useless. We’ve seen bots do this several times before. When bots attack in this manner, they always form a unique belt around the hashtag they are spamming. Visualizations make these bot attacks very obvious.

Botnet attack on #EPNNotWelcome Image: LoQueSigue

Botnet attack on #EPNNotWelcome
Image: LoQueSigue

Bots spammed the hashtag #EPNNotWelcome during Enrique Peña Nieto’s visit to the UK on March 3. The digital protest was suppressed by bots and Mexican tweeps reported not seeing many images from the protests in London.

#EPNNotWelcome bots

#EPNNotWelcome bots

These spam campaigns regulate the speed of the tweets being uploaded to twitter and cause the trend to drop out of the top 10 topics. The same type of bot attack was used against #YaMeCanse and has also been used recently to spam #EnDefensaDeAristegui, which at the time of writing this article was on its 3rd iteration – #EnDefensaDeAristegui3.

Translation: “With troops deployed in newspapers, spots and bots seems to be a campaign against Aristegui #EndefensadeAristegui”

Translation: “Despite its thousands of mentions, the hashtag #EndefensadeAristegui disappeared from Twitter tonight. Same bots of the #YaMeCanse”

The #EnDefensaDeAristegue trend started when Radio MVS fired journalist Carmen Aristegui and 2 of her team members for using the MVS name and logo in connection with the launch of new whistleblower network MexicoLeaks.

READ: Mexican Twitter Bots: Cyber-Attacks on Free Speech & Organizing

You can easily see the massive bot formation surrounding and suppressing the trends supporting journalist, Carmen Aristegui. The bots again formed a unique belt shape around the targeted hashtags.

Bot attack on Aristegui trends. Image: LoQueSigue

Bot attack on Aristegui trends.
Image: LoQueSigue

Creating Fake Trends

Spamming hashtags is a fairly standard bot attack. LoQueSigue monitored the Mexican botnet while it created a fake trend, which is a bit more creative than typical bot behavior.

Federal police evicted a CETEG protest in Acapulco on February 25 and a deluge of images and videos showing protesters bloodied from violent police brutality were uploaded to the internet and tweeted.

“Translation: RT @tryo1 A country where teachers are treated like scum and criminals with respect. Something is wrong #Acapulco”

Alberto Escorcia from LoQueSigue recorded bot activity after the eviction only instead of spamming the #Acapulco tag, the bots created a fake trend #SoyAmanteDe. Visualizations of the networks reveal the stark difference between Mexican twitter bots and real humans tweeting.

Humans create networks, bots do not.

(Screenshots from video by LoQueSigue embedded below)

Real people tweeting about #Acapulco police brutality. Humans create organic networks. Image: LoQueSigue

Real people tweeting about #Acapulco police brutality. Humans create organic networks.
Image: LoQueSigue

Bot trend #SoyAmanteDe - showing typical bot activity. Bots never create networks. Image: LoQueSigue

Bot trend #SoyAmanteDe – showing typical bot activity. Bots never create networks.
Image: LoQueSigue

READ: Help Mexico Fight Online Censorship and Defend Against Bot Attacks

Thousands of bots propelled #SoyAmanteDe (I am a lover of…) into the top trending hashtags and dropped #Acapulco to the 10th position, eventually causing it to drop out of the top 10 topics despite almost 300,000 more #Acapulco tweets from real people.

Video (Spanish): Are they censoring tweets about the Acapulco eviction?

The #SoyAmandeDe bots did not tweet the same repeater tweets, spamming hashtags as we’ve seen in other bot attacks. In the fake trend, bots used the same words and phrases only in different arrangements. We saw this same bot behavior smearing protesters who painted graffiti on the Ángel de la Independencia. Which brings us to another typical botnet activity.

Smearing Protesters

Protests erupted after the brutal eviction of CETEG teachers in Acapulco. During marches on February 26, protesters painted some graffiti on the Ángel de la Independencia, a well known monument on Paseo de la Reforma, Mexico City.

The protesters who painted graffiti on the Ángel angered the Mexican botnet. Negative, defamatory tweets were sent out using the same words and phrases but changing the order, in the same manner that bots tweeted in the fake #SoyAmanteDe trend.

“Translation: The #Peñabots: demonstrating their hunger, submission and illiteracy #AngeldelaIndependencia”

At a glance these bots are not as obvious as spam bots. If someone does not speak Spanish, they might not notice the disparaging tone of these tweets. We grabbed screenshots of several bots and translated what they tweeted. “Encapuchados” (people wearing hoods/masks) are frequent targets of Mexican twitter bots.

Smearing “encapuchados is not new for the botnet. CETEG teachers union protesters were smeared on February 18 after protests in Chilpancingo.

“Translation: CETEG teachers throw stones at riot police in Chilpancingo”

The same image of someone with their face covered in mid-stone toss, allegedly at (out of frame?) riot police was tweeted by many accounts, all using the same repeater tweet while spamming a #Chilpancingo trend.

These are some of the interesting bot behaviors we have observed in Mexican twitter. LoQueSigue is still running a crowdfunding campaign to develop software that can get rid of the bots. Please sign the petition asking twitter to deal with the Mexican botnet. If you happen to see suspicious activity on twitter, screenshot it and tweet it at us @NewsRevo or send it to our facebook page. Also be sure to follow LoQueSigue on twitter for Mexican botnet updates in Spanish.

Sources:
LoQueSigueTV
YoSoyRed
Avaaz
TeleSur English