Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Artificial Intelligence

US Disrupts AI-Powered Russian Bot Farm on X

The US and allies blame Russian state-sponsored threat actors for using Meliorator AI software to create a social media bot farm.

AI Bot Farm

Threat actors affiliated with RT (formerly Russia Today), a Russian government-backed media organization, have used artificial intelligence (AI) features of the Meliorator software to create fake online personas used to disseminate disinformation to and about the US, Germany, Israel, the Netherlands, Poland, Spain, and Ukraine, reads a joint advisory from the government agencies.

Meliorator was designed to create seemingly authentic social media personas en masse, post content like authentic users, mirror disinformation posted by other fake personas, perpetuate false narratives, and formulate messages.

The tool consists of an administrator panel named Brigadir, which serves as the primary end-user interface, and a seeding tool named Taras, a back-end used to control the fictitious personas.

Threat actors could use Meliorator to create bots based on specific parameters or archetypes and had access to automated scenarios or actions that could be completed on behalf of groups of bots.

According to the authoring agencies, RT had access to the AI-enabled bot farm generation and management software since 2022 and used it to disseminate disinformation in support of Russia’s interests.

As of June 2024, Meliorator was only compatible with X, where Russian threat actors used it to create 968 accounts to use as part of their influence operations.

Advertisement. Scroll to continue reading.

On Tuesday, the US announced it seized two domain names that were used by private email servers the Russian threat actors relied on to register the fake social media accounts for the bot farm.

The bot farm, the affidavits filed in support of the seizure warrants show, was controlled by a Russian FSB officer, a Meliorator developer, and members of a private intelligence organization, “with the approval and financial support of the Presidential Administration of Russia (aka the Kremlin)”.

The identified accounts have been suspended by X, but the government agencies call for other social media platforms to take note of the influence operation and “assist with identifying fictitious personas to reduce Russian malign foreign influence activity”.

Related: Google Disrupts More China-Linked Dragonbridge Influence Operations

Related: Why We Need to Get a Handle on AI

Related: Senators Urge $32 Billion in Emergency Spending on AI After Yearlong Review

Related: US Releases International Cyberspace Strategy

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Today’s attackers are no longer breaking in — they’re logging in. Join this live webinar as we break down the modern identity attack chain and examine how recent breaches exploited weaknesses in authentication, identity verification, and access management processes.

Register

AI has accelerated both sides of the fight. Adversaries are weaponizing vulnerabilities faster, while defenders are racing to ship detections and configurations. Join this live webinar as we explore how to prove your controls actually hold against new threats, map your security maturity, and unite breach simulation with automated pentesting into a single, coordinated program.

Register

People on the Move

SolarWinds has appointed Justin Henkel as Chief Information Security Officer.

J. Paul Haynes has joined Cinchy as Chief Executive Officer.

Hatem Naguib has become Chief Executive Officer at Sysdig.

More People On The Move

Expert Insights

Four decades of incident response experience suggest that exploits are often the symptom, not the root cause, of today’s cybersecurity failures.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.