Feds Say They’ve Unraveled A Russian Bot Network

The FSB is coming up with increasingly creative ways to create low-follower X accounts.
Russian President Vladimir Putin listens to Moscow Mayor Sergei Sobyanin during their meeting via teleconference at the Novo-Ogaryovo residence outside Moscow, Russia, Wednesday, May 27, 2020. (Alexei Nikolsky, Sputn... Russian President Vladimir Putin listens to Moscow Mayor Sergei Sobyanin during their meeting via teleconference at the Novo-Ogaryovo residence outside Moscow, Russia, Wednesday, May 27, 2020. (Alexei Nikolsky, Sputnik, Kremlin Pool Photo via AP) MORE LESS
Start your day with TPM.
Sign up for the Morning Memo newsletter

In early 2022, a senior employee at the Russian state news agency RT pitched his superiors on an idea: could RT create an in-house social media bot farm to reach people outside of its traditional news broadcasts?

Per federal court documents released on Tuesday, RT executives said yes.

The result was a quixotic attempt involving the FSB, the successor agency to the KGB, to use AI to develop a mushrooming series of fake X accounts that parroted Russian propaganda.

In a search warrant affidavit, the FBI said that it had identified 968 accounts after an unnamed “U.S. government agency” tipped it off to the inner workings of RT and its alleged cooperation with an FSB official in setting up the network. Per a statement, X moved to shut down the accounts while the DOJ seized two domain names related to the network.

The affidavit — in which an unnamed FBI agent recounted how federal investigators learned of the bot farm, assessed at least part of its scope, and moved to dismantle it — reads partly like a spy novel, and partly like a skeptical take on the value of Russian disinformation efforts. The impression the affidavit leaves of what the FBI demolished is less that of a devious effort to pour gasoline on nuanced differences within the American public, and more of a scattershot approach: creating as many accounts as possible, and then using them to take the propaganda that Russia trains on its own citizens abroad. In this case, that’s videos of Russian President Vladimir Putin giving long speeches about the history of Eastern Europe.

The affidavit cites only two examples of social media posts generated by the network. For those who have followed Putin’s efforts to legitimate his full-scale invasion of Ukraine, they’re familiar: In one November 2023 instance, an account posted a speech Putin gave contesting the historicity of the current borders of Ukraine, Poland, and Lithuania, calling them “gifts” from Russia. In another, from October 2023, a bot responded to an unnamed candidate for federal office with another Putin video, this time directly justifying the invasion.

In the former case, the bot had 23 followers. The FBI didn’t specify the reach of the latter account, or of the hundreds of others taken down in the sting.

Enter the FSB

That relatively small reach — and focus on the kind of Eastern European historical issues on which President Putin has long obsessed over but which seem likely to elude most American audiences — belies the lengths to which both Russian officials and U.S. law enforcement went to create and then demolish the network.

Per the affidavit, an unnamed U.S. government agency sparked the probe by giving the FBI a tip: executives from RT, the Russian state-run news agency, had moved to create a “social media bot farm” which RT could then use to spread information on a broad scale.

The tip focused on two RT employees. One, the chief of RT’s “Directorate of Digital Journalism,” formulated the idea for the bot farm, while another RT employee implemented it, starting in April 2022.

The next year, the tip said, the FSB took notice. An officer from the KGB successor recruited the two RT employees to work for an unnamed “private intelligence organization” that he had created. The group’s purpose, the FBI said, was to advance Russian government goals, including by using fake social media accounts to broadcast Russian propaganda. Per the tip, the Kremlin approved the group’s creation.

From there, the affidavit says, the unnamed U.S. government agency determined that the intelligence organization began to provide “investigative services” to RT last year, effectively acting as a cover within the Russian state organization for what was really going on: the FSB was using RT to “conduct influence operations against foreign adversaries in coordination with the Kremlin,” including via the bot farm.

It’s an extremely convoluted way of demonstrating the mechanics of something that’s long been known: RT frequently parrots and amplifies Russian propaganda.

What makes this different are the many layers of deception. Per the affidavit, not only was the FSB’s involvement concealed from RT, but RT then used subterfuge to create the network of fake social media accounts with which to spread FSB messaging.

Per the affidavit, the FBI was able to unravel the scheme in large part by finding ways to corroborate the tip from the unnamed U.S government agency.

The FBI did so by obtaining email addresses for suspect X accounts from the social media company. Many of the addresses were registered to unknown domains; after obtaining information for who bought the domains (they were sold by an Arizona provider), the FBI found that they were registered to a fake person with a VPN in Lithuania.

A search of a Google account associated with the domains, the affidavit says, unearthed another clue: it was created from an IP address that traces back to Russia. It’s then (pardon this inevitable reference) a Russian nesting doll of clues an email accounts: the first email account listed a recovery email address; that recovery email address listed another recovery email address. The third address, the FBI found, had been created in December 2015 — years before the bot network was created.

The FBI found that it listed an associated phone number. That traced back to the beginning: one of the two RT employees that worked on the bot farm.

Latest News

Notable Replies

  1. Does the Russian bot have MAGgot connections?

    Supermagafragilistic schadenfreudelicious,anyone?

  2. I’m wondering if Gym Jordan will have to do hearings on this ‘investigation.’

  3. I’d expect Trump to tell the FBI to stop this if he gets back in power.

  4. Speaking of Trump’s favorite country…

    Vladimir Putin’s troops target a children’s hospital in Ukraine, then accuse Ukraine of destroying it… Vladimir Putin’s government issues an arrest warrant for Navalny’s widow because she favors democracy.

    Republicans want a tough guy like him in the White House, except, understand, our tough guy will be tough on our people, on anybody not named Trump.

    Frankly I’m not sure that’ll help you much.

  5. You can bet that there are many more tentacles reaching out from Russia over social media and other avenues to try to poison our politics and get Trump elected. Other nations are likely doing this as well, but Russia has an especially important reason to do so, as Trump will walk away from Ukraine and NATO and let Putin have his way with Europe. Xi in China may also be in favor of Trump, as he doesn’t seem to care about Taiwan and may let Xi have at it, as well as take over the South China Sea.

    If we elect our own dictator, it’s very likely he’ll be transactional with other dictators, allowing them to do what they want and taking advantage of that in other ways (like the Kushner $2 billion deal with the Saudis). And, it’s likely Trump will freeze out other democracies who try to keep him from undoing the world order holding back the bad actors. It’s just another reason we can’t let him win in November.

Continue the discussion at forums.talkingpointsmemo.com

52 more replies


Avatar for system1 Avatar for richardinjax Avatar for jeffgee1 Avatar for eldonlazar Avatar for eggrollian Avatar for globalguy Avatar for gatorgirlnc Avatar for DuckmanGR Avatar for dont Avatar for sniffit Avatar for lastroth Avatar for jkrogman Avatar for vlharpley Avatar for fiftygigs Avatar for benthere Avatar for slimjim33 Avatar for brian512 Avatar for tpr Avatar for kelaine Avatar for demosthenes59 Avatar for jwbaker Avatar for justruss Avatar for dogselfie Avatar for carpe_diem

Continue Discussion
Masthead Masthead
Founder & Editor-in-Chief:
Executive Editor:
Managing Editor:
Associate Editor:
Editor at Large:
General Counsel:
Head of Product:
Director of Technology:
Associate Publisher:
Front End Developer:
Senior Designer: