Behind the Scenes: The Industry of Social Media Manipulation Driven by Malware

Overview: Olivier Bilodeau, Director of Cybersecurity Research at GoSecure, and Masarah Paquet-Clouston, researcher at GoSecure and the University of Montreal, present a four-year technical investigation into the commercial malware ecosystem driving social media fraud. Focusing on the Linux/Moose IoT botnet, the researchers examine how compromised embedded devices are converted into proxy networks to facilitate fake follower and like campaigns across Instagram, Twitter, and Facebook. The talk details the reverse engineering of malware payloads, network honeypots, traffic decryption, and the centralized infrastructure orchestrating mass account automation.

Key Topics: - The cybercrime supply chain of social media manipulation and black-market engagement services - Linux/Moose IoT botnet propagation mechanics targeting BusyBox-based embedded Linux routers via Telnet - Reverse engineering the in-memory proxy service and SSL/TLS man-in-the-middle traffic interception - Infrastructure analysis using Jupyter Lab, data clustering, and discovering centralized Windows automation clients

Technical Details: The speakers detail the economic supply chain underpinning social media fraud, where commercial entities, political influencers, and aspiring online personalities purchase artificial followers and engagement to distort platform visibility algorithms. At the foundational layer of this criminal industry sits Linux/Moose, an IoT worm first documented in 2015 that infects embedded Linux routers and network devices running the BusyBox userland environment. The malware propagates autonomously by conducting continuous Telnet credential brute-forcing against external IP addresses. Upon gaining access, Linux/Moose deploys an in-memory proxy payload that deliberately restricts its operational routing capabilities exclusively to social networking endpoints, specifically Instagram, Twitter, and Facebook.

To monitor botnet operations, the researchers deployed a global network of honeypots configured to capture Linux/Moose binaries and detonate samples in controlled analysis environments. Because the malware proxied encrypted HTTPS communication, the team implemented a custom SSL/TLS man-in-the-middle (MITM) interception pipeline using mitmproxy to decrypt and record raw HTTP transaction logs. Command-and-control (C2) analysis revealed the presence of 'whitelisted IPs' transmitted within botnet beacon messages. These whitelisted IPs represented exclusive servers authorized to route traffic through the residential proxy network formed by the infected routers, serving as the egress bridge to social media platforms.

To determine whether the botnet operated as an open, decentralized proxy reseller network or a closed enterprise, the researchers correlated packet captures (pcaps) with proxy logs inside Jupyter Lab using pandas dataframes and heuristic clustering algorithms. Analyzing variables including targeted websites, TLS fingerprints, and user-agent strings yielded inconclusive results. However, cross-referencing account creation requests and followed account targets revealed that each whitelisted IP maintained an isolated list of managed fake accounts, yet all accounts across disparate IPs simultaneously followed the exact same customer target profiles. Network intelligence further traced these whitelisted IPs to remote Windows servers hosted by OVH, where operators accessed Remote Desktop Protocol (RDP) sessions to run commercial automation software—thick-client applications displaying grid layouts that orchestrate tens of thousands of fake social accounts through the proxy mesh.

Key Takeaways: Social media manipulation relies directly on cybercriminal infrastructure, converting compromised consumer IoT routers into residential proxy networks that circumvent fraud detection algorithms. Network administrators must secure embedded Linux network equipment by disabling unencrypted Telnet interfaces and replacing default manufacturer credentials. Social media platforms and threat researchers must look beyond superficial user-agent strings and correlate synchronized following patterns across distributed proxy IP ranges to dismantle coordinated fake account farms.

(AI summary — Gemini Flash)