{"id":3080,"date":"2025-03-05T13:56:46","date_gmt":"2025-03-05T10:56:46","guid":{"rendered":"https:\/\/factcheck.lt\/?p=3080"},"modified":"2025-05-02T09:41:30","modified_gmt":"2025-05-02T06:41:30","slug":"","status":"publish","type":"post","link":"https:\/\/factcheck.lt\/eng\/news\/youtube_botnet_belarus\/","title":{"rendered":"Network manipulation: How a coordinated network of bots works in the comments of Belarusian YouTube channels","raw":"Network manipulation: How a coordinated network of bots works in the comments of Belarusian YouTube channels"},"content":{"rendered":"

A study of comments on video materials posted in February 2025 on Belarusian democratic YouTube channels revealed a large-scale coordinated network of bots systematically influencing public opinion.<\/p>\n

The analysis processed 85,736 comments on 1,132 videos left by 32,326 unique authors. Among them, 2,845 accounts were identified as having left 5 or more comments, of which 201 accounts were identified as potential bots based on behavioral indicators.<\/p>\n

Network Structure<\/strong><\/p>\n

Analysis of connections between bots revealed a clear cluster structure with several distinct communities.
\n\"\"<\/span><\/p>\n

The network visualization demonstrates at least four well-defined clusters (blue, green, yellow, and purple) that function as coordinated groups commenting on the same videos. Key accounts occupying central positions in the network are distributed among clusters. In the blue cluster, accounts such as @NataliaPetrovaa-sr4ll<\/code>, @user-xt5zt9whLj<\/code>, and @Leto2jmoy<\/code> stand out. In the green cluster, @\u0421\u0432\u044f\u0442\u043e\u0441\u043b\u0430\u0432-n4c6x<\/code>, @\u0421\u0432\u043c\u0441\u043e\u043d\u041a\u0430\u0440\u043f\u043e\u0432\u0438\u0447<\/code>, @\u0412\u0430\u0434\u0438\u043c-yb34lj<\/code>, @PiterFan117j94<\/code>, and @\u0410\u043b\u0435\u043a\u0441\u0430\u043d\u0434\u0440-j47t1c<\/code> play central roles.<\/p>\n

More detailed analysis revealed 5 functional bot clusters with different roles.
\n\"\"<\/p>\n

Cluster 0, with 4 participants, represents “wide-reach bots”<\/strong><\/em> with high indicators of comment quantity and number of commented videos.
\n\"\"<\/p>\n

Cluster 1 includes 2 participants and functions as a group of “scouts”<\/strong><\/em> focused on maximum coverage of different videos with fewer comments on each.<\/p>\n

The most numerous is Cluster 2, uniting 182 participants.
\n\"\"<\/p>\n

These bots act as “content generators”<\/strong><\/em> with very high average comment length and commenting frequency.
\n\"\"<\/p>\n

Cluster 3, which includes 2 participants, specializes in the role of “analysts”<\/strong><\/em> creating very long, detailed comments.
\n\"\"<\/p>\n

Cluster 4, also consisting of 2 participants, acts as a group of “spammers” with the most obvious signs of automation, high frequency of commenting, and significant video coverage.<\/p>\n

Temporal Activity Patterns<\/strong><\/p>\n

Analysis of the bots’ temporal activity revealed clear patterns indicating the coordinated nature of the operation.
\n\"\"<\/span><\/p>\n

In February 2025, four main activity peaks were recorded: February 17 (226 comments), February 18 (243 comments), February 19 (300 comments, highest peak), and February 25 (296 comments). An additional peak was noted on March 1 (244 comments). After this, a sharp drop in activity was observed in early March, which may indicate the end of the information campaign or a change in tactics.
\n\"\"<\/span><\/p>\n

The distribution of activity by day of week and hour shows that the highest intensity occurs on Tuesday and Wednesday, as well as in the morning hours (4-7 hours UTC, which corresponds to 7-10 hours Belarusian time). Such a temporal structure indicates a professional, organized nature of the activity, likely within a standard work schedule.<\/p>\n

Lexical Analysis<\/strong><\/p>\n

Analysis of the vocabulary used by bots showed clear thematic directions and narratives.
\n\"\"<\/span><\/p>\n

Among the most frequent words, geographic and political markers dominate, such as “belarus”, “belarus”, “lukashenko”, “usa”, “ukraine”, “rf”, indicating the geopolitical orientation of the comments.<\/p>\n

Particularly revealing was the analysis of trigrams (sequences of three words), demonstrating the use of template constructions for mass commenting.
\n\"\"<\/span><\/p>\n

Pro-government trigrams stand out (“thanks to the president of rb”, “to the president of rb our”, “rb to our batka”), constructions supporting power structures (“glory to the power structures”, “structures protected belarusian”), anti-opposition phrases (“belarusian people prazi”, “people prazi latushko”) and patriotic statements (“belarus lived lives”, “lives live forever”).<\/p>\n

The nature of the trigrams indicates the use of ready-made templates and phrases, which is consistent with the identified botnet structure, especially with the dominant cluster 2 (“content generators”).<\/p>\n

Target Video Materials and Engagement Analysis<\/strong><\/p>\n

Analysis of target video materials showed that bots predominantly attack videos about civic activity. The absolute leader in the number of bot comments was the video “Belarusian woman showed an example of courage” (about 400 comments).
\n\"\"<\/span><\/p>\n

Significant attention is also paid to materials about international relations, such as “ARMENIAN WOMAN HOSTAGE! Lukashenko bargains with Yerevan…” and “Russia and the US voted together at the UN for the first time in…”.<\/p>\n

Channels whose videos were most attacked in February 2025:<\/p>\n