Olivier Bilodeau - Industry of Social Media Manipulation Driven by Malware
Exposes the malware-driven underground industry providing fake engagement (followers, likes, shares) powering disinformation operations at scale.
Summary
Malware-Backed Social Media Manipulation
Olivier Bilodeau (Cybersecurity Research Director, GoSecure) presents research exposing the technical infrastructure behind coordinated social media manipulation operations powered by malware botnets.
The Manipulation Industry
A well-organized underground market provides 'social media marketing' services: fake followers, likes, retweets, YouTube views, and review scores. These services are typically powered by infected devices in consumer malware botnets, not server farms, providing realistic geographically distributed traffic.
Malware Integration
Bilodeau analyzes malware families that include social media manipulation modules alongside traditional banking trojans and ransomware droppers, showing how click fraud, credential theft, and fake engagement generation run as parallel monetization threads on the same compromised systems.
Operation Analysis
The talk includes analysis of a specific manipulation operation's infrastructure: C2 panels managing 100,000+ infected devices performing coordinated social media actions, complete with task scheduling, anti-detection delays, and revenue reporting dashboards.
Related talks
Main Stage·40 min
Mikko Hypponen
Mikko Hypponen explores the preservation of historic malware samples, early virus artistry, and four decades of digital threats in the Malware Museum.
Main Stage·16 min
Valerio Alessandroni
Valerio Alessandroni demonstrates how remote access trojans abuse trusted Google Cloud services and APIs for stealthy C2 communication and proxy tunneling.
Main Stage·47 min
Alessandro Magnosi
Malware deployment tactic exploiting NTFS features and emulated read-only filesystems to bypass endpoint inspection.