In the modern digital space, information wars go beyond traditional propaganda, turning into complex, high-tech operations. TikTok botnets have become not just a tool for promoting narratives, but also part of strategic information manipulation aimed at shaping public opinion.
As emphasized by Kaja Kallas, High Representative of the European Union for Foreign Affairs and Security Policy, in her keynote speech at the conference held on March 17-18, 2025, dedicated to countering foreign information manipulation and interference (FIMI):
“We must take advantage of artificial intelligence, not just talk about its risks.
Artificial intelligence is capable of:
- identifying patterns when analyzing large data sets;
- detecting bot networks;
- verifying information by cross-checking with reliable sources;
- and also helping to identify key participants in information operations.”
Using AI to analyze such campaigns is becoming an essential tool in the fight against disinformation. In this article, we will present a comprehensive study of botnets operating through Belarusian TikTok channels — from network structures to characteristic linguistic patterns and technical signs of automation.
The analysis of two pro-government Belarusian TikTok channels affiliated with state propaganda revealed large-scale and systematic use of coordinated botnets to promote content and shape public opinion. Clearly structured bot networks with various behavioral characteristics, centralized management, and pronounced linguistic patterns corresponding to state propaganda narratives were detected.
The following TikTok channels were selected for analysis: @first_news_ and @belarusseychas. Brief information about the channels:
Data source – Exolyt
Comments on videos for January 2025 were collected. The dataset consists of 320 videos and 19,062 unique comments.
A suspicion coefficient of 3.5 was chosen, which reduced the number of false positives, allowing only obvious bots to be identified.
Structure and Organization of Botnets
Analysis of activity in Belarusian TikTok channels revealed a complex botnet structure consisting of 129 bots with various functional characteristics. To understand their roles and behavior, two clustering methods were applied, each providing valuable information about the typology and organization of bots.
Applying the K-means method with an optimal number of clusters k=4 allowed dividing bots into four functional groups. The largest group, which can be called the “Mass Base,” consists of 104 low-activity bots with an average level of suspicion (80.6% of the total). Their main task is to create “background noise” supporting the state position. The second group – “Amplifiers” – consists of 9 low-activity bots with a high level of suspicion (7.0%), which participate in targeted campaigns to strengthen certain narratives. The smallest but most influential group of “Opinion Leaders” includes only 2 highly active bots with a very high level of suspicion (1.6%), generating the main content and setting the tone for discussions. The fourth group – “Distributors” – consists of 14 medium-activity bots (10.8%), specializing in distributing messages from “opinion leaders.”
The parallel application of the DBSCAN method proposed an alternative division into 6 clusters, providing additional nuances in understanding the botnet structure. This method identified the “Outliers” cluster of 15 bots with anomalous behavior, not fitting standard templates; Cluster 1 of 4 bots with the highest suspicion score (4.83); Cluster 2 of 8 bots with a high level of comment duplication; Cluster 3, including 93 bots, forming the bulk of the botnet with moderate activity; Cluster 4 of 3 specialized bots with a low duplication rate; and Cluster 5 of 6 bots with a low suspicion score, masquerading as regular users.
The distribution of bots between clusters demonstrates the typical structure of professional botnets, where a small core of highly active bots coordinates a large periphery of low-activity ones. The objectivity of clustering is confirmed by the “elbow” method, which independently confirmed the optimal number of clusters k=4.
Visualization in two-dimensional space shows a clear distinction of bots into functional groups with minimal overlap, indicating a well-thought-out segmentation of the botnet.
Signs of Coordination
Analysis of the detected botnets revealed numerous signs of centralized coordination and coordinated activity. One of the most convincing indicators is the high overlap of bots between different channels, as reflected in the table:
For some channel pairs, this indicator reaches 75%, which practically excludes the probability of random coincidence. Such a high degree of overlap indicates centralized distribution of bots across channels and their coordinated movement in accordance with changing priorities of the information campaign.
The first line of videos with overlapping comments but posted on different channels:
The study of content duplication patterns also confirms the presence of centralized management. 296 identical comments were reproduced by 31 bots without any changes or variations. Such uniformity of content on various channels and from different accounts is impossible without a single control center distributing template texts. Moreover, linguistic analysis showed that even non-identical comments are often built according to the same structural templates with only some elements replaced, which also indicates centralized content development.
Topological analysis of network connections reveals a complex hierarchical structure of the botnet. The graph clearly shows centralized hubs acting as coordination centers, and connections extending from them to peripheral bots. Such topology is typical of managed botnets with a clear hierarchy and division of roles. Particularly characteristic is the presence of intermediate nodes that perform the function of transmitting commands from central hubs to groups of executive bots. The density of connections within the identified clusters is significantly higher than between them, which confirms the managed segmentation of the botnet into functional groups.
Behavioral Patterns
Analysis of bot behavioral patterns revealed a significant imbalance in the distribution of activity between different types of accounts, which is clearly visible in the graph:
The vast majority of bots, namely 99 accounts, demonstrate average suspicion with very low activity, allowing them to remain inconspicuous to standard detection systems. In contrast, a small number of highly active bots (only 2) generate a disproportionately large amount of content, averaging 41.5 comments per account. Such asymmetry in activity indicates a carefully thought-out distribution of roles: low-activity bots create the illusion of mass support, while highly active ones set the direction of discussion and produce the main content.
The study showed that 58% of all bot activity is concentrated on just ten videos, with the highest concentration on the most popular video, where each bot accounts for more than 20 comments. Such concentration indicates strategic prioritization of key platforms to maximize influence. Notably, the choice of videos for intensive commenting correlates with their potential audience and thematic focus, indicating a targeted approach to spreading certain narratives.
In the structure of bot distribution across videos, a dual strategy is revealed: on one hand, a significant portion of bots (42%) are distributed across numerous “other” videos, creating the effect of dispersed presence; on the other hand, a substantial concentration (10.5%) is observed on the leading video, providing intensive impact on the key audience. Such distribution maximizes both the breadth of coverage and the depth of influence on priority areas, which is characteristic of professionally planned information campaigns.
Content Analysis
Linguistic Features
Detailed analysis of n-grams in comments left by bots revealed clearly expressed linguistic patterns characteristic of pro-government propaganda. The graph shows that the most frequent words in comments are “money” (51), “when” (35 mentions), “help” (29), “will be” (26), “is” (24). Such lexical concentration is not typical of natural communication and clearly indicates the thematic focus of the information campaign. Notably, these words form a semantic field related to the prospects of economic support and stability.
The bigram graph shows a stable structure of two-word combinations in bot comments. The dominant bigrams can be divided into three main categories: related to economic well-being and stability, expressing support for the current political course, and criticizing the opposition and Western countries. Such distribution corresponds to typical narratives of state propaganda and indicates centralized formation of the information agenda. Quantitative analysis revealed that the most popular bigrams occur with a frequency significantly exceeding the natural distribution in regular communication.
The study of trigrams deepens the understanding of the propaganda content structure. The identified three-word constructions represent template phrases with pronounced emotional coloring, aimed at forming a positive perception of state policy. Stable constructions, repeated in various comments with minimal variations, serve as additional evidence of an organized campaign with centralized content planning. Notably, some trigrams form complete syntactic templates that can be filled with different content while maintaining the overall structure and direction of the message.
Thematic Analysis
Analysis of the thematic focus of bot comments revealed several dominant narratives. Economic themes clearly prevail in comments, as confirmed by the frequency of words like “money,” “will be,” “help,” and “is.” The emphasis on economic well-being and material support corresponds to the traditional strategy of legitimizing power through appealing to economic stability. Notably, economic narratives are often presented in the form of promises of future improvement, which is characteristic of establishing an emotional connection with the audience through creating positive expectations.
The second most significant thematic direction is the promotion of stability and security narratives. This theme often manifests in the context of contrasting internal stability with external threats, creating a cognitive frame of a “safe haven” in a turbulent world. Such a narrative appeals to basic security needs and forms a positive association between the existing political regime and a sense of protection.
A notable feature of the comments is the consistent “us-them” opposition, which is traced in the context of many discussions. This opposition serves to strengthen group identity and create an image of an external enemy, which is classically used to consolidate support for the current government. Linguistic markers of such opposition include the use of inclusive pronouns “we,” “our,” “us” in contrast to exclusive “they,” “their,” “foreign.”
Features of Comment Structure
Detailed analysis of comment structure, presented in the graph, revealed several characteristic features. The most notable is the extreme brevity of most messages – the median comment length is only 3 characters. Such brevity is atypical for natural communication and indicates a minimalist approach to forming a mass presence with minimal resource expenditure.
At the same time, there is a high dispersion of comment length: with a median of 3 characters, the average value is 30.5 characters. Such a significant discrepancy indicates the presence of both very short and substantially longer template comments. This can be explained by different functional roles of comments: short ones are used to create the appearance of mass support, while long ones are used to promote more complex narratives.
Low content diversity, reflected in a high duplication rate. Such uniformity is fundamentally different from natural communication, where repetitions are rare and usually contextually determined. The high degree of duplication serves as additional confirmation of the automated nature of commenting and centralized content management.
Technical Characteristics of Botnets
Detailed Metrics of Suspicion
Technical analysis of suspicion metrics allows detailed characterization of various aspects of automated bot activity. The Suspicious Score shows fairly high values across the sample with an average score of 4.02 for all bots.
The most suspicious according to the K-means method is cluster 2 with a value of 3.91, while using the DBSCAN method highlights cluster 1 with an even higher score of 4.83. The specially identified DBSCAN outliers cluster, including 15 bots, demonstrates an average suspicion score of 4.02, corresponding to the general trend. Notably, the relatively small standard deviation of suspicion (0.32) indicates homogeneity of metrics and may indicate a unified methodology for creating and managing bots.
Analysis of the number of comments (Comment Count) reveals significant variability in activity between different types of bots. The average is 5.8 comments per bot, but the distribution is extremely uneven. The maximum value, reaching 41.5 comments per bot, is observed in cluster 2 according to the K-means method, while the minimum value – only 1.26 comments – is characteristic of cluster 0. The intermediate position is occupied by cluster 3 K-means with 11.07 comments on average per bot. The high variability of this indicator (standard deviation 8.4) indicates a functional division of roles in the botnet, where different groups of bots perform different tasks within a single information campaign.
The content duplication coefficient (Duplicate Ratio) demonstrates a high degree of comment repeatability overall with an average indicator of 0.68. However, this indicator varies significantly between clusters. The lowest value (0.04) is characteristic of cluster 0 K-means, which may indicate a deliberate strategy of masking bots of this type as natural users. High duplication rates are observed in clusters 1 (0.74), 2 (0.77), and 3 (0.83) K-means, indicating the predominant use of template comments in these groups. Such distribution clearly demonstrates the diversification of strategies of different types of bots within a single network.
The indicator of unique comments (Unique Comments) and the number of commented videos (Videos Commented) complements the picture of technical characteristics of the botnet. The average number of unique comments is 1.84 per bot, with a maximum value of 9.5 in cluster 2 K-means and a minimum of 1.11 in cluster 0. Such variability (standard deviation 2.14) once again emphasizes the diversity of functional roles of bots. The average number of commented videos is 4.36 per bot, however, cluster 2 K-means stands out with an extreme value of 39.5 videos, demonstrating wide coverage, while cluster 0 focuses on only 1.26 videos on average. The ratio of comments to videos shows stable values from 1:1 to 1.05:1, indicating a systematic commenting strategy.
TF-IDF and Text Analysis
Analysis of the textual content of comments using the TF-IDF metric identified key words with the highest weight, characterizing the specifics of bots. The highest weight was given to the word “money” (0.037349), indicating its disproportionately high frequency in bot comments compared to natural communication. Other high-weight words include “on” (0.031240), “not” (0.029157), “for” (0.018645), “respect” (0.018131), “this” (0.016081), “recovered” (0.014544), “how” (0.014721), “these” (0.014373), and “free” (0.012913). Semantic analysis of this vocabulary set demonstrates a clear orientation towards financial and economic topics with elements of encouragement and approval.
The distribution of TF-IDF values demonstrates a characteristic pattern: the top 30 words have values from 0.008 to 0.037, with a clear exponential decrease in significance after the first ten lexical units. Notably, the grouping of words by TF-IDF values correlates with the identified bot clusters, confirming the presence of specialized lexical sets for various functional groups of automated accounts. This fact is additional evidence of centralized content management.
Parameters of comment length demonstrate anomalous distribution characteristics. With a median comment length of 3.0 characters, the average value is 30.5 characters, indicating a strong positive skewness of the distribution (skewness coefficient 0.86). This feature is emphasized by the high kurtosis of the distribution (3.24), demonstrating a concentration of values atypical for natural communication. Analysis of quantiles shows that 75% of comments are shorter than 25 characters, while atypically long comments (over 200 characters) make up less than 5% of the total sample. Such a bimodal distribution with a predominance of extremely short comments confirms the artificial nature of content generation.
Technical Signs of Automation
Temporal metrics of bot activity provide additional technical evidence of automation. The average time between consecutive comments from one bot is 212 seconds, but this indicator differs significantly between bot types. The coefficient of variation of intervals (time_diff_cv) is only 0.45 for highly active bots, indicating significant regularity of their activity, while for low-activity bots this indicator reaches 1.86, demonstrating more pronounced randomness of intervals, probably for better imitation of natural behavior. Rhythmic publication is characteristic of 85% of bots, which demonstrate quasi-periodic activity with elements of deliberately introduced noise.
Analysis of behavioral patterns reveals numerous signs of automation. The high rate of comment duplication (duplicate_ratio) reaches 0.77 in some clusters, which is fundamentally impossible for natural communication. Low variability of the vocabulary used, expressed through a coefficient of variation of 0.34, is also uncharacteristic of human interaction. The template nature of syntactic constructions is traced in the fact that identical n-grams are found in 62% of comments, demonstrating structural uniformity of the generated content. The regularity of publication time intervals is particularly noticeable in highly active bots, where the standard deviation is only 42.6 seconds. Special attention deserves the high degree of correlation (0.78) between activity spikes of bots from different clusters, which clearly indicates centralized management and coordination of actions.
Architecture and Topology of the Botnet
Topological analysis of the network characteristics of the botnet demonstrates a clear structural organization. The average clustering coefficient of the network is 0.42, indicating a tendency to form densely connected groups. Network density is 0.16, reflecting moderate intensity of interconnections between nodes. The average node degree is 4.8 connections, demonstrating a branched network structure. The network diameter, equal to 6, indicates the compactness of the structure, where any two nodes can be connected through a limited number of intermediate links. Network modularity (0.58) indicates pronounced clustering and the presence of relatively isolated functional groups.
Structural features of the botnet allow identifying 4-6 clearly distinct bot communities with different functional roles. Of particular note are the discovered intermediary nodes, performing the function of connecting elements between different clusters and ensuring coordination of activity. The botnet structure features three central hubs with a high degree of connectivity (more than 15 connections per node), which likely perform the role of control centers. Topological analysis reveals a hierarchical structure with 2-3 levels of subordination, which is typical for centrally managed botnets. Characteristic is the presence of “bridges” between network segments, demonstrating high betweenness centrality (betweenness centrality > 0.5) and ensuring the transmission of commands and content between functionally different groups of bots.
The matrix of bot overlaps between channels demonstrates stable patterns of bot distribution. The maximum overlap, reaching 75%, is observed between channels 7457093455341488 and 7457103375063092, indicating their close thematic connection or commonality of target audience. The smallest significant overlap (40.9%) is recorded between channels 7457093455341488 and 7464510189153094, which may indicate their relative thematic isolation. The average level of bot overlap between channels is 53.7%, which is an extremely high indicator, uncharacteristic for the natural distribution of users. The standard deviation of overlaps (9.3%) demonstrates relative homogeneity of this parameter, which further confirms the centralized distribution of bots across channels.
Technological Level
Comprehensive analysis of technical characteristics allows classifying bots by the level of complexity of the technologies used. The most numerous group (80.6% of bots) consists of basic replicator bots, corresponding to cluster 0 K-means. They demonstrate a simple algorithm of copying and pasting content, low activity (an average of 1.26 comments per bot) and extremely low diversity (1.11 unique comments). The main function of these bots is to create background “noise” of support, creating the illusion of mass presence.
Intermediate-level bots, represented by cluster 3 K-means (10.8% of the total), demonstrate moderate activity (11.07 comments per bot) while maintaining low content diversity (1.64 unique comments) and a high level of duplication (0.83). These bots are used primarily to amplify individual narratives within the information campaign, performing the role of “amplifiers” of key messages.
Advanced bots, corresponding to cluster 1 K-means (7.0% of bots), are characterized by medium activity (5.78 comments) with moderate content diversity (1.44 unique comments). A distinctive feature of these bots is a higher level of natural language imitation, which allows them to successfully integrate into existing discussions and influence their direction. They play the role of “discussion manipulators,” changing the tone and focus of discussions.
The most technologically complex group consists of elite bots, corresponding to cluster 2 K-means (1.6% of the total). These bots demonstrate extremely high activity (41.5 comments per account), significant content diversity (9.5 unique comments), and wide video coverage (39.5 commented recordings). Presumably, these bots are used to initiate discussions in a given direction and establish basic narratives, which are then relied upon by other types of bots. The technological level of these bots suggests the use of more complex content generation algorithms, possibly with elements of machine learning for better imitation of natural user behavior.
Thus, the analysis demonstrates the application of multi-level technological solutions: from simple scripts for mass actions to complex systems with elements of adaptive behavior for imitating natural communication. Such technological differentiation is typical for professionally organized information campaigns with centralized management and strategic resource allocation.
Conclusions
The conducted research provides convincing evidence of the use of botnets by two pro-government Belarusian TikTok channels to promote the official state position. Based on a comprehensive analysis of data for January 2025, several key conclusions can be drawn.
The characteristics of the identified botnets indicate a high professional level of campaign organization. The scale and structure of the network, clear coordination of actions between different groups of bots, well-thought-out linguistic patterns, and carefully calibrated temporal characteristics of activity indicate the presence of significant resources and centralized management. Particularly noteworthy is the well-thought-out strategy of distributing bots across different clusters with a clear division of functions, which speaks to serious strategic planning of the operation.
Content analysis of bot comments confirms their focus on promoting pro-government narratives. The dominant themes are economic stability, support for the current government, criticism of opponents and Western countries, as well as forming a positive image of state policy. Linguistic analysis revealed stable speech constructions and templates characteristic of official propaganda.
The technological level of the detected botnets indicates the application of modern methods of automation and algorithmic adaptation. Notable is the system’s ability to adapt to the mechanisms of the social platform, which is manifested in the well-thought-out distribution of resources and evolution of methods of influence. Of particular note is the ability of botnets to adapt to changes in detection algorithms through dynamic changes in activity parameters.
Overall, this study not only confirms the fact of using coordinated botnets to promote the state position through TikTok channels affiliated with Belarusian propaganda, but also allows considering this activity as part of a broader strategy of information influence, implemented using modern technologies and methodologies of network impact.
