Open source Twittor tool can control botnets via Direct Messages

A security researcher has created a tool that allows botnet masters to control their botnet by simply sending out commands via Twitter accounts.

“I mostly wanted to create a PoC after Twitter decided to remove the 140 characters limit for Direct Messages,” he noted.

The project is open source (available on GitHub), and the researcher – London-based Paul Amar – invited developers to “fork the project, contribute, submit pull requests, and have fun.”

The tool – dubbed Twittor – is a Python-based backdoor. To use it, a botmaster needs to open a Twitter account, set up a Twitter app, and get Twitter API credentials, so that they can be inputed in the script.

Twittor allows botmasters to list active bots, execute commands on it, refresh C&C control, and more – all via Direct Messages.

The tool has been inspired by gcat, another open source, Python-based backdoor that uses Gmail as a command and control server.