These may hit a site from a variety of locations, landing pages and device types, ultimately showing a relatively normal distribution. However, they are identifiable as spam bots because they create spikes of “Direct” traffic with high bounce rates that hit a large number of landing pages (most legitimate direct traffic will land on the homepage or high category level pages).
Because of their relatively normal distribution of traditional user data, they are also difficult to remove. Removing a large breadth of cities can ultimately exclude legitimate traffic. The solution lies in greater data segmentation using dimensions you likely do not frequently use within Google Analytics: browser size, browser version, network domain, screen resolution and Flash version. We frequently see outdated or not set values for these bot sources.