New research published by the cybersecurity firm Mandiant Threat Intelligence, in collaboration with Google’s Threat Assessment Group, has highlighted the dangerous evolution of Chinese influence operations online. A suspected Chinese government-affiliated network of hundreds of fake accounts, first detected in June 2019, has increased the scope of its activities, permeating more platforms, employing more languages, and even inciting users to take real-world action. Ryan Serabian and Lee Foster summarized these concerning new developments on the FireEye blog:
The scope of activity, in terms of languages and platforms used, is far broader than previously understood. Most reporting has highlighted English and Chinese-language activity occurring on the social media giants Facebook, Twitter, and YouTube. However, we have now observed this pro-PRC activity taking place on 30 social media platforms and over 40 additional websites and niche forums, and in additional languages including Russian, German, Spanish, Korean, and Japanese. While some platforms have hosted hundreds or thousands of accounts in the network, other platforms have hosted a smaller number. Collectively, these observations suggest the actors behind this campaign have significantly expanded their online footprint and appear to be attempting to establish a presence on as many platforms as possible to reach a variety of global audiences.
Accounts in the network have actively sought to physically mobilize protestors in the U.S. in response to the COVID-19 pandemic, though we have seen no indication that these attempts motivated any real-world activity. While previous public reporting has highlighted limited instances of organic engagement with the network on Twitter and we have continued to track similar instances of organic engagement on both social media and niche online forums, this direct call for physical mobilization is a significant development compared to prior activity, potentially indicative of an emerging intent to motivate real-world activity outside of China’s territories. [Source]
Today @FireEye published a piece on on a pro-PRC coordinated influence actor: https://t.co/3Z9NCUhqFw
Google’s TAG has been tracking this actor for 2 years now and we internally call it DRAGONBRIDGE. Some observations: 🧵— Shane Huntley (@ShaneHuntley) September 8, 2021
Perhaps the most concerning aspect of the campaign’s new strategy is its attempt to incite protests in the U.S. Joseph Menn at Reuters described the content of the posts, some of which aimed to stir up protests:
In addition to promoting false information on the virus, researchers said priorities for the group include criticizing fugitive Chinese propagandist Guo Wengui and his ally, former Donald Trump strategist Steve Bannon, and exploiting concerns about anti-Asian racism.
[…] Some of the posts urged protesters to demonstrate against racism in the United States. In addition, they called on protesters to rally in April outside what the accounts said was the New York home of wealthy expatriate Guo, but there was little evidence that people showed up.
The coordinated fake accounts took that in stride, instead distributing doctored photos of a different protest in a different place. [Source]
The campaign’s push for real-world action appears to mimic tactics from Russian influence operations. “They’re copying the Kremlin’s playbook,” said John Hultquist, vice president of analysis at Mandiant, the cybersecurity firm that authored the report. During the 2016 U.S. presidential election, Russian-backed Facebook accounts publicized and financed over 60 rallies, protests, and marches around socially divisive issues. A growing body of evidence has shown that China and Russia are supporting one another’s disinformation campaigns.
Researchers stated that the network was the same one behind the 2019 coordinated influence campaign on Western social media platforms that sought to undermine the Hong Kong democracy protests. At the time, Twitter announced that it had deleted almost 1,000 accounts originating in China and suspended 200,000 more, and Facebook removed several Chinese government-backed pages followed by thousands of real users. YouTube also removed 3,000 channels linked to the network. Benjamin Strick, Director of Investigations at the Center for Information Resilience, described the main objectives and targeted subjects of the Chinese network in 2019:
Our research shows evidence of a deliberate effort to distort international perceptions on significant issues – in this case, in favour of China. The aim of the network appears to be to delegitimize the West by amplifying pro-Chinese narratives. There appears to be close overlaps in narratives shared by the network, to those shared by the social media accounts of China State representatives and state-linked media.
The network targets significant subjects such as US gun laws, COVID-19, human rights abuses in Xinjiang, overseas conflicts and racial discrimination in an apparent bid to inflame tensions, deny remarks critical of China, and target Western governments. The content was posted in English and Chinese.
The narratives CIR uncovered in this influence operation have strong similarities to content seen on the accounts of Chinese Government representatives and China state-linked media. [Source]
The network uncovered by these researchers echoes a broader set of Chinese state influence campaigns on Western social media. In June, an investigation by ProPublica and the New York Times revealed an elaborate Chinese government campaign to counter allegations of forced labor in Xinjiang by enlisting Uyghurs to make individual propaganda videos, which accumulated hundreds of thousands of views on YouTube and other social media platforms. In May, the Associated Press and the Oxford Internet Institute reported on an army of fake Twitter accounts whose posts were frequently shared by Chinese diplomats and state media, reaching millions of viewers. Non-Chinese vloggers have also popped up on Western video streaming platforms to endorse pro-CCP narratives, in suspected coordination with Chinese state media. And, of course, Chinese diplomats have continued their “Wolf Warrior diplomacy” on Twitter.
One major topic of recent Chinese global influence campaigns has been the Covid-19 pandemic. Chinese actors have overtly and covertly peddled conspiracy theories and other disinformation on the origin of the virus, the effectiveness of Western vaccines, and the responsiveness Western governments. These efforts have yielded mixed results and prompted pushback from the West: in 2020, the European Union, usually tepid about confronting Beijing, labeled China a source of disinformation on the pandemic.
While the Chinese influence campaign tracked by Mandiant may not have succeeded in mobilizing many people this time, these increasingly pernicious attempts are warning signs for the future of democratic resilience. “[T]he most significant features of this network remain its scale and persistence, in spite of low engagement levels,” said Shane Huntley, Director of Google’s Threat Analysis Group. “We anticipate they will continue to experiment to drive higher engagement and encourage others in the community to continue tracking this actor, shedding light on their operations and taking action against them.”
