The network initially began in 2019 focusing on discrediting Hong Kong’s pro-democracy protests. The operation has since expanded in size and scope, spanning 30 social media platforms and 40 other websites and online forums in seven languages, according to a Sept. 8 report from U.S. security firm Mandiant Threat Intelligence.
In addition to echoing claims from Chinese state media, the group also made an active effort to get Americans to attend protests against anti-Asian sentiment, in what appears to show the Chinese operatives’ growing appetite to more directly influence real-world activities before a global audience.
In April, thousands of posts emerged calling on Asian Americans to demonstrate against “racial injustice.” Some posts—written in languages including Korean, Japanese, and English—specifically targeted fugitive businessman Guo Wengui, directing people to an address said to be Guo’s New York home to demonstrate against virus origin theories promoted by Guo, particularly that the virus was a biological weapon made by the Chinese regime.
While no evidence suggested such attempts were successful, it was an “early warning that the actors behind the activity may be starting to explore, in however limited a fashion, more direct means of influencing the domestic affairs of the U.S.,” the researchers wrote.
Mandiant didn’t have proof of involvement from Beijing-controlled bodies, and the pro-Beijing accounts have so far gained little traction on either major social media or niche platforms.
The network instead portrayed the April 24 protest as a success, posting doctored photos from a different rally that took place elsewhere a day earlier.
“It’s almost like they are being paid by volume,” instead of engagement, said Shane Huntley, director of the threat analysis group at Google.
On LiveJournal, a Russian networking service, and Argentine social media site Taringa, the pro-Beijing actors had attempted to cast doubt about the origins of the CCP virus, which causes COVID-19, such as by claiming that the virus came from Fort Detrick, or that the virus had first appeared in the United States and Europe, rather than a lab in the Chinese city Wuhan.
The posts sometimes have “fairly laughable” slip-ups, such as calling the “novel coronavirus” the “new crown virus,” Huntley noted on Twitter, although he observed the group has been improving its production quality, experimenting with higher resolution videos and better subtitles.
Researchers have also identified similar patterns in posts in other languages, possibly due to them being written by non-native speakers or automatic translation.
Despite the accounts’ failure in attracting meaningful engagement, the persistence and dedication as they expand their online footprint have been concerning, the researchers said.
“They’ve clearly got a wide mandate that’s global. Someone is giving them pretty broad orders,” said John Hultquist, vice president of intelligence analysis at FireEye, the cybersecurity firm that owns Mandiant.
