- The bot network, which made posts in at least seven languages, apparently aimed to promote the Chinese government and influence American online users.
- Mandiant first detected its movement in June 2019, which mainly “focused on discrediting pro-democracy protests in Hong Kong.”
- At the time, the propaganda activities were limited to Twitter, Facebook and YouTube. The network has since expanded its scope and has also started using artificially generated images for account profile pictures.
- The network reportedly began pushing stories critical of Chinese virologist Dr. Li-Meng Yan and Chinese dissident Guo Wengui, multiple narratives about the COVID-19 pandemic, and domestic U.S. political issues.
- While Mandiant emphasized that there was “no evidence” that the online network’s activities would succeed, it expressed concern about the intention behind them.
- “This direct call for physical mobilization is a significant development compared to prior activity, potentially indicative of an emerging intent to motivate real-world activity outside of China’s territories,” the report noted. “We believe it is important to call attention to such attempts and for observers to continue to monitor for such attempts in future.”
- According to the Wall Street Journal, the researchers noted how similar the network’s efforts were to Russia’s activities during the 2016 presidential election.
- “They’re copying the Kremlin’s playbook,” John Hultquist, Mandiant’s vice president of analysis, was quoted as saying.
- While the report did not directly attribute the network to the Chinese government, Hultquist said the activity is “almost certainly supported by a government sponsor, either directly through a government agency or a third-party contractor.”
- Hultquist pointed out that the campaign not only advances China’s interests, but also appears to involve “significant resources, based on the growing scale of this operation.”
- In a series of tweets on Wednesday, Google’s Threat Analysis Group head Shane Huntley shared that the company had been tracking the network’s operation for the past two years, noting the posts are often removed immediately after receiving only a small amount of engagement online.