Google revealed on Thursday that it was taking steps to dismantle over 50,000 instances of activity orchestrated by a pro-Chinese influence operation known as DRAGONBRIDGE by 2022.
“Most DRAGONBRIDGE activity is low-quality content without a political message, populated across many channels and blogs,” the company’s Threat Analysis Group (TAG) said in a report shared with The Hacker News. “However, a small fraction of DRAGONBRIDGE accounts also post about current events with messages pushing pro-China talking points.”
DRAGONBRIDGE was first revealed by Google-owned Mandiant in July 2022, calling its failed effort to target rare earth mining companies in Australia, Canada and the United States aimed at sparking environmental protests against the companies.
Also known by the name Spamouflage Dragon, the spammy influencer network is known to have a presence across multiple platforms, including YouTube, Blogger, Facebook and Twitter, and primarily disseminates narratives critical of the US and favorable to China.
Some of the narratives included allegations that the United States interfered in the domestic affairs of other countries, while also highlighting themes of political discord, racial inequality, and inflation in an attempt to portray the nation in a negative light.
Despite the criticism of the United States, DRAGONBRIDGE’s pro-China content included narratives praising the country’s COVID-19 pandemic response, condemning pro-democracy protests, and intensifying support for the unification of Taiwan with China.
As part of its efforts to disrupt the threat actor’s activity, Google said it shut down 100,960 accounts across YouTube, Blogger and AdSense. It further noted that despite the abundant content production, DRAGONBRIDGE failed to attract an organic audience.
However, that hasn’t stopped the group from continually adapting its methods by creating animated political cartoons and producing higher-quality content to lure real users, TAG researchers warned.
A total of 56,771 YouTube channels created by DRAGONBRIDGE were disabled in 2022, with 58% of them having zero subscribers and 42% of the videos posted on those channels having zero views. On top of that, about 95% of Blogger blogs received 10 or fewer views.
“In the rare cases where DRAGONBRIDGE content did receive engagement, it was almost entirely inauthentic and came from other DRAGONBRIDGE accounts and not from genuine users,” TAG said. “Comment activity was mostly from other DRAGONBRIDGE accounts.”
The technology also pointed out that the coordinated inauthentic behavior was facilitated by leveraging Google Accounts purchased in bulk from account sellers who create and sell such accounts for a profit, in some cases even reusing dormant accounts previously used by other actors to build financially motivated campaigns.
“Despite their lack of traction with an authentic audience, DRAGONBRIDGE generates large amounts of content across multiple platforms, is persistent and continues to experiment in their tactics and techniques,” TAG said.
DRAGONBRIDGE is far from the only pro-China information operation to emerge in recent years. In August 2022, Mandiant revealed a campaign called HaiEnergy that used a network of fake news sites and social media to “reshape the international image of Xinjiang.”
