An attempt to spam social media platforms to drown out coverage of China’s lockdown protests was likely backed by the Chinese government, according to analysis by a US cybersecurity firm.
Recorded Future found that networks of coordinated bot accounts were targeting non-Chinese social media platforms to oust real posts about the demonstrations with spam content and hijack hashtags of Chinese city names. China’s government was most likely behind the tactic, it said.
Charity Wright, senior analyst at Recorded Future, said, “These spambot networks are resilient, well-resourced and agile. The speed at which they post content and open new accounts tells us they have automation tools to flood the information space. Very few Influence Operations are capable of this level of activity.”
“We think it’s likely that this was a large-scale operation, either sponsored by the Chinese government or outsourced by the state to a proxy like a well-resourced troll farm,” she added.
The analysis follows evidence over the past week that Twitter has been bombarded with harassing posts, many promoting escorts, to cover up the news of anti-lockdown protests in China. Alex Stamos, director of the Stanford Internet Observatory, said the Chinese activity shows the “first major failure” to stop government interference in the platform under Elon Musk’s ownership.
Recorded Future found that networks with thousands of accounts and posts were targeting Mandarin-speaking audiences by jumping on hashtags used to label coverage of the protests. Using these Chinese-language hashtags, the bot accounts then distribute large amounts of posts — for example, the locations of the protests such as Beijing, Shanghai, Guangzhou, Shenzhen, and Wuhan — with content such as escort ads, dating sites, pornography, and short video clips promoting various services.
In some cases, the posts consist of random sequences of English words with tracking codes attached to potentially measure how many posts are used.
Recorded Future said the automated accounts were the hallmark of coordinated disinformation campaigns. Telltale signs include using newly created accounts with zero or low follower counts; Accounts created in blocks of hundreds or thousands; Using similar account name structures like female name + numbers; identical text content; and sharing photos or videos of young Asian women.
“At first glance, it seems that this campaign is designed to drown out the discussion of the anti-Covid lockdown protests in China,” Wright said.
She said there was evidence that botnets had hijacked city name hashtags in previous campaigns, including in September and late October.
Recorded Future’s analysis of the cross-platform disruption campaign found limited distribution of annoying bot content on Facebook and Instagram, while there was nothing notable on Chinese-owned TikTok, which broadcasts footage of the protests.
Wright said authorities in China and domestic social media platforms were able to take quick action against content they found objectionable. However, this is not possible for foreign-owned platforms, making bot accounts a potential option to suppress coverage of the demonstrations.
“One way is to control the narrative by flooding the platform with whatever narrative they prefer,” Wright said. “In this case, the spambots didn’t tell a specific story or advance a government-sponsored narrative. Instead, they just flooded social media feeds with spam content.”