Google’s Threat Analysis Group (TAG) on Thursday published a report about a pro-China entity known as “Dragonbridge” or “Spamouflage Dragon” that flooded YouTube and other platforms with tens of thousands of messages last year.
Many of the messages were efforts to push Chinese Communist Party propaganda, such as criticism of Hong Kong pro-democracy activists.
TAG described Dragonbridge as a “spammy influence network linked to China” that created a huge number of dummy accounts on platforms like YouTube, Blogger, and AdSense, then used these accounts to pump out a blizzard of “low-quality content” mixed with some “messaging that pushes pro-China views.”
Much of the low-quality content was utter nonsense – clips of “animals, landscapes, food, sports, and other content” characterized by “garbled audio, poor translations, malapropisms, and mispronunciations.” Sometimes the creators made lazy mistakes such as forgetting to pull the standard gibberish “lorem ipsum” placeholder text from videos.
The sheer volume of these half-baked smokescreen posts made Dragonbridge the most prolific spammer Google took action against last year. TAG reported that at least 100,000 accounts associated with the network have been shut down.
As for the propaganda content, TAG said it “spanned a wide range of news topics – ranging from China’s [coronavirus] response to the war in Ukraine – and included a higher volume of content critical of the U.S.” than in previous years.
“The actor has primarily targeted Chinese speakers, but some narratives were in English and other languages,” the Google technicians reported. ”Pro-China content included narratives praising China’s pandemic response, criticism of pro-democracy protests, and significantly in 2022, more strident support for unification with Taiwan.”
TAG said Dragonbridge was “persistent and adaptable,” constantly experimenting with more sophisticated tactics, such as human voice narration instead of computer-generated monotonous voices, animated cartoons, and political content injected into beauty and cooking videos.
The network was responsive to current events, dramatically increasing its activity during Beijing’s temper tantrum over former House Speaker Nancy Pelosi’s visit to Taiwan in July, especially after China retaliated by surrounding Taiwan with provocative military drills.
Speaker of the U.S. House Of Representatives Nancy Pelosi (D-CA), center left, speaks Taiwan’s President Tsai Ing-wen, center right, after arriving at the president’s office on August 03, 2022 in Taipei, Taiwan. (Photo by Chien Chih-Hung/Office of The President via Getty Images)
During this period, TAG said Dragonbridge stopped churning out meaningless spam, began using hashtags intelligently to link its posts together, and focused on “topical, high-production-value content.” A good deal of this content consisted of videos glorifying Communist China’s military, the People’s Liberation Army (PLA).
Dragonbridge also became more focused and active during the 2022 U.S. midterm elections, attempting to “spread narratives highlighting US political divisions, potential for political violence, and threats to democracy.” Some of these posts were disguised to look like clips pulled from American news programs.
Cybersecurity firm Mandiant, which also monitored the activities of Dragonbridge, said the group also tried to pass off Chinese government-linked hackers as U.S. government operators, and promoted theories that the U.S. sabotaged the Nord Stream gas pipelines.
Mandiant noted that one of the Dragonbridge posts that tried to paint Chinese hackers as U.S. agents was a carefully-doctored real news item from Radio Free Asia (RFA). Dragonbridge also tried doctoring posts to impersonate Intrusion Truth, a watchdog group that monitors Chinese cyber threats.
Last June, Mandiant noticed a surge of Dragonbridge activity that attempted to disrupt rare-earth mining activity by countries other than China. The group launched propaganda attacks against American, Australian, and Canadian mining companies, using messages that were purportedly written by “concerned citizens” in those countries.
One of the most interesting things about Dragonbridge is what an utter failure it was. TAG seemed almost surprised by what a huge flop the whole endeavor was. Most of the network’s YouTube channels had no subscribers, 80 percent of its videos had fewer than a hundred views, and its blog posts were typically read less than a dozen times each. Even the bulk of that meager engagement came from other Dragonbridge accounts, not outside audience members.
TAG speculated that Dragonbridge never built an “organic audience” because so much of its content is random and unwatchable junk, which raises the question of why a group capable of producing better content would sabotage itself by making prospective audience members believe there was little reason to follow its channels.
Mandiant concluded that Dragonbridge should remain a “priority for monitoring” despite its lack of success, due to its “boldness and interest in influencing real-world activity.”