‘Mold of the internet’ has appeared on 50 platforms, researchers say
When a Twitter account for Utah business coach Spencer Taggart began posting about hot-button political issues in 2020, it garnered widespread attention. Tweets about an endemic cultural divide in the US and support for Black Lives Matter were shared by two Chinese embassy officials.
But Taggart didn’t write the tweets and hasn’t been on the social media platform, now called X, in five years. Rather, his identity had been hijacked by a massive pro-China propaganda network, according to the social media analysis firm Graphika.
“It’s a similar feeling to being robbed,” Taggart said, speaking from Hawaii after Bloomberg News alerted him to the fake account. “If they thought that I promoted communism and hatred toward our country, and they really thought I was saying that, how horrible.”
Taggart’s unusual saga is part of what Alphabet Inc.’s Google and Meta Platforms Inc. say is the largest China-based disinformation campaign ever. Designed to promote Chinese policies, criticize dissidents and mock westerners, it has infiltrated all corners of social media: Facebook, YouTube, TikTok, TripAdvisor, Pinterest, even fringe platforms like Gab, according to researchers.
Few people click on the posts from the campaign’s fake accounts, finding them more of an annoyance in their social media feeds, researchers said. But law enforcement officials warn that the group behind them have been effective at targeting Chinese dissidents in the US.
Earlier this year, Meta announced it had made its “biggest single takedown” of accounts, all belonging to what it calls “Spamouflage Dragon.” Meta, which has tied the group to the Chinese government, says its researchers found its posts on 50 different social media platforms. Google said it removed 160,000 accounts relating to the group, which it calls “Dragonbridge.”
Still, fake accounts keep popping back up.
“Sometimes we joke that Spamouflage is the ‘mold of the internet,’” says Libby Lange, an analyst at Graphika. “In that it turns up in the nooks and crannies of online spaces and often comes back after you scrub it away.”
The whack-a-mole efforts to get rid of it show how difficult it is to stop foreign propaganda operations from reaching social media users in the West. And while the group may seem occasionally inept, a senior law enforcement official cautioned that it could become a bigger problem given the resources of the Chinese government.
“We should still be concerned because if they ever do become really good at misinformation, it would be really terrible for the West,” said Roman Rozhavsky, section chief for the counterintelligence division at the FBI.
A spokesman for the Chinese Embassy in Washington, Liu Pengyu, said China “always opposes the creation and spread of disinformation.”
“What I have seen is that there is a lot of disinformation about China on social media in the US,” he said. “Some US officials, lawmakers, media and organizations have produced and spread a large amount of disinformation against China without any evidence, ignoring basic facts.”
Spamouflage is just one of the disinformation campaigns coming out of China, researchers say. Last month, Meta removed thousands of Facebook accounts impersonating Americans and posting about abortion and health care.
China’s online targeting of dissidents have increased along with stalking and physical threats, according to the FBI’s Rozhavsky. Among those is exiled Chinese businessman Guo Wengui, who one Spamouflage YouTube video described as a “Big Hemorrhoid,” according to Graphika. His lawyers didn’t respond to requests for comment.
Earlier this year, US authorities described the inner workings of a Chinese troll farm while charging 34 officers of China’s national police with harassing US residents. Prosecutors alleged that a unit of China’s Ministry of Public Safety operated the troll farm to attack dissidents and spread propaganda to sow divisions in the US.
Read More: Sign up for the Cyber Bulletin newsletter for exclusive coverage inside the shadow world of hackers and cyber-espionage ‒ and how businesses are playing defense.
US authorities didn’t identify the group as Spamouflage by name and wouldn’t comment as the case is ongoing. But in a call with journalists earlier this year, Meta said the troll farm was Spamouflage.
Spamouflage’s efforts aren’t confined to the US either. The Canadian government revealed this fall that Spamouflage was suspected of targeting Canadian Prime Minister Justin Trudeau and other members of the cabinet in a disinformation campaign that included claims a critic of the Chinese Communist Party in Canada had accused members of Parliament of criminal and ethical violations.
Ben Nimmo, global threat intelligence lead at Meta, said he first came across the group in 2019. He was poring through millions of tweets sharing subtitled videos in Chinese that criticized Guo, the exiled businessman, and Hong Kong democracy protests.
Even then, some of the group’s tactics struck him as odd. The names on some accounts – such as Bathsheba Lyons and Gonzales Swindlehurst – didn’t sound like typical pro-China supporters. The fake accounts interacted with each other to make it appear a genuine conversation was occurring and switched between mundane subjects and controversial political topics, he said.
The behavior spawned the name Spamouflage Dragon because the accounts used spam to camouflage political messaging, Nimmo said.
Read More: US Files Charges Over Chinese Harassment of Dissidents Overseas
Researchers at Meta and Google have linked the accounts to China by monitoring their online interactions and content and by noting that many of the posts are made during working hours there. People behind the accounts also sometimes forgot to delete information about their location and unit in YouTube videos, according to researchers.
Some of Spamouflage’s posts are more comical than convincing.
Shane Huntley, head of Google’s Threat Analysis Group, recalled one YouTube video that claimed the inferiority of Western food signified the moral bankruptcy of the West. The video added, “Whereas perfect Chinese food with its cohesion of flavors shows the superiority of Chinese culture,” Huntley said. Spamouflage tried to attract attention on social network Gab by condemning the Capitol Riots. But the posts didn’t gain much traction as Gab is home to far right influencers, said C. Shawn Eib, head of investigations at Alethea, which detects misinformation and social media manipulation.
In recent years, the group has evolved. For instance, it adopted artificial intelligence-generated avatars last year to make their profiles seem more realistic and used deepfake news anchors to share bogus articles, according to Graphika.
More recently, Spamouflage has been spotted on niche social platforms, including fan fiction websites and TripAdvisor. The travel site has blocked 3,500 attempts by Spamouflage to post content, leading its trust and safety team to carefully monitor the group, according to a TripAdvisor spokesman.
“It’s the largest known covert influence operation in the world,” Nimmo said. “It’s big, but it’s clumsy and it keeps on tripping up.”
As for Taggert, he said the account that impersonated him has been removed, but he has little other recourse. “Even if I wanted to take action, I’m not going to go after the largest underground military Chinese disinformation campaign,” he said.