The level of sophistication in generating pro-China/anti-USA content is just going to get better: question every ‘legitimate’ thing you read!

In the current era of digital disinformation, fake news, censored news and real-news-declared-as-fake news, Information Operations (IO) are of increasing value to state-sponsored social engineering campaigns.

One recent source of IO is leveraging a network of at least 72 suspected ‘inauthentic news’ sites and a number of suspected ‘inauthentic social media assets’ to disseminate content strategically aligned with the political interests of the People’s Republic of China (PRC).

The sites present themselves primarily as independent news outlets from different regions across the world, even publishing their dubious content in 11 languages. According to disclosure from Mandiant, these sites are linked to Shanghai Haixun Technology Co., Ltd (上海海讯社科技有限公司), a China public relations firm.

The IO campaign criticizes the USA and its allies, attempts to reshape the international image of Xinjiang due to mounting international scrutiny, and expresses support for the controversial reform of Hong Kong’s electoral system. In addition to these broader themes, the campaign leverages fabricated content designed to discredit opponents and critics of China’s government.

As the controlling entity, Haixun, also operates as a PR firm, it is suggestive of recent trends surrounding the outsourcing of IO to third parties, which can make IO more accessible and help obfuscate the identities of state actors. Haixun offers content creation and marketing services in at least 40 different languages in over 100 countries. Their most notable offerings are content creation projects (tailor-made videos) ostensibly geared towards English-speaking audiences. Linked to the firm’s content are 72 websites (59 domains and 14 subdomains) hosted by Haixun, that are used to target audiences in North America, Europe, the Middle East, and Asia.  

The campaign has also leveraged a small number of social media accounts across multiple platforms to disseminate content. Observed assets included personas presented as being affiliated with Haixun’s inauthentic news sites; author personas allegedly responsible for the content itself; and accounts that promote campaign content, but do not self-affiliate with the sites.

In some cases, accounts that were identified and assessed to be part of the IO campaign featured biographic data that displayed the text “I do paid promos,” raising the possibility that the pro-PRC content may have been commissioned.  

Recent Haixun IO content

There is at least some evidence to suggest the campaigns have failed to generate substantial engagement. Despite a significantly large numbers of followers, the political posts promoted by inauthentic accounts seem to have failed to gain much traction outside of the campaign itself.

This lack of amplification from external sources, not unlike what Mandiant researchers typically observed, has limited the campaigns’ ability to break out, essentially forming an echo chamber. Some examples of the content involved the following themes:

• On Aug. 1, several sites published two articles critical of US House Speaker Nancy Pelosi in response to reports that she may visit Taiwan in early August. The articles assert that Pelosi should “stay away from Taiwan” and highlight perceived tarnished relations between the US and Taiwan.
• On June 30, six days after the US Supreme Court decision to overturn Roe v. Wade, an English-language article was published purportedly by an author claiming to be an American woman living outside the US, which claimed that protesters against the decision had been met with violence by US law enforcement and US civilians that supported the decision to overturn Roe v. Wade.
• A Ukrainian-language article claimed that experiments run in alleged US bio-labs in Ukraine have resulted in numerous Ukrainian deaths. 
• An article published on several sites, including one purporting to be a Taiwanese news outlet, claimed that former US government official Mike Pompeo’s March 2022 visit to Taiwan was motivated by money and his alleged desire to run for US President in 2024. Additionally, it portrayed the US as an unreliable ally, arguing that Taiwan should not expect the US to send troops to defend it from a potential invasion by China.

Based on various factors, the IO content generation is likely to have been outsourced to third parties: IO outfits for hire. According to Mandiant, in mid-2021, Meta (Facebook) had testified about an increase in the use of such firms to “lower the barrier to entry for some threat actors” and “to obfuscate the identities of more sophisticated ones.”