An attempt to flood social media platforms with spam in order to drown out coverage of the lockdown protests in China was probably backed by the Chinese government, according to analysis by a US cybersecurity firm.
Recorded Future found that networks of coordinated bot accounts were targeting non-Chinese social media platforms to crowd out genuine posts about the demonstrations with spam content and by hijacking hashtags of names of Chinese cities. It said China’s government was most likely to be behind the tactic.
Charity Wright, a senior analyst at Recorded Future, said: “These spambot networks are resilient, well-resourced and agile. The rate at which they are posting content and spinning up new accounts tells us that they have automation tools to flood the information space. Very few influence operations are capable of this level of activity.”
“We believe it is likely that this was a large-scale operation either sponsored by the Chinese government or outsourced by the state to a surrogate like a well-resourced troll farm,” she added.
The analysis follows evidence last week that Twitter was being bombarded with nuisance posts, many of them adverts for escorts, in an attempt to obscure news of the anti-lockdown protests in China. Alex Stamos, director at the Stanford Internet Observatory, said the Chinese activity indicated the “first major failure” to stop government interference on the platform under Elon Musk’s ownership.
Recorded Future found that networks of thousands of accounts and posts were targeting Mandarin-speaking audiences by jumping on hashtags used to flag coverage of the protests. The bot accounts then distribute high volumes of posts under those Chinese-language hashtags – for instance the locations of protests like Beijing, Shanghai, Guangzhou, Shenzhen and Wuhan – using content such as adverts for escorts, dating services, pornography and short video-clips advertising various services.
In some cases, the posts consist of random strings of English words with tracking codes attached, potentially to gauge how much posts are being used.
Recorded Future said the automated accounts bore the hallmark of coordinated disinformation campaigns. Telltale signs include the use of newly created accounts with zero or low follower numbers; accounts created in blocks of hundreds or thousands; using similar account name structures such as female name + numbers; identical text content; and sharing photos or videos of young Asian women.
“At first glance, it appears that this campaign is intended to drown out the discussion of the anti-Covid lockdown protests in China” said Wright.
She said there was evidence that bot networks had hijacked city name hashtags in previous campaigns, including in September and late October.
Recorded Future’s analysis of the cross-platform disruption campaign found a limited spread of vexatious bot content on Facebook and Instagram, while there was nothing notable on Chinese-owned TikTok, which has been carrying footage of the protests.
Wright said authorities in China and domestic social media platforms were able to crack down quickly on content they deem to be objectionable. However, that is not possible for foreign-owned platforms, which makes bot accounts a potential option for quelling coverage of the demonstrations.
“One option is to control the narrative by flooding the platform with the narrative they prefer,” said Wright. “In this case, the spambots did not tell any particular story or push a state-sponsored narrative. Instead, they simply overwhelmed social media feeds with spam content.”
