According to analysis by a US cybersecurity firm, an attempt to flood social platforms with spam in order to drown out coverage of the lock-down protests in China was probably backed by the Chinese government.
Recorded Future found that networks of coordinated bot accounts targeted non-Chinese social media platforms to crowd out genuine messages about the demonstrations with spam content and hijacking names of Chinese cities. It said China's government was most likely to be behind the tactic.
Charity Wright, a senior analyst at Recorded Future, said these spambot networks are resilient, well-resourced and agile. The rate at which they are posting content and spinning up new accounts tells us that they have automation tools to flood the information space. Very few influence operations are capable of this level of activity. She said that it is likely that this was a large-scale operation either sponsored by the Chinese government or outsourced by the state to a surrogate like a well-resourced troll farm.
The analysis follows a series of nuisance posts on Twitter, many of which were ads for escorts, in an attempt to obscure news of the anti-lockdown protests in China. Alex Stamos, director at the Stanford Internet Observatory, said that the Chinese activity indicated the first major failure to stop government interference on the platform under Elon Musk's ownership.
Recorded Future found that thousands of accounts and posts were targeting Mandarin-speaking audiences by jumping on hashtags used to flag coverage of the protests. The bot accounts then distribute high volumes of posts under those Chinese-language hashtags for instance the locations of protests like Wuhan, Shanghai, Guangzhou, Shenzhen and Beijing, using ads for escorts, dating services, pornography and short videoclips advertising various services.
In some cases, the posts consist of random strings of English words with tracking codes attached, which can be used to gauge how much posts are being used.
Recorded Future said automated accounts bore the hallmark of coordinated disinformation campaigns. Telltale signs include the use of newly created accounts that have zero or low follower numbers, accounts created in blocks of hundreds or thousands, using similar account name structures such as female name numbers, identical text content, and sharing photos or videos of young Asian women.
At first glance, it appears that this campaign is intended to drown out the discussion of the anti-Covid lockdown protests in China, according to Wright.
She said there was evidence that bot networks had hijacked city name hashtags in previous campaigns, including in September and late October.
Recorded Future's analysis of the cross-platform disruption campaign found a limited spread of vexatious bot content on Facebook and Instagram, while there was nothing notable on Chinese-owned TikTok, which has been carrying footage of the protests.
Wright said that the authorities in China and domestic social media platforms were able to crack down quickly on content they deem to be objectionable. That is not possible for foreign-owned platforms, which makes bot accounts a potential option for quelling coverage of the demonstrations.
One option is to control the narrative by flooding the platform with the narrative they prefer, said Wright. In this case, the spambots did not tell a story or push a state-sponsored narrative. They simply overwhelmed their social media feeds with spam content.