Chinese State-Linked Information Operation Revealed Social Media Account Takeover Potential

Executive Summary

Nisos investigators identified a network of pro-Beijing Twitter accounts likely engaged in state-backed information operation targeting audiences in various countries in Latin America, including Paraguay, Costa Rica, Chile, and Brazil. Some of the accounts promote strategic Chinese state media-linked news content in both Spanish and Portuguese.

The network is linked to China News Service and shows signs of coordinated inauthentic behavior, with accounts posting similar or identical content related to China at close time intervals. This indicates they are likely organized through a common operator echoing content mainly from Chinese state-linked media outlets, in an attempt to improve China’s image and enhance its policy and diplomatic efforts.

China News Service is reportedly part of China’s “United Front,” a strategy aimed at spreading Beijing’s influence that simultaneously works as an espionage method for Chinese government agencies. The accounts represent a likely covert effort to promote state media content that bypassed Twitter’s previous state media labeling policy. (See source 1 in appendix)

Apps communicating with the IP address of the network’s affiliated websites showed permissions to not only gather personally identifiable information from subscribers, but also demonstrated the potential to control subscribers’ social media accounts. This could enable China’s government to potentially micromanage narratives and obtain information from dissidents residing abroad, which has been reported as common activity by Chinese government-linked actors through other methods. Nisos did not find the same level of invasive permissions among other news agencies, including other foreign state-affiliated media websites.

Background

Nisos researchers identified a small social media network focused on countries in Latin America sharing content from Chinese state-linked news agencies using sock puppet social media accounts. The small network is affiliated with a group of Chinese language news agencies targeting Chinese-speaking audiences residing in cities and countries outside of China. Social media content shared by the network includes information, images, and footage from China News Service and other Chinese state-backed media outlets. WhoIs data also revealed that many of the affiliated websites were registered by a user with an email address attributed to China News Service.

China News Service serves as one of China’s largest state-owned news agencies and operates several overseas branches. (See source 2 in appendix) China News Service was formerly run by the Overseas Chinese Affairs Office, which was absorbed into the United Front Work Department of the Chinese Communist Party. (See source 3 in appendix) According to France’s Institute for Strategic Research at the Military School, the United Front serves as a Chinese government policy that aims to remove perceived internal and external enemies, control dissidents, advance Beijing’s interests, and assert its influence abroad. (See source 4 in appendix)

Twitter Network Focused on Latin America

Latin America (LATAM) is no stranger to information operations during times of political unrest and elections. (See source 5 in appendix) There have been several instances of local media organizations and “alternative” news outlets echoing content from foreign state media agencies that promote narratives favorable to the foreign state actor and in many cases, not to U.S. government interests in the region. For example, Russia’s influence operations in the media and social media spaces are notable in the region as much of its state media content is found through Cuban, Venezuelan, Nicaraguan, and Mexican media organizations, journalists, as well as “independent” and “alternative” news outlets. (See source 6, 7 and 8 in appendix) Similarly, Russia-originating information operations during Colombia’s elections in 2022 shared many similarities to an influential operation led by Venezuelan marketing specialists linked to former Venezuelan government employees. (See source 9,10 and 11 in appendix) Common features included:

• Promoting Russia, Cuba, Venezuela, and Nicaragua’s likely preferred candidate, current President Gustavo Petro
• Demonizing the former presidential administration
• Forming divisive narratives around domestic issues and amplifying those during political unrest prior to elections to sow severe discord among the Colombian population
• Shared similar content around one of Colombia’s largest drug cartels, the Gulf Clan’s, armed strike in in May 2022, which undermined the more politically conservative-aligned presidential candidate
• Similar hashtag uses
• Similar bot and sock puppet engagements

Unlike Russia’s government and other proxies, which appear prominent in the information space throughout LATAM, China’s government has yet to reach the same level of domestic engagement but that does not mean it is not trying to influence political and cultural perceptions in the region; especially to counter unfavorable perceptions of China on a global scale following the COVID-19 pandemic, which originated from China. (See source 12 in appendix)

Accounts’ Behavior and Twitter’s Previous State-Affiliated Media Policy

Nisos found three Twitter accounts recycling China state-affiliated media content and targeting audiences in Paraguay, Costa Rica, and Chile. These accounts appeared as independent news agencies with a low number of followers. The network’s methodology bypassed Twitter’s previous state-affiliated media labeling policy, which stated:

“State-affiliated media is defined as outlets where the state exercises control over editorial content through financial resources, direct or indirect political pressures, and/or control over production and distribution. Accounts belonging to state-affiliated media entities, their editors-in-chief, and/or their prominent staff may be labeled. We will also add labels to Tweets that share links to state-affiliated media websites.” (See source 13 in appendix)

Nisos did not confirm whether the network operator(s) are linked to China’s government, but the accounts promote state-run media sources (i.e. China News Service and Xinhua News). We assess that this effort was a product of China’s media and political interests in targeted countries.

The accounts identified put effort into applying methodologies to avoid adding links that would take users back to China News Service, the Chinese state-linked media organization from which the majority of their China-related content comes from. Their methodology enabled its content to appear on Twitter without the need to get redirected outside of the platform. For instance, the accounts posted pictures of online documents that included Spanish-translated content from China News Service’s “We Talk” in various instances. Below is an example of one case in which the three accounts simultaneously shared an article translated from Chinese into Spanish using this method.

The majority of the accounts’ China-related content appeared in video and picture forms and focused on Chinese culture, tourist sites, food, entertainment, and events. Such posts often used the hashtag #China and included video clips from Chinese state-affiliated media sources. However, none of the China-related posts provided links or mentions of the contents’ original sources in the text.

The Accounts

Nisos researchers assess that the three accounts engaged in coordinated inauthentic behavior targeted audiences in Paraguay, Chile, and Costa Rica likely because these countries align with Beijing’s foreign policy interests. For instance, in Paraguay, two leading presidential candidates that participated in the country’s recent presidential election had opposing policy plans regarding Taiwan and China. The candidate that succeeded promised to make Taiwan the preferred partner over China whereas the candidate who received the second most votes sought to change the relationship with Taiwan to be closer to China. Costa Rica and Chile also appeared to be of interest to China as its telecommunications firm, Huawei, demonstrated interest in implementing services and 5G in these two countries. (See source 14, 15 and 16 in appendix)

DISCLAIMER:

The reporting contained herein from the Nisos research organization consists of analysis reflecting assessments of probability and levels of confidence and should not necessarily be construed as fact. All content is provided on an as-is basis and does not constitute professional advice, and its accuracy reflects the reliability, timeliness, authority, and relevancy of the sourcing underlying those analytic assessments.

About Nisos®

Nisos is The Managed Intelligence Company®. Our analyst-led intel investigations, assessments, and monitoring services empower your security, intelligence and trust and safety teams. We provide accurate, customized intelligence that guides your security and risk decisions – protecting your organization, assets, and people. Learn more at nisos.com.