As part of its ongoing efforts to counter misinformation operations and influence campaigns, Google’s Threat Analysis Group (TAG) disrupted more than 50,000 instances of activity from a prolific pro-China influence operator known as Dragonbridge.
The Dragonbridge group has been operating for several years and TAG has followed its activities since 2019. While the group has not developed a large authentic audience for its content across YouTube, AdSense, Blogger and other Google platforms, Dragonbridge has shown no signs of giving up and continues to evolve its tactics and techniques to spread pro-China propaganda and other messages. In 2022, Dragonbridge focused on a number of different topics in its content, including the war in Ukraine, the COVID-19 situation in China, as well as some anti-American messaging.
In a new report released Thursday, TAG detailed some of Dragonbridge’s recent tactics and campaigns and said the group remains committed to its goals.
“While DRAGONBRIDGE has not attracted an organic audience, they are persistent and adaptable. Since TAG started tracking the network in 2019, DRAGONBRIDGE has consistently experimented with new tactics, new formats and higher quality content. As they evolve over time, DRAGONBRIDGE’s coordinated inauthentic activity may eventually attract the attention of real users. For this reason, TAG and Mandiant track DRAGONBRIDGE closely and Google has taken an aggressive approach to identifying and removing their content,” TAG said in its report.
Among the changes that Dragonbridge made last year was a move to make their content seem more authentic. One way they attempted to do this is by using human narration, rather than AI-generated voices, in their videos. Another change was trying out a sort of talk show format that used real people on camera discussing news events. Dragonbridge also produced some animated political cartoons and videos that mixed information operation content with other content such as beauty advice.
Last year Dragonbridge took advantage of several major worldwide news events to post their own content, including the U.S. midterm elections, the monkeypox outbreak, Russia’s invasion of Ukraine, and the tensions between China and Taiwan. The group uses a massive number of accounts in order to post the huge volume of spammy content that it does, and Google has been able to follow the group’s accounts and disrupt them quickly.
“To post their spam and IO content, DRAGONBRIDGE manages infrastructure consisting of thousands of accounts at any given time. Google has terminated 100,960 accounts associated with DRAGONBRIDGE over the network’s lifetime,” the TAG report says.
“Rather than build their account infrastructure themselves, DRAGONBRIDGE obtains Google Accounts from bulk account sellers who create and sell accounts for profit. We have seen DRAGONBRIDGE reuse accounts that were previously used for financially motivated activity, then went dormant before they resumed activity and posted DRAGONBRIDGE videos and blogs. We believe accounts like this are changing hands from other bad actors to DRAGONBRIDGE.”
Influence operations like the ones that Dragonbridge runs are increasingly common, especially on YouTube and other social media platforms, and groups from China, Russia, Iran, North Korea, and many other countries use influence operations regularly.