China implicated in global digital spin campaign

A Chinese public relations company has been linked by digital intelligence firm Mandiant to what it says could be a covert disinformation campaign being conducted on dozens of its news websites.

Although distinct from the Dragonbridge information operations (IO) campaign previously observed by Mandiant, HaiEnergy appears to be following similar techniques, tactics, and procedures (TTPs), passing off what the cyber-research firm calls “inauthentic websites” as legitimate news outlets in more than 10 languages including English, Chinese, French, and Arabic.

As with Dragonbridge, HaiEnergy appears to be leveraging controversial Western figures in its attempts to promote favorable views of China and even fabricating evidence to support its claims.

Though Mandiant has linked Shanghai Haixun Technology to HaiEnergy, it could not determine whether the global PR firm is actually behind the campaign, which is targeting audiences across North America, the Middle East, Europe, and Asia.

“While we do not currently have sufficient evidence to determine the extent to which Haixun is involved in, or even aware of, HaiEnergy, our analysis indicates that the campaign has at least leveraged services and infrastructure belonging to Haixun to host and distribute content,” said Mandiant.

Outspoken advocates targeted

One of HaiEnergy’s chief targets highlighted by Mandiant is Adrian Zenz, a German anthropologist and Christian fundamentalist who has accused China of conducting cultural genocide against the Uyghur Muslim people of Xinjiang province.

HaiEnergy appears to be willing to go to some lengths to turn Western public opinion against the academic, using what Mandiant believes is a false Twitter persona named “Jonas Drosten” to post screenshots of seemingly fake letters suggesting Zenz is on the payroll of the US government.

Closer scrutiny by Cybernews of one of the letters reveals grammatical errors and bizarre syntax that suggest it may have been forged.

“The tweet and one of the letters argued that Zenz received financial support from US Senator Marco Rubio and former White House Chief Strategist Steve Bannon,” said Mandiant. “The other two letters implied that the financial support came from grants awarded to Zenz from the Victims of Communism Memorial Foundation in 2020 and 2021.”

The claims in themselves do not appear so far-fetched, but closer scrutiny by Cybernews of one of the letters reveals grammatical errors and bizarre syntax that suggest it may indeed have been forged.

The letter, allegedly from Rubio to Zenz, begins: “it has been a great pleasure meeting you last week in Washington,” omitting the capital that should mark the beginning of a sentence. Towards the end of the letter, Rubio allegedly writes: “I’m a great sponsor to you, along with my good friend Bannon,” referring to the controversial former White House adviser by his surname despite the close relationship between the two implied by the clause. The letter signs off: “Please do not esithate [sic] to contact me for any support.”

The Jonas Drosten persona is cited by Swiss Zeitung – identified by Mandiant as one of 72 sites hosted by Haixun – as a “new Twitter user” who has “revealed” that Zenz received two payments, of “$275,000” in 2019 and “again 300,000 [sic]” in 2020. Swiss Zeitung refers to Drosten as a “former colleague” of “data abuser” Zenz but does not appear to substantiate this claim.

Screenshots of what is thought to be fake news backed by China
Copies of three letters Mandiant believes are forged (top) and a story on Haixun-owned news site Swiss Zeitung that claims academic and China critic Adrian Zenz was paid by the US government.

While Mandiant said the HaiEnergy campaign had enjoyed little success and essentially constituted an “echo chamber” of opinion, it appears from its findings that agencies loyal to Chinese interests are becoming increasingly adept at using divisive Western figures to provoke dissent and at least try to steer global public opinion in its favor.

Zenz’s research is credited with exposing China’s program of mandatory detentions of Muslims on its soil, which has allegedly brought with it forced abortions and sterilizations to lower the ethnic minority population’s numbers. However, his motives for doing so may be questionable in the eyes of some – the lapsed Catholic turned born-again Christian told the Wall Street Journal in 2019 that he felt “led by God” to expose the atrocities.

And Bannon has been no stranger to controversy himself, having chaired the far-right news syndicate Breitbart and recently praised Russian leader Vladimir Putin for his conservative stance on LGBT rights.

Clever but ineffective

China’s willingness to use the West’s fractious political landscape as a means to present its own regime in a better light, therefore, demonstrates some conceptual adroitness – but as far as execution goes, Mandiant says it has yet to achieve any notable impact.

“We note that despite the capabilities and global reach advertised by Haixun, there is at least some evidence to suggest HaiEnergy failed to generate substantial engagement,” it said. “Despite large numbers of followers, the political posts promoted by inauthentic accounts we attribute to this campaign failed to gain much traction. This lack of amplification from external sources, not unlike what we typically observed with Dragonbridge, limited the campaigns’ ability to break out, essentially forming an echo chamber.”

Mandiant argues that the IO infrastructure itself is of more interest than its efficacy thus far because it suggests that the outsourcing of this service to third parties, in what it calls “IO for hire,” could become a trend.

"Despite large numbers of followers, the political posts promoted by inauthentic accounts we attribute to this campaign failed to gain much traction."

Mandiant, digital intelligence analyst

Citing testimony by Facebook at its Congress hearing last year as evidence to support this claim, Mandiant said: “Meta testified about an increase in the use of such firms, which have been used to lower the barrier to entry for some threat actors and to obfuscate the identities of more sophisticated ones.”

Haixun is a PR firm that offers services in around 40 languages to more than 100 countries – about half the global total of state territories. Foremost among these are what it dubs “positive energy packages” designed to align with Xi Jinping’s era-defining emphasis on “messages positively portraying the Chinese Communist Party, the Chinese Government, and its policies.”

Mandiant said: “Among their most notable offerings are the Europe and US Positive Energy package, which includes content creation ostensibly geared towards English-speaking audiences, and the Positive Energy Project Edition, which focuses on the production of tailor-made videos, promotion of custom content through ‘high-quality media resources,’ and campaign impact monitoring.”

Whatever the ramifications of such campaigns and the extent of Haixun’s relationship with HaiEnergy, one thing seems clear enough: by hook or by crook, China is making some effort to catch up to the West in terms of its digital media savvy.

More from Cybernews:

Nightmare cyberattack comparable to natural disaster, says expert

China mimicked protestors to tighten grip on coveted metals, says report

North Korean hackers named behind the $620 million Ronin hack

Nomad knew of flaw resulting in $190m heist

Snapchat fails to patch year-old bug, leaving millions exposed to data theft

Subscribe to our newsletter

Leave a Reply

Your email address will not be published. Required fields are markedmarked