Chinese Cyber Group Running Influence Campaign Targeting US Midterm Elections: Report

An unnamed Chinese hacker using his computer at their office in Dongguan in China's southern Guangdong province on Aug. 4, 2020. (Nicolas Asfouri/AFP via Getty Images)

In a report dated Oct. 26, the cybersecurity firm Mandiant identified new narratives pushed by Dragonbridge, an online disinformation campaign. The report says that Dragonbridge—in an effort to influence the U.S. midterm elections—has been aggressively seeking to create conflicts between the United States and its allies and within the U.S. political system.

In an earlier report, Mandiant states that Dragonbridge consists of a vast network of fake social media accounts promoting specific narratives in line with the political interests of the Chinese Communist Party (CCP).

Mandiant has been monitoring and reporting on it since June 2019.

Believed to have been formed in the midst of the Hong Kong anti-extradition protests, Dragonbridge’s early narratives included discrediting Hong Kong pro-democracy protesters.

In September 2021, Dragonbridge expanded its presence on social media platforms, websites, and forums in at least 7 languages, with the insidious goal to mobilize protesters in cities around the United States. The attempt, however, did not motivate any real-world activity, according to Mandiant.

In June 2022, the disinformation campaign targeted rare earth mining companies trying to ensure Chinese rare earth mining companies’ market dominance.

Plagiarizing, Altering, and Impersonating

In its latest campaign, the social media accounts promoted fake articles from major news outlets saying APT41, a Chinese government-backed hacker group, was backed by the U.S. government.

The articles from major news outlets are plagiarized and altered. The blog gave an example of a Chinese-language article published by Hong Kong’s Sing Dao Daily.

The original article says that “Chinese government backed hacker group APT41 has compromised the computer network of at least 6 U.S. state government, and that the Department of Justice has charged five APT41 hackers.”

The altered passage reads, “U.S. government backed hacker group APT41 has compromised the computer network of at least 6 countries, and that the countries have charged five APT41 hackers.”

Cybersecurity firm Intrusion Truth has long been tracking the activities of APT41. Lately, Mandiant identified Twitter accounts impersonating Intrusion Truth’s Twitter account with almost identical hashtags.

Criticizing US Political System and Democratic Process

In September 2022, Dragonbridge accounts posted a video in English on multiple social media platforms. The video attempts to discourage Americans from voting in the upcoming U.S. midterm elections by questioning the effectiveness of the U.S. government.

The video asserted that the cure for the United States is to “root out this ineffective and incapacitated system.” It also criticizes the legislative process for not having any tangible impact on Americans.

The Dragonbridge accounts also state that political infighting, partisanship, polarization, and division are the foundation of America’s democratic system.

Retired U.S. Brig. Gen. Robert Spalding said the CCP knows it can’t deal with the very powerful military of the United States, so it avoids direct military confrontation but chooses to wage an “unrestricted warfare” against all aspects of life in the United States. One of the forms of unrestricted warfare is cyber warfare.

The Mandiant blog concludes, “such persistence, combined with clear intent and scale, renders the campaign a priority for monitoring.”