Accounts Exhibited Similarities to Pro-China “Spamouflage Dragon” Influence Campaign, Posed as Americans on Both Sides of the Aisle
By C. Shawn Eib
Executive Summary
Alethea identified at least 165 Twitter accounts, presenting as Americans on both sides of the U.S. political aisle, that posted politically polarizing content related to the 2022 U.S. midterm elections. The accounts exhibited characteristics resembling Spamouflage Dragon, the well-known pro-China influence campaign that is also referred to as DRAGONBRIDGE.
Approximately 33% of the accounts Tweeted content directly referring to the midterms, with 61% of those posted between August and September 2022. 60% of the 165 accounts individually posted politically polarizing content disparaging both sides of the political aisle. At least 11 accounts alluded to QAnon conspiracy theories.
Alethea proactively notified Twitter of its findings, who took action on the accounts under its platform manipulation and spam policies.
The accounts’ attempts to exploit U.S. political polarization by posing as Americans on Twitter, which Alethea independently identified, also mirrors details reported on similar Facebook activity that Meta recently took enforcement action against and attributed to China.
We do not attribute the Twitter activity to China at this time, but instead note that it bears certain resemblances to previous influence activity that has been attributed to China. If linked to China, it would represent a new evolution in China's social media influence activity.
While the number of accounts identified is relatively small and they received very little engagement, we believe it is important to proactively highlight this potential evolution given their focus on the midterm elections and the highly charged political environment in the United States.
Background
Spamouflage Dragon [1], also referred to as DRAGONBRIDGE [2], is an ongoing, persistent pro-China influence campaign that was first publicly exposed in 2019, after Twitter took enforcement action against accounts spreading disinformation around the 2019 Hong Kong anti-extradition bill protests.[3] The campaign has been active across dozens of social media platforms, including Facebook, Instagram, and Twitter, and is typically known for its production of large amounts of YouTube video content.
Various disinformation researchers have assessed that the Spamouflage Dragon campaign is largely decentralized, with different clusters of activity exhibiting different characteristics, including posting in various languages, at varying volumes, and on diverse topics.[4][5] Given this decentralization and range of different behaviors and tactics, it is unclear where the boundaries between Spamouflage and other, unaffiliated pro-China influence activity sets lay, and the Spamouflage label has become something of an under-defined, catch-all term for pro-China information operations activity on the major social media platforms. As such, we do not attribute the activity discussed here directly to Spamouflage Dragon, but instead highlight the overlapping behaviors and characteristics it shares with previous Spamouflage-attributed activity.
Content and Narratives
Since 2019, the Spamouflage Dragon campaign has undergone various evolutions, including progressively dipping its toes deeper into U.S. domestic politics. Early 2021 reporting identified videos disseminated by a Spamouflage Dragon account cluster praising the events at the U.S. Capitol on January 6, 2021, as a “beautiful sight,” and another claiming political tensions in the country “made the world see” American hypocrisy following Joe Biden’s inauguration.[6] Additional reporting later identified attempts to organize protests among Asian Americans against racial violence in April 2021.[7] The bulk of Spamouflage Dragon activity since 2019, however, has centered on pushing narratives to global audiences that China is rising while the West is falling, and focused little on fomenting divisions within U.S. society.
On September 27, 2022, Meta announced the takedown of a number of accounts from China that were presenting themselves as Americans and posting polarizing political content, and noted that it was the first time they have taken action against a Chinese network focused on domestic U.S. politics.[8] While Meta did not identify the activity as Spamouflage Dragon, they did note that they observed it on additional platforms beyond Facebook, including Instagram and Twitter.
In line with these findings, Alethea independently and in parallel observed at least 165 inauthentic Twitter accounts playing both sides of the U.S. political aisle, while attempting to portray themselves as American, that exhibited characteristics closely resembling those of accounts previously attributed to Spamouflage Dragon. 46 of these accounts disseminated content supporting President Biden and the Democratic Party, while 18 accounts presented consistently as conservative. We also observed at least 99 “unaligned” accounts individually tweeting a mix of misleading or incendiary content disparaging both sides of the political aisle. One of the conservative-presenting accounts, and 10 of the unaligned accounts, also alluded to QAnon-adjacent conspiracy theories relating to grooming, child sacrifice, and the New World Order.
The accounts also increasingly referenced the upcoming U.S. midterm elections; out of 54 Tweets across the accounts we reviewed directly discussing the midterms, 33 were posted between August 1, 2022 and September 28, 2022. This included content copied directly from other Twitter users, including tweets from the official accounts of US political candidates. For example, one account posted a Tweet on September 3, 2022 which copied the text of a Tweet from U.S. congressional candidate for New York Pat Ryan, posted on September 2, 2022.
Post from @MarisaGigliot12 copying the text from the verified account @PatRyanUC, a New York-based congressional candidate [9]
Original Tweet from @PatRyanUC posted the day before the tweet from @MarisaGigliot12 [10]
The accounts also regularly posted content criticizing NSA surveillance (a common focus of previous Spamouflage-attributed accounts), content promoting Edward Snowden, and content promoting China’s Belt and Road Initiative over the proposed U.S.-led Build Back Better World Initiative. They typically interspersed their political posts with non-political content such as gardening tips, flower pictures, and music, particularly Korean pop music (KPop). One tactic we observed involved copying text from local news or traffic accounts. In one instance, an account Tweeted about a drunk driving accident, mentioning the location only by street names. The text was copied from an account that posts traffic information in Kokomo, IN.[11] Blending incendiary political content with commercial “spam” and innocuous content about music, gardening, and other non-political topics, is a key behavior of accounts that have previously been linked to Spamouflage Dragon.[12]
We do not attribute this activity to China at this time, but instead note that it bears certain resemblances to previous influence activity that has been attributed to China. Alethea proactively notified Twitter of its findings, who took action on the accounts under its platform manipulation and spam policies.
Liberal Content
Approximately 28% of the accounts we identified presented themselves as liberal Americans and spread content focusing on issues likely to be important in the upcoming midterm elections. For example, these accounts referenced the overturning of Roe v. Wade, presented former President Trump and the GOP as criminals or traitors, and alleged voter suppression of certain populations within the United States.
Post from @MarthaM43043674 describing voter mobilization due to the overturning of Roe v. Wade [13]
Post from @Natalie99381219 encouraging support for candidates who support protecting voting rights [14]
Conservative Content
Among the 18 accounts that consistently posted conservative political content, issues of focus included immigration, student loan forgiveness, and the war in Ukraine. These accounts also encouraged discussion of stolen U.S. election narratives and spread misleading content relating to election security. Specifically, the accounts posted content raising doubts about the legitimacy of the 2020 U.S. presidential election, spread narratives that Democrats will fraudulently claim victory in the upcoming U.S. midterm elections, and alleged, without providing supposed evidence, that ballot drop boxes and/or mail-in ballots increase the likelihood of voter fraud.
Post from @Kimberl94829386 expressing negative views about Joe Biden and his support of Ukraine, as well as demonstrating efforts to present as an American (“secure ‘our’ border”) [15]
Post and RT from @MelodieNoone6 referencing stolen election allegations [16]
Post from @AmandaM37819335 repeating false claims regarding the 2020 Elections [17]
Post from @Vanessa49500773 claiming that if the “RINOS AND DEMOCRAPS” aren’t voted out in the midterm elections, there will be no 2024 elections [18]
The Unaligned Accounts
The majority (60%) of the accounts we identified shared an eclectic mix of incendiary content disparaging both sides of the political aisle. Despite each account posting a relatively small amount of content, with most only having approximately 60 Tweets, they switched between content that was virulently anti-Republican and anti-Democrat, sometimes as quickly as the following Tweet. This extreme alternating behavior may have degraded the accounts’ ability to maintain their personas in ways that authentic users would find believable.
Account @Kimberl42021572, which posted a Tweet accusing the DOJ of attempting to jail Trump to help Biden win re-election, copied the text of a Tweet calling Republicans who voted against certifying the 2020 election results “indefensible” two weeks later [19]
QAnon-Adjacent Content
One of the conservative-presenting accounts’ and 10 of the unaligned accounts’ posts also alluded to conspiratorial narratives often seen within QAnon and its adjacent communities, including narratives related to grooming, child sacrifice, and the New World Order. In one instance, an account directly copied the text of a tweet posted by an unrelated QAnon-adhering account that appeared to be an attempt to write in the style of a “Q-Drop,” mimicking the language “Q” has used in posts to 4chan/8kun.
Post from @LeslieS89351905 alluding to QAnon-adjacent narrative relating to child sacrifice [20]
Post from @ClaireB20982670 seemingly emulating the style of a “Q-Drop”, using the formatting and language “Q” has used when posting to 4chan/8kun. This text was originally posted 8 minutes prior by a separate account unaffiliated with the accounts discussed in this report [21]
Indicators of Inauthenticity and Resemblance to Spamouflage Dragon
The accounts we identified presented a number of indicators of inauthenticity and shared behavioral characteristics with previously attributed Spamouflage Dragon accounts, including similar posting patterns and the use of batch-created accounts that used stock imagery for profile pictures.
Batch creation: 157 (96%) of the accounts we identified were created on December 6, 2021, between 13:00-17:00 UTC, with an additional account created on December 29, 2021, two accounts on January 10, 2021, and five on January 20, 2021.
Lack of followers: Most of the accounts had between zero and six followers, and followed between 10 and 20 accounts.
Mix of innocuous and politically charged content: The accounts mixed their political content with posts about music, gardening, flowers, and other non-political content, a defining characteristic of Spamouflage Dragon.
Promotion of China’s interests: The accounts posted content promoting Chinese interests in areas of competition between the U.S. and China, similar to content pushed by previously attributed Spamouflage Dragon accounts. One particular area of focus was contrasting the U.S.-led Build Back Better World Initiative (B3W) with China’s Belt and Road Initiative. Other content was heavily critical of the NSA.
Account referencing the US-led Build Back Better World initiative [22]
Repeated content errors: Different accounts Tweeted different types of content with the same spelling errors. For example, across all posts made by all 165 accounts, whenever the word “republic” had been intended to be used, it had been misspelled as “repbulic” at least once in the Tweet.
Mass retweeting: Some accounts engaged in mass retweeting behaviors. For example, a May 7, 2022, Tweet from @SMU_Ming about U.S. surveillance of undersea cables received no retweets until May 10, 2022, at 6:56 UTC, when 18 of the reviewed accounts retweeted it in a row along with 118 other, unreviewed accounts, ending at 8:05 UTC.
Two tweets and retweet with misspelling of “repbulic” [23][24]
Additionally, some of the accounts we identified also shared characteristics similar to the activity described by Meta in their September 27, 2022 takedown report [25]:
Purported locations of Florida and Texas: 33% of the Twitter accounts we identified, mostly within the liberal-presenting and unaffiliated subsets, presented as residing in either Florida or Texas. Meta’s takedown report mentions that a cluster of left-leaning accounts they identified on Facebook focusing on abortion and gun rights claimed to reside in those two states, as well as California.
Gender discrepancies: 28% of the accounts we identified used female-presenting usernames but male-presenting profile pictures. Meta noted in its takedown report that in one of their identified Facebook account clusters, the accounts used male profile pictures and English female names.
Similar timeframes: Meta’s takedown report notes that the activity they actioned against began in November 2021. This was shortly before the accounts we identified on Twitter were created (December 6, 2021), and which became active a couple of weeks later.
Impact and Implications
Overall, the accounts we identified gained very little attention, if any, from authentic Twitter users, similar to previous Spamouflage Dragon-attributed accounts, and there is no evidence to suggest that this or any related activity has had any impact on the U.S. electorate. However, if the accounts were indeed part of the Spamouflage Dragon campaign, it would represent a new evolution in China’s information operations activity on social media. As the accounts were portraying themselves as Americans on both sides of the U.S. political aisle and directly referencing the upcoming midterm elections in what is a highly charged political environment, we believe it is important to highlight this evolution.
It remains unclear what the intended purpose of such a shift may be, though the nature of the activity we identified might suggest it was simply a poor attempt to contribute to political division and polarization in the United States. It is unlikely that their attempts to adopt American personas noticeably bolstered their ability to reach authentic users, and we note that over 75% of the 165 accounts we reviewed in detail had zero engagements from authentic users. However, in the past, certain accounts that have been attributed to the Spamouflage Dragon campaign have been able to reach high-profile social media influencers, who have in turn amplified narratives made by those inauthentic accounts.[26] Therefore, we believe it is important that researchers and analysts continue to investigate and report on the activities of account clusters such as this, particularly as they increase their attention on narratives that are materially impacting democratic discourse in the United States, such as “stop the steal” and QAnon-aligned conspiracy theories and allegations.
Endnotes
[1] https://graphika[.]com/reports/spamouflage
[2] https://www.mandiant[.]com/resources/blog/pro-prc-influence-campaign-expands-dozens-social-media-platforms-websites-and-forums
[3] https://blog.twitter[.]com/en_us/topics/company/2019/information_operations_directed_at_Hong_Kong
[4] https://public-assets.graphika.[]com/reports/graphika_report_spamouflage.pdf
[5] https://miburo.substack[.]com/p/spamouflage-survives
[6] https://public-assets.graphika[.]com/reports/graphika_report_spamouflage_breakout.pdf
[7] https://www.mandiant[.]com/resources/blog/pro-prc-influence-campaign-expands-dozens-social-media-platforms-websites-and-forums
[8] https://about.fb[.]com/wp-content/uploads/2022/09/CIB-Report_-China-Russia_Sept-2022-1-1.pdf
[9] https://twitter[.]com/MarisaGigliot12/status/1566015128763506688
[10] https://twitter[.]com/PatRyanUC/status/1565808031425855491
[11] https://twitter[.]com/KokomoScanner/status/1519152840710701056
[12] https://graphika[.]com/reports/spamouflage
[13] https://twitter[.]com/MarthaM43043674/status/1541553581635305473
[14] https://twitter[.]com/Natalie99381219/status/1527783345882644485
[15] https://twitter[.]com/Kimberl94829386/status/1537265530284957696
[16] https://twitter[.]com/MelodieNoone6/status/1555667629167312897
[17] https://twitter[.]com/AmandaM37819335/status/1519210742653796352
[18] https://twitter[.]com/Vanessa49500773/status/1556790935371091970
[19] https://twitter[.]com/Kimberl42021572/status/1547342891911036930
[20] https://twitter[.]com/LeslieS89351905/status/1550959257469722630
[21] https://twitter[.]com/ClaireB20982670/status/1555368003599990788
[22] https://twitter[.]com/webber_dianna/status/1473491469176492035
[23] https://twitter[.]com/NicoleT82493430/status/1498109217936392194
[24] https://twitter[.]com/Stephan37815517/status/1498117003961372675
[25] https://about.fb[.]com/wp-content/uploads/2022/10/CIB-Report_-China-Russia_Sept-2022-1-1.pdf
[26] https://public-assets.graphika.[]com/reports/graphika_report_spamouflage_breakout.pdf