Google disrupted over 10,000 instances of DRAGONBRIDGE activity in Q1 2024

Today we are sharing updated insights about DRAGONBRIDGE, the most prolific IO actor Google’s Threat Analysis Group (TAG) tracks. DRAGONBRIDGE, also known as “Spamouflage Dragon,” is a spammy influence network linked to the People’s Republic of China (PRC) that has a presence across multiple platforms. Despite producing a high amount of content, DRAGONBRIDGE still does not get high engagement from users on YouTube or Blogger.

As described in our previous blog, the majority of DRAGONBRIDGE activity remains low quality content without a political message. A small fraction of DRAGONBRIDGE accounts also post about current events with messaging that supports pro-PRC views. These narratives span a wide range of news topics — ranging from elections in Taiwan to the Israel-Hamas war — and include content critical of the US. The content primarily targets Chinese speakers, but some narratives are in English and other languages.

In 2023, Google disrupted over 65,000 instances of DRAGONBRIDGE activity across YouTube and Blogger, reflecting our continued focus on this actor and success in scaling our detection efforts across Google products. In the first quarter of 2024, Google disrupted over 10,000 instances of DRAGONBRIDGE activity across YouTube and Blogger. In the network's lifetime, this brings the number of instances of DRAGONBRIDGE activity we have disrupted to over 175,000.

In 2023 DRAGONBRIDGE struggled to get engagement on YouTube

Despite their continued profuse content production and the scale of their operations, DRAGONBRIDGE achieves practically no organic engagement from real viewers. In 2023, of the over 57,000 YouTube channels disabled, 80% had zero subscribers. Of the over 900,000 videos suspended, over 65% of their videos had fewer than 100 views, and 30% of their videos had zero views. Despite experimenting with content and producing large amounts of content, DRAGONBRIDGE still does not receive high engagement.

In the cases where DRAGONBRIDGE content did receive engagement, it was almost entirely inauthentic, coming from other DRAGONBRIDGE accounts and not from authentic users. Comment activity was also mostly from other DRAGONBRIDGE accounts.

DRAGONBRIDGE narratives follow the headlines

The majority of DRAGONBRIDGE activity is low quality content without a political message, populated across many channels and blogs. However, a small fraction of DRAGONBRIDGE accounts also post about current events with messaging that pushes pro-PRC views. This content is either quickly created in response to breaking news, or produced ahead of time for anticipated events.

DRAGONBRIDGE accounts create content reacting to breaking news, especially wedge social issues, usually within a few weeks of the event. In general, this content is lower quality than the content created for anticipated events, reflecting the speed with which the actor pivots to create content in response to current events.

For anticipated events, DRAGONBRIDGE creates content in advance, allowing them to quickly disseminate large volumes in a short timeframe around the event. We observed this with large volumes of content posted in the lead up to the 2024 Taiwan general election.

DRAGONBRIDGE content spiked ahead of the 2024 general election in Taiwan

DRAGONBRIDGE content has targeted Taiwan for years, including pro-unification narratives and surges of activity in response to news events. TAG observed a surge of activity around the general election held on January 13, 2024. As is typical with DRAGONBRIDGE, the volume of content was large but unsuccessful in gaining traction with authentic viewers.

The videos were typical of DRAGONBRIDGE’s style featuring robotic voiceovers, stock footage and publicly available images. Voiceovers and text overlays in the videos had awkward phrasings suggestive of machine translation. In addition to targeting Taiwan’s outgoing President, Tsai Ing-wen, some content included a direct call to action, with a song with lyrics telling people not to vote for Taiwan’s Democratic Progressive Party.

In the days prior to Taiwan’s general election on January 13, 2024, DRAGONBRIDGE posted thousands of videos and comments on YouTube using synthetic audio and avatars promoting a false “secret history” document critical of the outgoing President Tsai Ing-wen. The IO campaign had limited reach, with practically no engagement from organic users, and YouTube terminated channels tied to the activity. The campaign received coverage in the Taiwanese press, which noted the low views of the content.

The video content featured AI-generated news hosts speaking to the camera in the style of a news broadcast. The production quality of the videos varied widely, with some appearing realistic at first glance. Other content was obviously computer animated and showed no attempt to masquerade as real video.

DRAGONBRIDGE also posted comments to videos belonging to legitimate users, likely an attempt to spread their narrative. The comments shared links to DRAGONBRIDGE videos and the “secret history” document, which was hosted elsewhere online. DRAGONBRIDGE also pushed the same narrative on multiple, non-Google platforms, including X (formerly Twitter), Reddit, Instagram, Facebook, Medium, and smaller online forums and bulletin boards.

Continued experimenting: using generative AI tools

Although the January 2024 campaign targeting outgoing Taiwan President Tsai Ing-Wen was the largest observed DRAGONBRIDGE campaign using generative artificial intelligence (AI) to date, DRAGONBRIDGE has experimented with generative AI tools to create content for several years. Their use of AI-generated videos or images has not resulted in significantly higher engagement from real viewers.

As early as 2022, Graphika reported that DRAGONBRIDGE was using AI-generated footage. While the AI-generated news hosts appeared lifelike, the content consisted of DRAGONBRIDGE’s usual compilation of stock images and news footage from online sources accompanied by robotic English-language voiceovers.

Mandiant also reported in March 2023 that DRAGONBRIDGE leveraged several AI-generated images in order to support narratives negatively portraying US leaders, and in May 2023, DRAGONBRIDGE used an AI-generated "news presenter" in a short news segment-style video. Consistent with TAG findings, Mandiant did not observe significant engagement with this content.

Continued focus on US social wedge issues

DRAGONBRIDGE continues to create content with US-focused narratives that portray US government, society, and democracy in a negative light, cycling through political and social narratives that evolve with the headlines.

For example, in May 2024 DRAGONBRIDGE began uploading videos and commenting on the student protests over the Israel-Hamas war on US university campuses. This content is a mix of low quality videos made of repurposed footage with text overlaid on top, and content packaged to look similar to a TV news story, with opening graphics, dramatic music, and a news anchor.

The DRAGONBRIDGE content appeared in English, was generally pro-Palestine in its narrative themes, and used the student protests to frame the US and Western media as hypocritical. Comments by the actor contrasted the image of the US as supporting freedom of speech with students being detained by police, as well as Western media’s support of student protests in Hong Kong with negative views of student protests in the US. This fits in a larger context of DRAGONBRIDGE portraying the US government and society as hypocritical.

We have seen DRAGONBRIDGE respond to significant events with pre-produced content and consider it highly likely that they will continue to do so, including with the 2024 US general election.

Looking back: DRAGONBRIDGE activity during previous US elections

DRAGONBRIDGE content has regularly included US political issues and political figures, particularly in the leadup to elections and generally presented in the format of short news clips. In previous US elections, DRAGONBRIDGE content has not explicitly advocated for specific candidates or any specific political outcome in the US.

In 2020 DRAGONBRIDGE content was critical of both presidential candidates. Some narratives were highly critical of then US President Trump, including accusing him of deflecting his failures by drawing attention to China with terms like "the China virus," and featuring interview clips of people stating they regret voting for him.

In the leadup to the 2022 US midterm elections, Google terminated channels where DRAGONBRIDGE attempted to spread narratives highlighting US political divisions, potential for political violence, and threats to democracy. One video, also reported by Mandiant, attempted to portray voting in the US as ineffective and a waste of time. The activity extended cross-platform, with DRAGONBRIDGE posting similar messages via tweets and identical video content on X, formerly known as Twitter.

So far in 2024 DRAGONBRIDGE continues to spread narratives highlighting US political divisions, including content in January discussing political leaders.

TAG is actively monitoring DRAGONBRIDGE activity for any shifts in tone or focus related to the US presidential election.

Consistent narratives, varied tactics on other social media sites

In 2023, Mandiant also observed DRAGONBRIDGE accounts operating across multiple, non-Google platforms promoting narratives similar to those observed by TAG. Mandiant observed DRAGONBRIDGE accounts promoting a diverse range of narratives regarding global politics and various news events; however, a majority of those narratives generally remained focused on criticizing the US and its allies and partners and on sowing or exacerbating existing divisions within and between various countries and regions.

Although limited in overall scope, a portion of the campaign's activity promoting content on US politics on other platforms leveraged more nuanced tactics than other activity previously attributed to the campaign. These tactics included using inauthentic personas posing as US residents, employing engagement strategies like "follow trains" to attract unwitting followers, leveraging AI-generated image content, and posting content copied from real social media users. According to Mandiant, this small subset of DRAGONBRIDGE operations garnered higher levels of engagement from seemingly authentic users compared to the limited-to-no authentic engagement typically received by campaign activity. The limited authentic engagement was primarily observed on X, formerly known as Twitter.

Conclusion

Despite their failure to gain traction with an authentic audience, DRAGONBRIDGE generates high volumes of content across multiple social media platforms, is persistent, and continues to experiment in their tactics and techniques. That is why Google has scaled our efforts in recent years to disrupt DRAGONBRIDGE coordinated inauthentic activity on our platforms. We encourage others in the community to continue tracking this actor and shedding light on their operations and would like to thank Mandiant and other researchers for their partnership in countering DRAGONBRIDGE activity.