Over 50,000 instances of DRAGONBRIDGE activity disrupted in 2022

Threat Analysis Group’s (TAG) mission is to understand and counter serious threats, including actors engaged in coordinated information operations (IO). Today, in connection with the release of the TAG Bulletin, we are sharing year-in-review insights for 2022 about DRAGONBRIDGE, the most prolific IO actor TAG tracks. DRAGONBRIDGE, also known as “Spamouflage Dragon,” is a spammy influence network linked to China that has a presence across multiple platforms.

Most DRAGONBRIDGE activity is low quality content without a political message, populated across many channels and blogs. However, a small fraction of DRAGONBRIDGE accounts also post about current events with messaging that pushes pro-China views. DRAGONBRIDGE narratives in 2022 spanned a wide range of news topics — ranging from China’s Covid-19 response to the war in Ukraine — and included a higher volume of content critical of the US. The actor has primarily targeted Chinese speakers, but some narratives were in English and other languages.

In 2022, Google disrupted over 50,000 instances of DRAGONBRIDGE activity across YouTube, Blogger, and AdSense, reflecting our continued focus on this actor and success in scaling our detection efforts across Google products. We have terminated over 100,000 DRAGONBRIDGE accounts in the IO network’s lifetime. Despite their scale and profuse content production, DRAGONBRIDGE achieved practically no organic engagement from real viewers — in 2022, the majority of DRAGONBRIDGE channels had 0 subscribers when Google disrupted them, and over 80% of DRAGONBRIDGE videos had fewer than 100 views. Engagement for DRAGONBRIDGE’s blogs on Blogger was also low, with nearly 95% receiving 10 or fewer views for blogs terminated in December.

While DRAGONBRIDGE has not attracted an organic audience, they are persistent and adaptable. Since TAG started tracking the network in 2019, DRAGONBRIDGE has consistently experimented with new tactics, new formats and higher quality content. As they evolve over time, DRAGONBRIDGE’s coordinated inauthentic activity may eventually attract the attention of real users. For this reason, TAG and Mandiant track DRAGONBRIDGE closely and Google has taken an aggressive approach to identifying and removing their content.

Content without an audience

In 2022, the overwhelming majority of DRAGONBRIDGE content Google disrupted never reached a real audience. Among the 53,177 channels we disabled in 2022, 58% had zero subscribers and 42% of their videos had zero views. 83% of those videos had fewer than 100 views.

In the rare cases where DRAGONBRIDGE content did receive engagement, it was almost entirely inauthentic, coming from other DRAGONBRIDGE accounts and not from genuine users. Comment activity was mostly from other DRAGONBRIDGE accounts.

Blogger engagement metrics also show almost no authentic audience for DRAGONBRIDGE’s blogs. For blogs terminated in December, nearly 95% of DRAGONBRIDGE blogs received 10 or fewer views, and over 96% received no comments.

Low quality and spammy

A feature of DRAGONBRIDGE – and likely a contributing reason they have not gained an organic audience on YouTube and Blogger – is the low quality of their content, especially in English. Most of their posts are spammy, nonsensical material without an overt political message — often clips of animals, landscapes, food, sports and other content. Blurry visuals, garbled audio, poor translations, malapropisms, and mispronunciations are also common. The content is often hastily produced and error-prone — for example, neglecting to remove Lorem Ipsum text from a video.

Pro-China narratives and increased criticism of the US

A small fraction of DRAGONBRIDGE channels and blogs post on current events, promoting pro-China messages and criticizing the US. In 2022, DRAGONBRIDGE increased focus on and sharpened their criticism of the US with posts mostly in Mandarin, in English and other languages.

DRAGONBRIDGE’s pro-China content included narratives praising China’s pandemic response, criticism of pro-democracy protests, and significantly in 2022, more strident support for unification with Taiwan.

We saw an increase in DRAGONBRIDGE activity amidst heightened cross-strait developments. Following the announcement of a possible visit to Taipei by then US House Speaker Nancy Pelosi in late July, DRAGONBRIDGE shifted some of its focus towards criticism of Speaker Pelosi, along with her family and finances. This was in line with usual DRAGONBRIDGE patterns of attempting to discredit US political leadership.

However, during and after the Chinese People’s Liberation Army’s (PLA) military drills straddling Taiwan in early August, DRAGONBRIDGE sharply escalated its rhetoric, uploading militaristic videos of the PLA and political videos calling for Taiwanese President Tsai Ing-Wen and her political allies to “surrender,” moving away from criticism of Speaker Pelosi. DRAGONBRIDGE displayed unusually coherent behavior in using uniform hashtags and titles across channels, while swiftly and repeatedly uploading topical, high-production-value content that was not interspersed with the usual misdirecting spam. The pace and manner of this pivot highlighted DRAGONBRIDGE’s additional sensitivity to geopolitical developments in China’s immediate neighborhood, and Taiwan in particular.

In 2022, DRAGONBRIDGE also posted narratives claiming the US was responsible for stoking tensions abroad and meddling in the domestic affairs of other countries. DRAGONBRIDGE’s US-focused narratives portrayed US society and democracy in a negative light, cycling through political and social narratives that evolved with the headlines. In 2022, Google removed DRAGONBRIDGE content on topics such as US Covid-19 response, racial inequality, political divisions, inflation, and other controversial topics.

In the leadup to the 2022 US midterm elections, Google terminated channels where DRAGONBRIDGE attempted to spread narratives highlighting US political divisions, potential for political violence, and threats to democracy. They presented election narratives as if they were short news clips. One video, previously reported by Mandiant, attempted to cast voting in the US as ineffective and a waste of time.

Bulk account infrastructure

To post their spam and IO content, DRAGONBRIDGE manages infrastructure consisting of thousands of accounts at any given time. Google has terminated 100,960 accounts associated with DRAGONBRIDGE over the network’s lifetime.

Rather than build their account infrastructure themselves, DRAGONBRIDGE obtains Google Accounts from bulk account sellers who create and sell accounts for profit. We have seen DRAGONBRIDGE reuse accounts that were previously used for financially motivated activity, then went dormant before they resumed activity and posted DRAGONBRIDGE videos and blogs. We believe accounts like this are changing hands from other bad actors to DRAGONBRIDGE.

Evolving tactics and experimentation

DRAGONBRIDGE regularly experiments with new tactics, including producing a small number of channels with high quality, bespoke content. These evolving tactics underscore DRAGONBRIDGE’s willingness to experiment and their persistence. Tactics we saw DRAGONBRIDGE test include:

• High quality content with real human voice narration instead of a machine generated voice
• Talk show format with a real person on-camera discussing events in a “news like” format
• Animated political cartoons
• IO content mixed in with high quality apolitical content, such as beauty advice and cooking tips

Conclusion

Despite their failure to gain traction with an authentic audience, DRAGONBRIDGE generates high volumes of content across multiple platforms, is persistent and continues to experiment in their tactics and techniques. That is why we have scaled our efforts to disrupt DRAGONBRIDGE coordinated inauthentic activity on our platforms. We encourage others in the community to continue tracking this actor and shedding light on their operations and would like to thank Mandiant and Graphika for their partnership in countering DRAGONBRIDGE activity.