Updates from Threat Analysis Group (TAG)

Threat Analysis Group

TAG Bulletin: Q1 2022

Feb 28, 2022

[[read-time]] min read

Shane Huntley
Shane Huntley
Senior Director, Threat Analysis Group

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2022. It was last updated on May 12, 2022.

January

  • We terminated 3 YouTube channels as part of our investigation into coordinated influence operations. The campaign uploaded content in Arabic that was critical of former Sudanese president Omar al-Bashir and supportive of the 2019 Sudanese coup d’état. Our findings are similar to findings reported by Meta.
  • We terminated 1 AdSense account and 1 Play developer as part of our investigation into coordinated influence operations linked to Turkey. The campaign was sharing content in Arabic that was about news and current events in Libya. Our findings are similar to findings reported by Meta.
  • We terminated 42 YouTube channels and 2 Ads accounts as part of our investigation into coordinated influence operations linked to Iraq. The campaign uploaded content in Arabic that was in support of the Iraqi Harakat Hoquq party. We received leads from Mandiant that supported us in this investigation.
  • We terminated 4 YouTube channels, 2 AdSense accounts, and 1 Blogger blog and blocked 6 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into reported coordinated influence operations linked to Belarus, Moldova, and Ukraine. The campaign was sharing content in English that was about a variety of topics including US and European current events. We believe this operation was financially motivated.
  • We terminated 4361 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports
  • We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Ukraine. The campaign was linked to JokerDNR and was sharing content in Ukrainian that was critical of the Ukrainian military, the Ukrainian government, and NATO. We received leads from Mandiant, which is now part of Google Cloud, that supported us in this investigation.

February

  • We terminated 416 YouTube channels and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was posting content in Russian that was supportive of Russia’s recognition of Ukrainian separatist regions and critical of the United States and NATO.
  • We terminated 1 YouTube channel as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the media outlet News Front and was sharing content in Ukrainian that was critical of Ukraine’s government and the West. We received leads from Miburo Solutions that supported us in this investigation.
  • We terminated 5 YouTube channels and 21 Blogger blogs as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was uploading a variety of content in Russian including criticism of Ukraine’s handling of the COVID-19 pandemic, criticism of US and EU support for Ukraine, and criticism of local politicians in St. Petersburg.
  • We terminated 12 YouTube channels as part of our investigation into coordinated influence operations linked to Latin America. The campaign uploaded content in Spanish that was critical of local and national politicians in Ecuador and Honduras. Our findings are similar to findings reported by Meta.
  • We terminated 1 Ads account as part of our investigation into coordinated influence operations linked to the Philippines. The campaign promoted content in Tagalog and English that was supportive of presidential candidate Bongbong Marcos and his family.
  • We blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was linked to actors who were connected to the Liberty Front Press influence campaign and was uploading content in Arabic that was about a variety of topics including current events in Syria and analysis in support of the 1978 Iranian Revolution. We received leads from Mandiant that supported us in this investigation.
  • We terminated 6103 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

We have also taken extraordinary measures beyond our actions against coordinated influence operations to protect users and stop the spread of misinformation and disinformation about the war in Ukraine online.

March

  • We terminated 229 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia’s actions in Ukraine, critical of condemnation of Russian President Vladimir Putin, and critical of the United States and the West.
  • We terminated 1 YouTube channel as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the outlet UKR Leaks and was sharing content in Russian that was supportive of Russia’s actions in Ukraine and critical of the Ukrainian military.
  • We terminated 7 YouTube accounts and 1 AdSense account as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Russian news agency ANNA News and was sharing content in Russian that was critical of pro-Western Ukrainians and the Ukrainian perspective on both past and present relations with Russia. We received leads from Miburo Solutions that supported us in this investigation.
  • We terminated 3 YouTube channels and 1 AdSense account as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian and English of prank calls targeting UK government officials.
  • We blocked 3 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian, English, Bulgarian, Georgian, and Turkish that was supportive of independence and separatist movements in Ukraine and Georgia and was critical of Ukraine, the West, and NATO.
  • We terminated 28 YouTube channels and 16 AdSense accounts as part of our investigation into coordinated influence operations linked to Russia and Cameroon. The campaign was sharing content in French that was supportive of Russia and the governing junta in Mali and critical of France and French-led counterinsurgency operations in the region.
  • We terminated 2 YouTube channels and blocked 5 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to Russian state-sponsored entities and was sharing content in Russian that was supportive of Russia’s actions in Ukraine and separatist movements in the disputed regions of Ukraine and that was critical of the Ukrainian government, the United States, NATO, and the EU. We received leads from the FBI that supported us in this investigation.
  • We terminated 9 YouTube accounts and 2 Ads accounts and blocked 8 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. Parts of the campaign were linked to News Front and were sharing content in Russian that was supportive of Russia’s actions in Ukraine and critical of Ukraine, Ukrainian President Volodymyr Zelenskyy, and the United States. Our findings are similar to findings reported by Meta.
  • We terminated 6 YouTube channels and 1 AdSense account as part of our investigation into coordinated influence operations linked to Russia, Azerbaijan, Moldova, and Armenia. The campaign was sharing content in Russian and Ukrainian that was about a variety of topics including the war in Ukraine. We believe this operation was financially motivated. We received leads from Graphika that supported us in this investigation.
  • We terminated 12 YouTube channels and 1 AdSense account and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to the Donbass region. The campaign was sharing content in Russian that was supportive of separatist movements in the disputed regions of Ukraine.
  • We terminated 10 YouTube channels as part of our investigation into coordinated influence operations linked to Palestine. The campaign was sharing content in Arabic that was about a variety of topics including tensions between Palestine and Israel. We believe this operation was financially motivated.
  • We terminated 7304 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.
POSTED IN:

Related stories