Updates from Threat Analysis Group (TAG)

Threat Analysis Group

TAG Bulletin: Q1 2023

May 01, 2023

min read

Shane Huntley
Shane Huntley
Senior Director, Threat Analysis Group

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2023. It was last updated on April 27, 2023.

January

  • We blocked 2 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to individuals from Poland. The campaign was sharing content in Polish that was supportive of Russia and critical of the United States and Ukraine. We received leads from Mandiant, which is now part of Google Cloud, that supported us in this investigation.
  • We terminated 87 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of the Wagner Group and Russia’s performance in the war in Ukraine.
  • We terminated 7 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to actors tied to Russian intelligence and was sharing content in Russian that was supportive of the Russian government, the war in Ukraine, and the quality of daily life in Russia for the average Russian citizen.
  • We terminated 4 YouTube channels as part of our investigation into coordinated influence operations. The campaign was sharing content in German that was critical of Ukrainian refugees.
  • We terminated 40 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Persian, English, Hindi and Urdu that was supportive of the Iranian government and critical of protesters in Iran. We received leads from Graphika that supported us in this investigation.
  • We terminated 1,088 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government.
  • We terminated 6,285 YouTube channels and 52 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels and blogs mostly uploaded spammy content in Chinese about music, entertainment and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

February

  • We terminated 207 YouTube channels and 10 Blogger blogs as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian and English that was supportive of Russia and Russia’s invasion of Ukraine.
  • We terminated 193 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine, NATO, and the West.
  • We terminated 15 YouTube channels, 10 Blogger blogs, and blocked 7 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Albania. The campaign was linked to the France and Albania-based National Council of Resistance of Iran (NCRI) and was sharing content in Persian, Pashto and English that was supportive of the People's Mujahedin Organization of Iran (MEK) and critical of the Iranian government. We received leads from LinkedIn that supported us in this investigation.
  • We terminated 4,787 YouTube channels and 14 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China, Taiwan, and U.S. foreign affairs. These findings are consistent with our previous reports. We received leads from LinkedIn that supported us in this investigation.

March

  • We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian and English of prank calls targeting Polish and Ukrainian government officials.
  • We terminated 320 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine, NATO and the West.
  • We terminated 112 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of Russia and critical of Ukraine.
  • We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Israel. The campaign was sharing content in English that focused on promoting or denigrating specific individuals.
  • We terminated 10 YouTube channels and 4 Ads accounts as part of our investigation into coordinated influence operations linked to Venezuela. The campaign was sharing content in Spanish that was supportive of Venezuelan President Nicolás Maduro Moros.
  • We terminated 21 YouTube channels, 2 AdSense accounts and 2 Blogger blogs as part of our investigation into coordinated influence operations linked to Nigeria. The campaign was sharing content in English that was supportive of the Indigenous People of Biafra (IPOB) movement and critical of voting and democratic processes in Nigeria.
  • We terminated 6,930 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.
POSTED IN:

Related stories