Updates from Threat Analysis Group (TAG)

Threat Analysis Group

TAG Bulletin: Q1 2024

Mar 06, 2024

[[read-time]] min read

Shane Huntley
Shane Huntley
Senior Director, Threat Analysis Group

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2024. It was last updated on April 22, 2024.

January

  • We blocked 4 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Italy. The campaign was sharing content in English, Czech and Farsi that was supportive of the Russian government and Russia’s ongoing war in Ukraine.
  • We terminated 1 Ads account and blocked 2 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Israel. The campaign was sharing content in Arabic, Hebrew, English, Spanish, French, German and Farsi that made claims that Europe and the West will be targeted in future attacks by the terrorist organization Hamas.
  • We terminated 2 Ads accounts and 2 Blogger blogs, banned 1 Play developer, and blocked 42 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Turkey. The campaign was sharing content in Arabic about the Israel-Gaza war, the government of Yemen, and news and politics in the Arab world.
  • We terminated 1 Ads account and blocked 3 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Kuwait. The campaign was sharing content in Arabic that was supportive of the government of Kuwait as well as content about news and politics in the Arab world.
  • We terminated 134 YouTube channels as part of our investigation into coordinated influence operations linked to Indonesia. The campaigns were sharing content in Bahasa Indonesia supportive of the Indonesian ruling party.
  • We terminated 5,306 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

February

  • We terminated 4 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Hebrew that was critical of the Israeli government and its actions in the ongoing Israel-Gaza war. The campaign also shared content depicting alleged cyber attacks targeting Israeli organizations.
  • We terminated 33 YouTube channels and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English, Spanish and Farsi that was supportive of Iran, Yemen, and Palestine and critical of the US and Israel.
  • We terminated 3 YouTube channels, 1 AdSense account, and 8 Blogger blogs as part of our investigation into coordinated influence operations linked to Pakistan. The campaign was sharing content in Urdu and English that discussed Pakistani politics and was supportive of the Pakistan Muslim League Nawaz party.
  • We blocked 5 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the actor publicly tracked as Doppelganger and was sharing content in English, German and French about news and current events in the US, Western Europe, Ukraine, Russia and the Middle East.
  • We terminated 73 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian that was supportive of Russian leadership and critical of Ukraine, the US and Western Europe.
  • We terminated 4 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in German and Arabic that was supportive of the Russian government.
  • We terminated 11 YouTube channels as part of our investigation into coordinated influence operations linked to Indonesia. The campaign was sharing content in Bahasa Indonesia that was supportive of the Indonesian ruling party.
  • We terminated 31 YouTube channels, 2 Ads accounts, and 1 AdSense account as part of our investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The campaign was sharing content in English that was critical of US technology and promoted Chinese technology.
  • We terminated 15 YouTube channels as part of our investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The campaign was sharing content in Chinese that was critical of the government of Taiwan. We received leads from Mandiant (part of Google Cloud) that supported us in this investigation.
  • We terminated 1,341 YouTube channels and 48 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and US foreign affairs. These findings are consistent with our previous reports.

March

  • We terminated 40 YouTube channels and 2 AdSense accounts as part of our investigation into coordinated influence operations linked to Afghanistan. The campaign was sharing content in Farsi and English that was supportive of Palestine and critical of Israel and the US.
  • We terminated 7 YouTube channels as part of our investigation into coordinated influence operations linked to individuals in Argentina. The campaign was sharing content in Portuguese that was critical of opposition political parties in Portugal.
  • We terminated 22 YouTube channels, 3 Blogger blogs, and 1 AdSense account as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Farsi that was supportive of Iran and Yemen and critical of Israel.
  • We terminated 48 YouTube channels as part of our investigation into coordinated influence operations linked to Indonesia. The campaigns were sharing content in Bahasa Indonesia that was supportive of the Indonesian ruling party.
  • We terminated 1 Blogger blog as part of our investigation into coordinated influence operations linked to Taiwan. The campaign was sharing content in Chinese that was supportive of Taiwan’s unification with the People’s Republic of China (PRC) and critical of the Democratic Progressive Party (DPP).
  • We terminated 33 YouTube channels and 3 AdSense accounts as part of our investigation into coordinated influence operations linked to individuals in Cameroon and Haiti. The campaign was sharing content in French that was supportive of China and critical of the West.
  • We blocked 107 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The campaign was linked to a media company and was sharing content in Korean, Japanese, Russian, English, Portuguese, Italian, Spanish and other languages that was supportive of China.
  • We terminated 3,066 YouTube channels and 540 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and US foreign affairs. These findings are consistent with our previous reports.
POSTED IN:

Related stories