Threat Analysis Group

TAG Bulletin: Q2 2021



This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2021. It was last updated on July 29, 2021.

April

  • We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to El Salvador. This campaign uploaded content in Spanish focusing on a mayoral race in the Santa Tecla municipality. Our findings are similar to findings reported by Facebook.


  • We terminated 43 YouTube channels as part of our investigation into coordinated influence operations linked to Albania. This campaign uploaded content in Farsi that was critical of Iran’s government and supportive of Mojahedin-e Khalq. Our findings are similar to findings reported by Facebook.


  • We terminated 728 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about protests in Hong Kong and criticism of the U.S. response to the COVID-19 pandemic. These findings are consistent with our previous reports.

  • We terminated 1 Play developer as part of our investigation into coordinated influence operations linked to Myanmar. The campaign was linked to the Myanmar Armed Forces and was sharing content in Burmese and English that was supportive of the Myanmar Armed Forces.

May

  • We terminated 57 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. This campaign uploaded content in Russian that was supportive of Russia’s government.


  • We terminated 11 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. This campaign uploaded content in Russian that was critical of Ukraine and of U.S. narratives related to Russian troop build up on the Ukrainian border.


  • We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. This campaign uploaded content in Russian that was critical of protests in Belarus. We received leads from FireEye that supported us in this investigation.


  • We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. This campaign uploaded content in Bahasa Indonesia that was critical of Israel and Saudi Arabia.


  • We blocked 3 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Mexico. This campaign uploaded content in Spanish that was supportive of a number of local mayoral and gubernatorial candidates. Our findings are similar to findings reported by Facebook.


  • We terminated 1,015 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China’s COVID-19 vaccine efforts and social issues in the U.S. These findings are consistent with our previous reports.

June

  • We terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. This campaign uploaded content in Azerbaijani and Armenian that was critical of Armenia and supportive of the Azerbaijani military. Our findings are similar to findings reported by Facebook.


  • We terminated 17 YouTube channels and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Ukraine. This campaign uploaded content in Ukrainian that amplified several media platforms posing as news outlets and promoting a select number of local politicians. Our findings are similar to findings reported by Facebook.


  • We terminated 3 YouTube channels, 1 Play developer, and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. This campaign uploaded content in English, Russian, German, Italian, French, and Spanish that was supportive of Russia’s positions on the military conflicts in Ukraine, the Middle East, and Central Asia.


  • We terminated 15 YouTube channels as part of our investigation into coordinated influence operations linked to Ethiopia. This campaign uploaded content in Amahric that was supportive of Prime Minister Abiy Ahmed and was critical of his opposition. Our findings are similar to findings reported by Facebook.


  • We terminated 36 YouTube channels, 1 ads account and 1 blog as part of our investigation into coordinated influence operations linked to Pakistan. This campaign uploaded content in English and Urdu that was critical of India’s government in its treatment of Muslims, particularly in the region of Kashmir. Our findings are similar to findings reported by Facebook. We received leads from Graphika that supported us in this investigation.


  • We terminated 123 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. This campaign uploaded content in Russian that was critical of the protests supporting Alexei Navalny.


  • We terminated 9 YouTube channels as part of our investigation into coordinated influence operations linked to China. This campaign uploaded content in Mandarin Chinese that was positive in sentiment about life in Xinjiang, China and was critical of Western allegations of abuses. We received leads from Graphika that supported us in this investigation.


  • We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Moldova. This campaign uploaded content in Russian that contained a variety of sensational political narratives, including one about an imminent threat to Russia from Ukraine and the U.S.


  • We terminated 989 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China’s COVID-19 vaccine efforts and social issues in the U.S. These findings are consistent with our previous reports. We received leads from FireEye and Graphika that supported us in this investigation.