Updates from Threat Analysis Group (TAG)

Threat Analysis Group

TAG Bulletin: Q2 2023

Jul 31, 2023

[[read-time]] min read

Shane Huntley
Shane Huntley
Senior Director, Threat Analysis Group

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q2 2023. It was last updated on July 31, 2023.

April

  • We terminated 13 YouTube channels and 2 Ads accounts as part of our investigation into coordinated influence operations linked to Lithuania. The campaign was sharing content in Lithuanian that was supportive of Russia and critical of Ukraine, NATO and the EU.
  • We terminated 1 YouTube channel as part of our investigation into coordinated influence operations linked to Russia. The campaign was associated with the FROZENBARENTS persona Cyber Army of Russia, and was sharing content in Russian that focused on sharing hacking techniques.
  • We terminated 5 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine.
  • We terminated 139 YouTube channels as part of our investigation into coordinated influence operations linked to Ukraine. The campaign was sharing content in Russian that was supportive of Russia and Kazakhstan President Kassym-Jomart Tokayev.
  • We terminated 18 YouTube channels, 1 Ads account, and 4 AdSense accounts as part of our investigation into coordinated influence operations linked to Turkey. The campaign was sharing content in English focused on the conflict in Ukraine. We believe this operation was financially motivated.
  • We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic that was supportive of the Iran government.
  • We terminated 113 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government.
  • We terminated 141 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Uzbekistan. The campaign was sharing content in Uzbeki language that was supportive of Uzbekistan President Shavkat Mirziyoyev.
  • We terminated 3,495 YouTube channels and 28 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China and US foreign affairs. These findings are consistent with our previous reports. We received leads from LinkedIn and Graphika that supported us in this investigation.

May

  • We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Turkey. The campaign was sharing content in Turkish that was supportive of the AK Party.
  • We terminated 68 YouTube channels as part of our investigation into coordinated influence operations linked to Turkey. The campaign was sharing content in Turkish that was supportive of the Nationalist Movement Party (MHP) and Victory Party.
  • We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaigns were sharing content about a variety of topics including content supportive of Palestine and critical of Israel.
  • We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in French and English that was related to Iranian hack-and-leak operations. Our findings are similar to findings reported by Meta.
  • We terminated 337 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine, NATO and the West.
  • We terminated 7 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign uploaded content in Russian that promoted the Wagner Group and Yevgeny Prigozhin.
  • We terminated 35 Youtube channels as part of our investigation into coordinated influence operations linked to Spain. The campaign was sharing content in Spanish that was critical of the Spanish government.
  • We terminated 188 YouTube channels as part of our investigation into coordinated influence operations linked to Mexico. The campaign was sharing content in Spanish that was supportive of the Morena party and Senator Ricardo Monreal.
  • We terminated 9,599 YouTube channels and 3 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

June

  • We terminated 239 YouTube channels as part of our investigation into coordinated influence operations linked to Mexico. The campaign was sharing content in Spanish that was supportive of the Morena party and Senator Ricardo Monreal.
  • We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Slovakia. The campaigns were sharing content in Slovak, Czech, and English supportive of Russia and critical of the West.
  • We terminated 26 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 91 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian related to the Russia-Ukraine war that was supportive of Russia and critical of Ukraine.
  • We terminated 380 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm that was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Turkey. The campaign was sharing content in Turkish that was supportive of the AK Party.
  • We terminated 163 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government.
  • We terminated 10 YouTube channels as part of our investigation into coordinated influence operations linked to China. The campaign was sharing content in Tibetan and English that was critical of the Dalai Lama and the Central Tibetan Administration. Our findings are similar to findings reported by Meta.
  • We terminated 6,575 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.
POSTED IN:

Related stories