Updates from Threat Analysis Group (TAG)

Threat Analysis Group

TAG Bulletin: Q3 2024

Sep 12, 2024

[[read-time]] min read

Billy Leonard
Threat Analysis Group

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2024. It was last updated on October 31, 2024.

July

  • We terminated 89 YouTube channels as part of our investigation into coordinated influence operations linked to Ecuador. The campaign was sharing content in Spanish about Mexican and Ecuadorian politics.
  • We blocked 10 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to entities operating in the United States. The influence operations campaign was sharing content in English that sought to persuade voters to run for elected positions as independent candidates. We received leads from Meta that supported us in this investigation.
  • We terminated 27 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English, Polish, French and Russian that was supportive of Russia and critical of Ukraine and Western institutions. We received leads from OpenAI that supported us in this investigation.
  • We blocked 25 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the actor publicly tracked as Doppelganger and was sharing content in English, German and French about news and current events in the US, Western Europe, Ukraine, Russia and the Middle East.
  • We terminated 26 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 1 Blogger blog as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of Russia and critical of Ukraine.
  • We terminated 34 YouTube channels and 1 Ads account as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian, Spanish, German and English that was supportive of Russia and critical of the West.
  • We terminated 18 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English that was supportive of Russia and critical of the U.S.
  • We terminated 5 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in French, Arabic and Spanish that was supportive of Russia and critical of the West.
  • We terminated 12 YouTube channels and 1 Ads account as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Polish, German, Italian, English, Hungarian, Czech and Dari that was supportive of Russia and critical of the West.
  • We terminated 7,319 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We blocked 13 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English that was supportive of Russia and critical of Ukraine and the West.
  • We blocked 7 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 583 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government.
  • We terminated 5,554 YouTube channels and 15 Blogger blogs and blocked 4 domains from eligibility to appear on Google News surfaces and Discover as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

August

  • We blocked 2 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations. The campaign was sharing content in French about news and current events.
  • We terminated 99 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in French, Arabic, Polish, English, German, Italian, Turkish, Hebrew and Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 806 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English about French political figures.
  • We blocked 25 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the actor publicly tracked as Doppelganger and was sharing content in German that was supportive of Russia and critical of the West.
  • We terminated 4,253 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 49 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to Russian state-sponsored entities and was sharing content in Russian that was critical of the Moldovan government and President Maia Sandu.
  • We terminated 1,232 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government.
  • We blocked 498 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The campaign was linked to a Chinese PR firm named Shanghai Haixun Technology Co., Ltd and was sharing spammy, repetitive content in addition to topics aligned to the views of the Chinese government.
  • We terminated 4,253 YouTube channels and 1,004 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

September

  • We terminated 103 YouTube channels as part of our investigation into coordinated influence operations linked to France. The campaign was sharing content in French that was critical of minority communities in France.
  • We terminated 124 channels as part of our investigation into coordinated influence operations linked to an individual based in the UK. The campaign, which consisted solely of content from this one individual, was sharing content in English related to the US election.
  • We terminated 1 Blogger blog and blocked 8 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Cameroon. The campaign was linked to a digital marketing firm and was sharing content in French that was supportive of Russia and critical of France and the West.
  • We terminated 4,164 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We blocked 16 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the actor publicly tracked as Doppelganger and was sharing content in Arabic, French, German, English and Italian about current events in Europe, the US and Middle East, including content related to the US election.
  • We terminated 60 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English, Polish, French, German, Italian, Turkish, Hebrew and Russian that was supportive of Russia and critical of Ukraine.
  • We terminated 21 YouTube channels and 7 Ads accounts and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English, French and Russian that was supportive of Russia and critical of France and the US. Our findings are similar to findings reported by Meta.
  • We blocked 3 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English about the US election as well as content supportive of Russia and critical of Ukraine.
  • We blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 7 Blogger blogs and blocked 116 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English about topics related to the US election as well as content supportive of Russia and critical of Ukraine.
  • We terminated 26 YouTube channels and 5 Ads accounts as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Russian state-controlled media outlet RT and was sharing content in English about a variety of topics, including content related to the US election.
  • We blocked 3 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Georgian and Armenian that was supportive of Russia as well as content related to events and politics in Georgia and Armenia. Our findings are similar to findings reported by Meta.
  • We terminated 1,877 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government.
  • We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Farsi that was supportive of the Iranian government and Palestine and critical of Israel.
  • We terminated 11 YouTube channels, 1 Ads accounts and 1 AdSense account as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic and English about current events in the Middle East, US and UK.
  • We terminated 4 YouTube channels and 1 Ads accounts as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Urdu, English, Farsi, Arabic and Bengali that was supportive of the Iranian government and Palestine and critical of Israel.
  • We blocked 22 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English, French and Arabic that was supportive of Palestine and critical of Israel. The campaign also shared content in English related to the US election, including narratives from across the political spectrum.
  • We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The campaign was sharing content in English that was supportive of China and critical of the West.
  • We terminated 6,019 YouTube channels and 1,432 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.
POSTED IN:

Related stories