Updates from Threat Analysis Group (TAG)

Threat Analysis Group

TAG Bulletin: Q4 2022

Jan 25, 2023

[[read-time]] min read

Shane Huntley
Shane Huntley
Senior Director, Threat Analysis Group

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2022. It was last updated on January 19, 2024.

October

  • We terminated 76 YouTube channels as part of our investigation into coordinated influence operations linked to Brazil. The campaign was sharing content in Brazilian Portuguese that was supportive of Brazilian President Jair Bolsonaro.
  • We terminated 718 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine and the West.
  • We terminated 8 YouTube channels and blocked 2 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English that was about a variety of topics including British and global current events. We received leads from Meta that assisted us in this investigation.
  • We terminated 27 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian that was supportive of Russia and critical of Western Europe and Ukraine.
  • We terminated 30 YouTube channels and 5 AdSense accounts as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine, NATO, and the West.
  • We terminated 5,197 YouTube channels and 17 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels and blogs mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

November

  • We blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic that was supportive of the Syrian government and Iran.
  • We terminated 1 AdSense account and blocked 3 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English that was supportive of independence movements in Scotland, Wales, and Northern Ireland and critical of the United Kingdom and its recent governments. We received leads from Mandiant, which is now part of Google Cloud, that supported us in this investigation
  • We terminated 1 AdSense account and blocked 15 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic, Farsi, English, French, and Malay that was supportive of Iran, Syria, and Palestine and critical of the United States, Saudi Arabia, and Israel.
  • We terminated 515 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia.
  • We terminated 19 YouTube channels, 2 AdSense accounts, and 6 Blogger blogs as part of our investigation into coordinated influence operations linked to individuals from Colombia. The campaign was sharing sensational content in Spanish that was about a variety of topics including U.S. immigration policy and the U.S. midterm elections. We believe this operation was financially motivated.
  • We terminated 13 YouTube channels, 1 AdSense account, and 5 Ads accounts as part of our investigation into coordinated influence operations linked to individuals from Argentina. The campaign was sharing content in Spanish that was about a variety of topics including U.S. elections, Brazilian elections, the war in Ukraine, and COVID-19. We believe this operation was financially motivated.
  • We terminated 57 YouTube channels as part of our investigation into coordinated influence operations linked to Brazil. The campaign was sharing content in Portuguese that was supportive of Brazilian President Jair Bolsonaro.
  • We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to China. The campaign was sharing sensational content in Chinese that was about the war in Ukraine and relations between mainland China and Taiwan.
  • We terminated 1 AdSense account and blocked 1 domain from eligibility to appear on Google News surfaces as part of our investigation into coordinated influence operations linked to China. The campaign was sharing content in English that was about a variety of topics including U.S. and global news and current events.
  • We terminated 7,599 YouTube channels, 1 AdSense account, and 3 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels and blogs mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

December

  • We terminated 121 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 5 YouTube channels and 1 Ads account as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of Russia. We received leads from the FBI that supported us in this investigation.
  • We blocked 1 domain from eligibility to appear on Google News surfaces as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English that was supportive of Iran and critical of the United States, the West, and Israel.
  • We terminated 20 YouTube channels, 15 Ads accounts, and 3 AdSense accounts and blocked 13 domains from eligibility to appear on Google News surfaces as part of our investigation into coordinated influence operations linked to individuals from Vietnam. The campaign was sharing content in English and Vietnamese that was critical of the Chinese government. We believe this operation was financially motivated.
  • We terminated 5,233 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.
  • We terminated 22 YouTube channels and 1 Blogger blog as part of our investigation into coordinated influence operations linked to Myanmar. The campaign was sharing content in Burmese about Myanmar’s government, developments in the civil war, and potential US intervention.
POSTED IN:

Related stories