Updates from Threat Analysis Group (TAG)

Threat Analysis Group

TAG Bulletin: Q4 2023

Jan 19, 2024

[[read-time]] min read

Shane Huntley
Shane Huntley
Senior Director, Threat Analysis Group

This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q4 2023. It was last updated on January 19, 2024.

October

  • We terminated 8 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Hindi and Arabic with anti-Israel narratives.
  • We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Hindi and Arabic that was supportive of the government of Iran.
  • We terminated 355 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 13 YouTube channels and 1 Blogger blog as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in English that was critical of Ukraine and the West.
  • We terminated 6 YouTube channels and 1 Ads account and blocked 4 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to state-funded media and was sharing content in English, Italian, Spanish and Polish that was supportive of Russia.
  • We terminated 57 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian, Azerbaijani and Turkish that was supportive of Azerbaijani interests in the Nagorno-Karabakh region, and critical of Russia and Armenia.
  • We terminated 41 YouTube channels as part of our investigation into coordinated influence operations linked to Ukraine. The campaign was linked to the Donbass region of Eastern Ukraine and was sharing content in Russian that was supportive of Russia and critical of the West.
  • We terminated 90 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government.
  • We terminated 21 YouTube channels and disabled 8 AdSense Accounts as part of our investigation into coordinated influence operations linked to Ethiopia. The campaign was sharing content in Amharic related to political topics in Ethiopia.
  • We terminated 40 YouTube channels and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Sudan. The campaign was sharing content in Arabic about Sudanese news and politics.
  • We terminated 317 YouTube channels as part of our investigation into coordinated influence operations linked to Turkey. The campaign was sharing content in Turkish that was supportive of a Turkish political party.
  • We terminated 3,785 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network mostly uploaded spammy content in Chinese about music, entertainment and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

November

  • We terminated 39 YouTube channels and 1 Blogger blog, and blocked 2 domains from eligibility to appear on Google News surfaces and Google Search Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic that was supportive of the Islamic Republic of Iran.
  • We terminated 40 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Azerbaijani and Farsi that was supportive of Iran’s government and critical of Israel and the US.
  • We terminated 2 YouTube channels and disabled 1 AdSense account as part of our investigation into coordinated influence operations linked to Pakistan. The campaign was sharing content in Urdu that discussed Pakistani politics and was supportive of the Pakistan People's Party.
  • We terminated 68 YouTube channels and 1 Blogger blog, disabled 5 Ads accounts and blocked 8 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Pakistan. The campaign was sharing content in Urdu and English that was supportive of the Pakistan Army and critical of India.
  • We blocked 21 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Togo. The campaign was linked to a Togo-based marketing company and was sharing content related to news and politics in Africa. We received leads from Mandiant, which is now part of Google Cloud, that supported us in this investigation.
  • We terminated 110 YouTube channels as part of our investigation into coordinated influence operations linked to individuals in Ukraine. The campaign was sharing content in Russian that was supportive of Russia's and Kazakhstan’s governments.
  • We terminated 7 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Spanish that was supportive of Russia and critical of Ukraine and the West.
  • We terminated 282 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We blocked 32 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the actor publicly tracked as Doppelganger and was sharing content in English, German, and French that discussed divisive social issues in Western countries. We received leads from Meta that supported us in this investigation.
  • We terminated 33 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian that was supportive of the Russian government and critical of Ukraine, the US, and Western Europe.
  • We terminated 26 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian that was supportive of the Russian government and critical of Ukraine, the US, and the West.
  • We terminated 99 channels as part of our investigation into coordinated influence operations linked to Taiwan. The campaign was sharing content in Chinese that was supportive of an opposition party and critical of Taiwan's ruling party.
  • We terminated 2702 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.

December

  • We terminated 23 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and critical of Ukraine and the West.
  • We banned 1 Play developer and blocked 2 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Turkey and Russia. The campaign was sharing content in Turkish that was supportive of Russia and critical of Ukraine.
  • We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to Thailand. The campaign was sharing content in Thai about Thai politicians and the Thai royal family.
  • We terminated 1953 YouTube channels and 52 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to the People’s Republic of China (PRC). The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports.
POSTED IN:

Related stories