Google has revealed that it took down 1,320 YouTube channels and 1,177 Blogger blogs as part of a coordinated influence operation connected to the People’s Republic of China (PRC).
“The coordinated inauthentic network uploaded content in Chinese and English about China and U.S. foreign affairs,” Google Threat Analysis Group (TAG) researcher Billy Leonard said in the company’s quarterly bulletin released last week.
The tech giant said it also terminated Ads, AdSense, and Blogger accounts linked to two coordinated influence operations with ties to Indonesia that shared content supportive of the ruling party in the country.
Another big cluster dismantled by Google involved a network of 378 YouTube channels that it said originated from a Russian consulting firm and disseminated content that projected Russia in a favorable light and denigrated Ukraine and the West.
The company further terminated one AdSense account and blocked 10 domains from showing up in Google News and its Discover feed for mobile devices that spawned content in English and Norwegian about food, sports, and lifestyle topics.
The coordinated operation, linked to individuals from the Philippines and India, was financially motivated, according to Google.
Some of the other prominent violators taken down are listed below –
The development comes as OpenAI and Meta revealed that they disrupted an influence operation orchestrated by a Tel Aviv-based political marketing firm called Stoic to propagate pro-Israel messaging in the U.S. and Canada amid the ongoing conflict in Gaza. The campaign began in October post the outbreak of war between Israel and Hamas.
“This network commented on Facebook Pages of international and local media organizations, and political and public figures, including U.S. lawmakers,” Meta noted late last month. “Their comments included links to the operation’s websites and were often met with critical responses from authentic users calling them propaganda.”
“They posted primarily in English about the Israel-Hamas war, including calls for the release of hostages; praise for Israel’s military actions; criticism of campus antisemitism, the United Nations Relief and Works Agency (UNRWA), and Muslims claiming that ‘radical Islam’ poses a threat to liberal values in Canada.”
Meta told CyberScoop that it linked the activity to STOIC based on a “combination of technical and behavioral indicators,” without sharing additional specifics.
According to a report published by The New York Times last week, the covert influence-for-hire campaign was commissioned by Israel’s Ministry of Diaspora Affairs, citing four Israeli officials, who said the government body earmarked around $2 million to the operation.
This is not the first time shadowy Israeli companies have been caught engaging in disinformation campaigns. In early 2023, the Forbidden Stories consortium uncovered an “ultra-secret” entity named Team Jorge that offers for sale “influence and manipulation services to the highest bidder.”
The disclosures also follow an advisory from Microsoft delving into Russia’s escalating malign disinformation campaigns against France and the 2024 Summer Olympic Games, some of which have used artificial intelligence (AI)-generated audio clips to advance pro-Kremlin narratives.
It’s worth noting that the International Olympic Committee (IOC), while allowing qualifying athletes from Russia and Belarus to compete in the multi-sport event as “Individual Neutral Athletes,” has barred them from participating in the opening ceremony in light of the war in Ukraine.
Last October, the IOC’s executive board suspended the Russian Olympic Committee “with immediate effect until further notice” after its decision to include as members regional sports organizations from four Ukrainian territories illegally annexed by Russia since the onset of the war in February 2022. In February, Russia lost its appeal against the ban.
“If they cannot participate in or win the Games, then they seek to undercut, defame, and degrade the international competition in the minds of participants, spectators, and global audiences,” Redmond said.
Google-owned Mandiant and Recorded Future, in two separate analyses, characterized the sporting event as a “target-rich environment” that faces a broad range of cyber threats ranging from ransomware and hacktivist attacks to nation-state actors conducting espionage and influence operations.
“The Paris Olympics faces an elevated risk of cyber threat activity, including cyber espionage, disruptive and destructive operations, financially-motivated activity, hacktivism, and information operations,” Mandiant researchers Michelle Cantos and Jamie Collier pointed out.
The actor behind the defamation campaign against the IOC is being tracked by Microsoft under the moniker Storm-1679, whose goals, the company added, also seek to instigate public fear to deter spectators from attending the event altogether through fabricated videos alleging possible terrorism threats.
The second Russia-linked threat actor to ramp up its anti-Olympics messaging in the past two months is Doppelganger (aka Storm-1099) which has been found using a cluster of 15 French language news sites to spread claims of rampant IOC corruption and potential violence at the Games.
“The Kremlin’s propaganda and disinformation machine is unlikely to hold back in leveraging its network of actors to undermine the Games as the Olympics draw near,” the Microsoft Threat Analysis Center (MTAC) said.
“Actors are likely to use a mix of propaganda facilitated by generative AI across social media platforms to continue their campaigns against France, the IOC, and the Olympic Games.”
