Mandiant has published new research with evidence that the pro-PRC campaign, HaiEnergy, may have financed at least two staged, in-person protests in Washington, D.C. and that campaign was able to get Chinese propaganda on at least 32 subdomains of legitimate U.S.-based news outlets.
As Mandiant detailed last August, the ongoing pro-PRC influence campaign included a network of at least 72 inauthentic news sites, which presented themselves as independent news outlets, based in various regions across the world, and leveraged infrastructure linked to a Chinese public relations (PR) firm called “Shanghai Haixun Technology Co.” (上海海讯社科技有限公司) (aka Haixun).
When Mandiant published its original report, they were unable to determine the extent to which Haixun was involved in, or even aware of this campaign, as Mandiant’s visibility was limited to the campaign’s use of infrastructure linked to the company. Mandiant’s new research now shows the PR firm Haixun is not only aware of the HaiEnergy campaign, but is actively supporting it through the solicitation of for-hire freelancers via the on-demand company, Fiverr, to promote campaign content.
Mandiant’s researchers note the campaign’s activity has continued to be unsuccessful in gaining traction – both online and in person.
Sandra Joyce, VP, Mandiant Intelligence – Google Cloud, states the following:
“This campaign goes beyond the troll factory noise we have gotten used to over the years. They are boosting their narratives with the help of well-known news brands and they are crossing lines by paying for fake protesters and using that content for propaganda purposes. It’s fortunate that they’re clearly having trouble generating much influence, but that’s certainly not for lack of trying and they will get better over time.”
Other new findings include:
- HaiEnergy may have financed at least two staged, in-person protests in Washington, D.C. that were recorded.
- The campaign then used the protests as source material in HaiEnergy-linked operations that promoted narratives surrounding highly divisive U.S. domestic issues and messaging critical of a June 2022 decision by the U.S. Government to ban all goods produced in China’s Xinjiang region.
- This would be a significant escalation in TTPs employed by this campaign, and further evidence suggesting the campaign is expanding its tactics to maximize potential impact.
- In at least one instance, Mandiant observed Haixun, via its Fiverr account, commission an influencer to promote a video surrounding China’s “victory” over COVID-19.
- Mandiant has identified new tactics, techniques, and procedures (TTPs) being employed by HaiEnergy, which includes the use of newswire services to distribute pro-PRC content to subdomains of legitimate U.S.-based news outlets.
- Mandiant also notes the possibility the campaign leveraged a less conventional tactic of displaying an ad with pro-PRC messaging that was possibly placed on a billboard in New York City’s Times Square.
