Spamouflage Survives: CCP-aligned Disinformation Campaign Spreads on Facebook, Twitter, and YouTube

Part 1/6: Overview of an eleven-month disinformation campaign promoting the Chinese government

Miburo has detected over 2,000 accounts spreading disinformation and propaganda aligned with the Chinese Communist Party (CCP) on Facebook, Twitter, and YouTube. These accounts operate in dedicated messaging clusters, producing and amplifying CCP-aligned disinformation, such as denying human rights abuses in China’s northwest region of Xinjiang. This report was also featured in The New York Times.

We assess with high confidence that the entity behind these accounts is Spamouflage, a well-known disinformation actor aligned with the CCP, identified previously in a 2019 Graphika report. “Spamouflage” is a well-resourced disinformation actor that spreads CCP-aligned propaganda, operates at scale, and has been caught multiple times on international social media platforms conducting information operations (IO) in support of the Chinese government. We call these actors “advanced persistent manipulators,” or APMs. This particular APM derives its name through its technique of  laying dormant or obscuring its true intentions by using spam posts as camouflage to avoid social media platforms’ detection systems. 

Spamouflage is undoubtedly one of most well-documented actors engaging in CCP-aligned IO, and continues to proliferate on international platforms—especially Facebook. Our team found a total of 2,009 accounts affiliated with this network: 1,632 on Facebook, 319 on YouTube, and 60 on Twitter. Spamouflage is proving to be the hydra of Chinese IO–when one of its accounts is suspended, two more reappear in its place.

We have observed and manually gathered data on these accounts since January 2021. This report reveals an expansion of Spamouflage’s messaging themes in the last 11 months, as well as a continuation of its past coordinated and inauthentic behaviors. We will explore content of interest first, before delving into Spamouflage’s behavior and network dynamics. 

No hard digital signals have definitively tied Spamouflage to the Chinese government, but it’s clear the APM’s message content and timing in 2021 are in lockstep with that of the Chinese government. To some extent, the question of who is behind the campaigns’ numerous operations is secondary. Knowing who “pressed the enter key” is less important than the implications that a well-known and well-resourced actor continues to spread Chinese propaganda at a high volume on international social media networks. Spamouflage’s content, the timing of its publishing, its promotion of statements from Chinese government officials and Chinese state-owned media (CSM) make it clear the goal is to advance the CCP’s goals. 

Figure 1 Network visualization of a subset of manually gathered Spamouflage accounts on Facebook shows different content focuses for different clusters. Connections represent likes or shares, nodes are pages and accounts. Larger nodes are “seeds,” producing original content amplified by others.

Lots of Bark but Little Bite: Estimating Spamouflage’s Reach

Despite its large number of accounts and high volume of posting, Spamouflage’s content was generally its own biggest amplifier, and appeared to reach only a small audience with the exception of a few posts that were able to achieve greater visibility. On both YouTube and Facebook—where Spamouflage gained the most traction—the true volume of organic engagement remains unclear. On YouTube, Spamouflage assets interact heavily with each other, subscribing to and and commenting on each other’s content. Engagement numbers on all platforms likely contain a sizable number of  bots and click farm operators. Nonetheless, the engagement and scale of these 2021 Spamouflage campaigns point to a  well-resourced, growing, and larger astroturfing effort than previously known.

• Facebook - 1,632 accounts. Pages in this set boast over 161,400 followers and 178,000 likes; individual accounts in this set have a cumulative 74,391 friends. It isn’t possible for open source researchers to determine what portion of these followers/likers/friends are themselves part of the campaign. Several accounts in this set boast over 4,500 followers or friends, suggesting that the campaign either breaks out of its inauthentic  bubble, or that Spamouflage continues to be extremely well-resourced with additional layers of false personas. 

• YouTube - 319 accounts with substantial reach. These channels gathered over 3.6 million views, posted over 7,600 videos, and accumulated over 41,000 subscribers. 

• Twitter - 60 accounts. Twitter accounts in this set had very limited reach. They produced over 1,200 tweets, which garnered over 1,000 likes. Most of the accounts had no followers. One account was following 31 other accounts.

Attribution notes: Overlap with Previous Spamouflage Campaigns

Both in terms of content and behavior, the accounts we have tracked for the past 11 months show heavy overlap with previous Spamouflage tactics, techniques, and procedures (TTPs).  

• Suspicious activity on Facebook pages - Pages in this set used several of the same evasion tactics that previous Spamouflage assets employed. These include page name changes, merging multiple pages to boost followers and likes, Bangladeshi pages changing names and posting in Chinese¹, and page managers in Bangladesh and China, among several others.

• Overlap with previous messaging themes, similar model for messaging dissemination - In addition to new messaging topics such as Xinjiang and Taiwan, clusters in this operation covered all of the same topics from previous Spamouflage campaigns: smearing Hong Kong protestors, painting Chinese dissident-in-exile Guo Wengui in a negative light, commenting on U.S. China relations, promoting China’s vaccine diplomacy, and emphasizing the chaos of the U.S. COVID-19 pandemic response. In addition to these themes having appeared in previous campaigns, the dissemination of each of these topics through dedicated, decentralized clusters aligns with this APM’s previous modus operandi. Clusters will typically message on one dedicated theme (e.g. Hong Kong), and not touch on others. 

• Linguistic overlap / identical content - Referring to Guo Wengui as “瘟龟”  (wēnguī, roughly “diseased turtle,” a near homonym of Guo’s name), idiom and phrasing overlap with previous Spamouflage content. In some cases, different pages would post the exact same content.

• Automated quotes from books once an account is set up - Several accounts in this set initially posted inspirational and spammy quotes in English, Chinese, or both languages. Many of them simply posted lines from an early 20th century novel The Moon and Sixpence, suggesting that accounts were programmatically posting content as bots. This mechanism has also been observed in other Spamouflage operations, such as “Dracula’s Botnet.”

• Use of computer-generated “GAN” imagery for profile photos, repeated use of stock images across profiles  - Computer-generated photos of humans were used for profiles on both Facebook and Twitter. (These photos are often referred to as GANs, an acronym for generative adversarial networks, the algorithm that generates them.) This tactic has been used in several previous campaigns from this actor, as well as several others. Many assets used identical stock profile photos as well. 

• “Seeds and amplifiers” pattern of operation - Assets continued to behave as “self-reinforcing clusters” on YouTube and Facebook commenting on and viewing each other’s videos and posts.

Most Noteworthy Aspects of 2021 Campaigns

Four aspects of Spamouflage’s activity in the past eleven months are worthy of particular attention. 

1. Denying human rights abuses in China’s northwest region of Xinjiang -  Spamouflage has begun actively producing disinformation denying the CCP’s ongoing human rights abuses against the Uyghurs, a Muslim-minority who are being systematically surveilled, put into concentration camps, and subjected to forced labor.

2. Taiwan-focused messaging - This APM has started to aggressively message on Taiwanese politics and cross-Strait relations. This content has aimed to denigrate Taiwan’s ruling Democratic Progressive Party (DPP) and President Tsai Ing-wen; alleged that the West is destabilizing Taiwan; opposed Taiwan’s participation in international organizations such as the World Health Organization (WHO) and United Nations (UN); and criticized U.S. President Joe Biden and U.S. Secretary of State Antony Blinken’s handling of U.S.-Taiwan relations.  

3. Continued CCP-aligned propaganda about the COVID-19 pandemic and vaccines - While Facebook, Twitter, and YouTube removed a Spamouflage operation messaging on this topic in February 2021, a significant portion of accounts remained online and actively spread disinformation on these topics.

4. Political Advertisements - At least two Spamouflage pages ran political advertisements on Facebook, a new technique for this APM. Both pages had over 3,000 followers and ran ads in February or March 2021. One of these ads was taken down for running without a disclaimer. No action appears to have been taken against the additional 16 ads, which also ran without disclaimers and uniformly paint support of the CCP in Hong Kong as “patriotic”.² Both ad-running pages had page managers located in Bangladesh. Facebook’s Ad Library claims all 17 ads had an estimated audience size of over 1 million people, ran without disclaimers, and collectively generated between 24,000 and 35,000 impressions.

Figure 2 One Spamouflage page with managers in Bangladesh and China ran an undisclosed political ad in March 2021.

Figure 3 Another page, 勇者無畏, ran 16 political ads supporting the CCP’s consolidation of power in Hong Kong in February and March 2021. Its page manager was also in Bangladesh.

Figure 4 Spamouflage ad celebrates Apple Daily Owner Jimmy Lai being denied bail in February 2021. The ad had an estimated audience size of over 1 million people, refers to Lai as a “gangster” and an “agent of chaos,” and claims he is “reaping what he has sown.” This political ad ran without a disclaimer, a violation of Facebook’s advertising policy.

Takeaways

It is clear that, while Spamouflage is a known APM, it is still able to proliferate on the world’s most popular social media platforms. In addition, it’s clear that Spamouflage will continue to serve as a messaging weapon to be aimed at the CCP’s target of the day. 

• This CCP-aligned actor is expanding its messaging, in particular with two new issues: denial of forced labor and human rights abuses in Xinjiang and a new focus on U.S.-Taiwan relations. This realignment of messaging priorities aligns with the CCP and CSM’s own. 

• Spamouflage, though a well-known actor with long-established TTPs, continues to proliferate on Facebook and YouTube. Accounts are typically actioned much more quickly on Twitter. Their continued proliferation on these platforms enables them to expand their audience and amplify Chinese government messaging. 

• Spamouflage continues to innovate - revelation of past tactics doesn’t dissuade the entity from continuing to use them. In addition to the use of Bangladeshi accounts, Turkish, Vietnamese, and Arabic-language accounts appear to be amplifying Spamouflage content in certain clusters. 

• Political ads have given Spamouflage a larger reach than before - for the first time, Spamouflage has run political ads on Facebook that have a substantial reach (a potential audience of millions, and tens of thousands of interactions). 

This report gave a general overview of Spamouflage’s 2021 operations on Facebook, YouTube, and Twitter. This week, we’ll be publishing several subsequent reports exploring specific content and themes throughout 2021³.

---

Want more? Read the rest of our Spamouflage Survives series here:

Part 2: Five Ways to Spot a Spamouflage Disinformation Campaign

Part 3: Cotton the Act: Large-Scale Network of CCP-aligned Facebook Accounts Deny Mass Atrocity in China's Xinjiang Province

Part 4: Strait Deception: Spamouflage Spreads Propaganda and Stokes Tensions in Taiwan

Part 5: Spamouflage’s Ill Will: Anatomizing a Two-Year Pandemic Propaganda Campaign

Part 6:Emperor in the Ether: Spamouflage’s Authoritarian Attacks on Democracy and Journalists

1. All references to “Chinese” as a language in this series or reports refer to Mandarin Chinese. Spamouflage also posts in Cantonese, another Chinese language, but we will refer to Cantonese posts as such throughout these pieces.

2. Most of these ads supported Hong Kong government’s February 2021 announcement of a loyalty oath all Hong lawmakers must swear to Beijing. Hong Kong Free Press referred to this oath as “the final nail in democracy’s coffin”.

3. All translations in this six-part series are the work of the author.