Dragonbridge’s influence campaign tried to shift blame by creating fake Intrusion Truth posts. A mysterious, pseudonymous account on Twitter, Intrusion Truth has published previously evidence linking several hacking campaigns to China including APT41. Instead, the fake Intrusion Truth posts falsely link APT41 with US hackers. Dragonbridge created a fake version of an article published in Hong Kong’s news agency. Sing Tao Daily The US government should be held responsible for APT41’s actions.
In a more timely example of Dragonbridge’s disinformation operations, it also sought to blame the destructive sabotage of the Nord Stream natural gas pipeline—a key piece of infrastructure connecting European countries to Russian gas sources—on the United States. Mandiant said that the claim, echoing statements made by Russian president Vladimir Putin, and Russian disinformation source, is part of a wider campaign intended to cause divisions among America’s allies and those who have sanctioned and opposed Russia’s devastation in Ukraine.
Mandiant stresses that none of these campaigns was especially successful. According to the company, most posts only received single-digit comments, likes, and retweets. Its fake tweets impersonating Intrusion Truth show no engagement. Hultquist warned that Dragonbridge is showing a new interest, possibly even from China, in aggressive disinformation. Given China’s cyber intrusions all over the globe, Hultquist is concerned that Chinese future disinformation campaigns could include hack-and leak operations that combine real revelations with disinformation campaigns. This was similar to what Russia’s GRU military Intelligence Agency has done. “If they get their hands on some real information from a hacking operation,” Hultquist says, “that’s where they become especially dangerous.”
Hultquist claims that Dragonbridge occasionally uses pro-Russian language, but Hultquist also says Mandiant doesn’t doubt the group’s pro China focus. Hultquist first saw Dragonbridge engage in a faux grassroots campaign in 2019 to denigrate Hong Kong’s pro democracy protestors. The group was seen posing as Americans to protest US-based rare-earth mining firms that were competing with Chinese companies earlier this year.
Dragonbridge campaigns don’t necessarily represent the work of a Chinese government agency. Hultquist states that they could be located at most in China. “It’s hard to imagine their activity, in its totality, being in any other country’s interest,” says Hultquist.
Dragonbridge working in China may represent a new phase for China’s use disinformation. China is known for its reluctance to engage in influence operations. A Director of National Intelligence report on foreign threats to the 2020 election declassified last year stated that China “considered but did not deploy influence efforts designed to change the outcome of the US Presidential election.” But just last month Facebook, too, says it spotted and removed campaigns of Chinese political disinformation posted to the platform from mid-2021 to September 2022, though it didn’t say if the campaigns were linked to Dragonbridge.
Although Dragonbridge has been around for a long time, the new effort to meddle in elections seems remarkably amateurish, according to Thomas Rid (a Johns Hopkins professor of strategic Studies and author of A History of Disinformation). Active Measures. He points to abstract phrases, like its call to “root out this ineffective and incapacitated system.” That kind of dull language fails to effectively exploit real wedge issues to exacerbate existing divisions in US society—often best identified by local agents on the ground. “It seems like they didn’t read the manual,” Rid says. “It seems like a remote, amateurish affair done from Beijing.”
Rid and Mandiant’s Hultquist both agree Dragonbridge’s failures shouldn’t be interpreted as evidence of Americans’ increasing immunity to manipulation operations. According to them, the US may not be able to tell fact from fiction due the deep political divisions within its society. “Authoritative sources are no longer trusted,” says Hultquist. “I’m not sure that we’re in a great place right now, as a country, to digest that some major information operation is attributable to a foreign power.”