Analyzing Chinese Information Operations with Threat Intelligence

This year, Chinese Information Operations (InfoOps) on social media platforms have received unprecedented attention across the globe. In major events such as the Hong Kong protest, the COVID-19 pandemic, and the U.S. presidential elections, the Chinese threat actors have weaponized social media to shape narratives and manipulate online users for the strategic interest of the People's Republic of China. TeamT5 Inc., as a cybersecurity firm based in Taiwan, has been investigating Chinese InfoOps since 2016. By adopting the mindset of threat intelligence, we have managed to illustrate the Chinese InfoOps threat landscape as well as identify threat actors emerging across social media. In this presentation, we will share trends in Chinese InfoOps which we observed this year. First, we will demonstrate the overt operations launched by the state media, embassies, and diplomats, which involve the propagation of conspiracy theories and disinformation, as well as the mobilization of patriotic netizens (a.k.a Little Pink) to conduct verbal attack or doxxing against dissidents. Then, we look into the covert operations, which can be observed in pro-China Facebook pages, content farms, and spam botnet. More importantly, we believe advanced persistent threat (APT) actors might have entered the InfoOps threat landscape. APT actors, typically a state-sponsored hacker group, usually conduct prolonged and targeted cyberattacks to mine highly sensitive data. However, in 2020 mid-July, we identified an InfoOp targeting Taiwanese authorities that can be linked to a notorious Chinese APT group which our intelligence team has tracked for years. We assess this is a targeted social media campaign spreading disinformation based on highly confidential data, and it could be used against other countries and cause distrust and chaos in democratic societies. Due to threat actors' fast-evolving tactics and social media's fast-changing nature, it is often difficult to identify the threat actors before they cause widespread disinformation. In this case, threat intelligence can help to combat the issue by providing better understanding and instant insights into actor methodologies and exposing potential risks.

Che Chang, Cyber Threat Analyst, TeamT5
Silvia Yeh @silvia_yeh, Cyber Threat Analyst, TeamT5

View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at http://www.sans.org/u/195g
#CTISummit #cyberthreatintelligence