Pro-China influence campaign allegedly financed staged protests in Washington

A new Chinese influence campaign used newswire services, staged protests, and billboard ads to spread pro-Beijing propaganda in the U.S., cybersecurity researchers said Monday.

The campaign is allegedly tied to Shanghai-based marketing firm Haixun, which was associated with an earlier influence campaign that involved dozens of fake news websites, according to a report by cybersecurity firm Mandiant.

Haixun is a private company, but it has Chinese police and government agencies among its clients. It's not clear if the Chinese state is funding the new campaign, but it aligns with and supports the Chinese Communist Party’s agenda, researchers said.

Haixun was associated with a campaign known as HaiEnergy, uncovered by Mandiant in 2022. As part of this campaign, Haixun supposedly ran 72 fake news sites worldwide, posing as independent news outlets while actually spreading content “strategically aligned with the political interests of China.”

This year, Haixun took things to the next level by using newswire services to spread pro-China content to legitimate news outlets based in the U.S. They're also suspected of organizing in-person protests in Washington to gain media coverage, as well as displaying pro-China messages on a billboard in the heart of New York City's Times Square, according to Mandiant, which is owned by Google.

Although Haixun’s campaigns go to great lengths to spread propaganda, their impact is questionable, researchers said. The pro-China influence campaigns tracked by Mandiant haven't gained much traction with real users and mostly seem to circulate "within their own echo chambers."

However, it seems these threat actors aren't giving up. In light of their previous unimpressive results, they are now exploring new tactics to expand their reach.

Newswire services

To get articles into news subdomains of at least 32 legitimate U.S. media websites, including the Pittsburgh Post News-Gazette and the Arizona Republic, Haixun used newswire distribution services operated by FinancialContent, a California-based company that publishes financial data and news online.

Imagine reading this propaganda screed posted on the website of the venerable Pittsburgh Post News Gazette. Are you going to realize this is not newspaper content? What a boon for this actor. Publishing their message under a trusted American masthead! 3/x pic.twitter.com/AhAVxSHPve

— John Hultquist (@JohnHultquist) July 24, 2023

Some of the articles that were published by FinancialContent and other newswire services associated with Haixun criticized then-House Speaker Nancy Pelosi's visit to Taiwan, along with U.S. human rights policy and press freedom.

Haixun allegedly used Fiverr, a marketplace for freelance services, to hire people who can promote content that aligns with China's political narratives and shared links to published articles. Mandiant also identified a network of fake accounts on Twitter promoting HaiEnergy-linked articles.

Haixun and FinancialContent did not immediately respond to a request for comment.

Staged protests

Mandiant found evidence that the HaiEnergy campaign may have also financed at least two staged in-person protests in Washington, D.C.

Both protests, which took place in June and September 2022, were captured on video and later used as source material to back up narratives published by media connected to HaiEnergy.

The first protest supposedly aimed to raise awareness about restrictions on religious freedom during the 2022 International Religious Freedom Summit. The second protest was allegedly staged in response to the U.S. government's decision in June 2022 to ban all goods produced in China's Xinjiang region due to reported human rights abuses against the Uyghur population.

Mandiant doesn't have direct evidence that Haixun paid the people in the protest videos, but it's highly probable that the protests were orchestrated on behalf of a third party, researchers said.

According to Mandiant, the potential financing of at least two staged protests represents a major escalation in the tactics and techniques used by this campaign. It also indicates that “the campaign is expanding its tactics to maximize potential impact.”