China-Linked Internet Trolls Try Fueling Divisions in U.S. Midterms, Researchers Say

It didn’t appear the group was attempting to support or damage any one candidate or political party, unlike prior campaigns linked to Moscow and Tehran, researchers said.

“What we are witnessing is the beginning of the capability that is going to continue to be getting better,” said Sandra Joyce, head of global intelligence at Mandiant, a cybersecurity arm of Google that published details of its findings on Wednesday. The report said the group had previously been observed focusing on undermining pro-democracy protests in Hong Kong and pushing narratives around racial strife in the U.S.

The Chinese government has broadly denied targeting the U.S. with online influence campaigns or disinformation. Representatives at the Chinese embassies in London and Washington didn’t respond to requests for comment.

Accounts linked to the group, which Mandiant has dubbed Dragonbridge, have attempted to cast doubt on the integrity of the American electoral process. For example, an English-language video shared across multiple social platforms last month sought to discourage voting in the midterms by questioning the utility of representative democracy.

“The solution to America’s ills is not to vote for someone,” the video said, urging instead that people “root out this ineffective and incapacitated system.”

At other times, the group sought to highlight mentions of “civil war” on social media and instances of politically motivated violence in the U.S.

While the campaign so far has gained little traction, Ms. Joyce said it was important to expose it before the perpetrators find more success.

“What we don’t want to do is wait until you can’t tell the difference,” she said.

Mandiant didn’t directly attribute the online campaign to the Chinese government because of a lack of definitive technical evidence. But the researchers noted the campaign consisted almost entirely of content promoting Chinese interests. The group was also well funded, operating simultaneously across dozens of internet platforms and several languages—including English, Chinese, German, Spanish, Malay and others.

Last month,

Meta Platforms Inc.

said it had removed an influence operation of Chinese origin that ran across Facebook, Instagram and other platforms and for the first time focused on American domestic politics ahead of an election.

The leaders of Russia and Iran ordered their governments to attempt to influence U.S. voters’ choices in the 2020 presidential election and undermine the public’s faith in American democracy, according to a U.S. intelligence assessment released early last year. The intelligence assessment said China also considered interfering but ultimately refrained because neither candidate appeared sufficiently favorable to Beijing that it would risk being caught by the U.S.

U.S. intelligence agencies and security researchers have observed more active Chinese online-influence operations since then—on topics including the Covid-19 pandemic and racism against Asian Americans—as threat groups have been seen operating in ways that increasingly seem to mirror previous efforts sponsored by the Kremlin, according to people familiar with the matter. The Office of the Director of National Intelligence declined to comment.

Top U.S. security officials have warned publicly in recent weeks that the midterms face an array of challenges, including domestic and international disinformation campaigns and a risk of physical violence and voter intimidation.

The Biden administration hasn’t seen foreign actors specifically target U.S. election systems with cyber operations this year, officials have said. An early October bulletin from the Federal Bureau of Investigation and Department of Homeland Security said potential malicious cyber activity was unlikely to disrupt or prevent voting.

The Mandiant report said Dragonbridge separately began spreading a narrative earlier this month that the U.S. had secretly bombed the Nord Stream gas pipelines to benefit itself and harm its European allies. Investigators aren’t sure what caused the pipeline damage but Western officials widely suspect Russian sabotage.

In another campaign, Dragonbridge attempted to pose as an online persona that has exposed Chinese hacking operations in an effort to pin hacks on the U.S. government instead, Mandiant said.

Of all the operations, researchers said the targeting of the midterms was the most troubling.

“They are trying to push out the narrative that voting doesn’t matter,” Ms. Joyce said. “It has a very, very clear message trying to shake the foundation of democracy.”

Write to Dustin Volz at [email protected]