Glass Onion

Key Findings

• Graphika has uncovered a network of 43 domains and 37 subdomains that pushed pro-China messaging while posing as the New York Times, the Guardian, the Wall Street Journal, and other legitimate media outlets.
• We identified technical links connecting this network to two Chinese companies that Google’s threat analysis group previously determined ran a pro-China campaign dubbed HaiEnergy. The tactics, techniques, and procedures (TTPs) used by the network closely resemble HaiEnergy and similar activity sets, including Paperwall, DuringBridge, and BayBridge.
• These domains and subdomains hosted advertisements, Chinese state media content, and pro-Communist Party of China (CPC) messaging pulled from external websites. We linked the hosted content to 30 Chinese companies and three Chinese individuals involved in public relations (PR) and digital marketing.
• We identified evidence that these companies and/or individuals leveraged these domains in contracts to promote the activities undertaken by CPC-linked entities. It is unclear whether these entities were aware that the promotion involved domains that spoofed English -and Chinese-language media outlets.
• The domains copied specific design elements directly from the websites of legitimate outlets in an effort to make their impersonation more convincing. Many also shared the same content management system (CMS) template.
• After Chinese marketing and PR firms placed content on the spoofed websites, the likely clients often promoted the material on Chinese platforms and websites, claiming it as evidence that influential news outlets had covered their company.
• On Western platforms, Spamouflage-linked accounts amplified content from these domains, demonstrating overlaps between the Chinese influence operation and this ecosystem of Chinese PR and marketing companies.