Security

China’s Spamouflage cranks up trolling of US Senator Rubio as election day looms

Note to Xi: Marco and Ted Cruz aren't the same person


China's Spamouflage disinformation crew has been targeting US Senator Marco Rubio (R-Florida) with its fake news campaigns over the past couple of months, trolling the Republican lawmaker's official X account and posting negative stories about Rubio on Reddit and Medium.

This is according to Clemson University researchers Darren Linvill and Patrick Warren, who note that this isn't the first time that the Beijing-linked trolls have set their sights on Rubio. And if the 2022 election is any indication, we can expect a flood of content about the "unhinged" senator from Florida on November 5.

Spamouflage, also tracked as "Dragonbridge," is the prolific, pro-People's Republic of China propaganda group that has been spreading fake news about American politics and politicians during the last two election cycles

Since 2023, they've also upped their deepfake game, which now includes phony videos on X and TikTok purporting to be posted by American patriots in "more aggressive" attempts to influence the upcoming presidential election.

In research published this month, Clemson University's Media Forensics Hub says the PRC-backed attacks on Rubio began in 2022 during his reelection campaign, and spiked on election day with negative articles across Medium, Tumbig, Pixiv, and Reddit, along with more than 20,000 messages posted on X from at least 6,500 accounts "almost entirely on election day morning." [PDF]

The fake news articles called Rubio "unhinged," and attempted to play up supposed feuds between former President Donald Trump and Rubio. But they made some major mistakes that were likely noticed by anyone who follows American politics. 

Essentially, these "news stories" were cut-and-paste jobs from content originally referring to tensions between Trump and US Senator Ted Cruz (R-TX), the academics note. Specifically, the content referred to Rubio as a senator from Texas and referenced events about Cruz, including stories about Cruz's wife, Heidi. 

Following his landslide reelection in November 2022, Spamouflage appeared to hit pause on the Rubio disinfo. But then it picked up again "in recent months." For these 2024 attacks, the trolls primarily used X accounts, including 82 "low-quality" ones that appeared in mid-September with negative replies to Rubio's official X account.

Others, Xeets, however, likely from hacked accounts that had been taken over by Spamouflage, shared images and paragraphs denigrating the lawmaker from Florida. 

Additionally, the crew again used Medium to amplify false narratives about the politician. This time, however, content posted via "hacked accounts was much higher quality than what was employed in 2022, though the bar here is low," Linvill and Warren wrote. 

"The September narrative content does, at least, seem to be originally written about Rubio and not another candidate," the duo said. "It is possible the content was written using a large language model less easily accessible in 2022."

While the fake news that Spamouflage continues to spew about Rubio - and any other American politicians, for that matter - is still pretty pathetic, the broader implications could have serious ramifications for the political process, the researchers noted.

Rubio is a vocal critic of China, and Spamouflage's primary goal appears to be undermining anyone who speaks out against the PRC's interests and goals. 

"Given how Rubio has recurred as a target and the nature of some of what we have identified here, it may be that accounts targeting him are employed to test new tactics before they are applied more broadly," the academics warn. "That may mean that Rubio is the proverbial canary in the coal mine and a warning of at least some things to come."

Plus, the report comes as the FBI and US Cybersecurity and Infrastructure Security Agency (CISA) issue another PSA about tactics that foreign trolls use to spread disinformation in the lead-up to the 2024 general election.

While this most recent warning from the feds specifically calls out Russian and Iranian influence operations, CISA and the FBI have previously taken China to task for these same types of campaigns that have the "goal of casting doubt on the integrity of the democratic process and sowing partisan discord." ®

Send us news
8 Comments

US reportedly mulls TP-Link router ban over national security risk

It could end up like Huawei -Trump's gonna get ya, get ya, get ya

How Chinese insiders are stealing data scooped up by President Xi's national surveillance system

'It's a double-edged sword,' security researchers tell The Reg

Blocking Chinese spies from intercepting calls? There ought to be a law

Sen. Wyden blasts FCC's 'failure' amid Salt Typhoon hacks

How Androxgh0st rose from Mozi's ashes to become 'most prevalent malware'

Botnet's operators 'driven by similar interests as that of the Chinese state'

US names Chinese national it alleges was behind 2020 attack on Sophos firewalls

Also sanctions his employer – an outfit called Sichuan Silence linked to Ragnarok ransomware

China's Salt Typhoon recorded top American officials' calls, says White House

No word yet on who was snooped on. Any bets?

T-Mobile US CSO: Spies jumped from one telco to another in a way 'I've not seen in my career'

Security chief talks to El Reg as Feds urge everyone to use encrypted chat

Microsoft: Another Chinese cyberspy crew targeting US critical orgs 'as of yesterday'

Redmond threat intel maven talks explains this persistent pain to The Reg

Telco security is a dumpster fire and everyone's getting burned

The politics of cybersecurity are too important to be left to the politicians

Trump administration wants to go on cyber offensive against China

The US has never attacked Chinese critical infrastructure before, right?

China gorging on silicon before Uncle Sam slams the door

Chip imports up more than 14% this year in anticipation of fresh restrictions

China preps another rocket that Beijing hopes will become its workhorse

Long March-8A improves payload by forty percent and comes just a month after Long March 12 debut