Canada targeted in a new Chinese transnational repression campaign linked to ‘Spamouflage’

On this page

• Introduction
• Targets and content
• Tactics, techniques and procedures
  • Background
  • Spamouflage objectives in 2024 to 2025
  • Inauthenticity and coordination
  • Link to the People’s Republic of China
• Implications
  • Impact on targets
  • Gendered disinformation
• Response
• Sample images

Introduction

Rapid Response Mechanism Canada (RRM Canada) has detected a new “Spamouflage” campaign on X, Facebook, TikTok and YouTube that is covertly targeting ten Mandarin Chinese-speaking individuals in Canada. RRM Canada assesses that the campaign began on August 31, 2024, and continues to this day.

On average, the campaign generates 100 to 200 new Spamouflage posts per day. The campaign is nearly identical to one RRM Canada publicly reported on in fall 2023, but is much larger and affects a greater number of Government of Canada (GoC) X accounts.

The current campaign involves sharing doctored videos—or deepfakes—in the comments section of X and Facebook accounts belonging to various government entities and Canadian media outlets. Some of these accounts have seen hundreds of links to deepfakes under a single post. These deepfakes were also uploaded to YouTube and TikTok.

The campaign also involves the operation of a “doxing” website, a tactic whereby malign actors intentionally post personally identifiable information about an individual through social media to harass and threaten them. Nearly 100 X accounts in Canada have been leveraged as channels for this new campaign, including:

• 65 GoC accounts, managed by 35 government departments and agencies, with the most affected X accounts belonging to Global Affairs Canada, Public Safety Canada, Justice Canada, the Canadian Armed Forces, the Royal Canadian Mounted Police and the Canadian Security Intelligence Service (CSIS)
• 20 Canadian media accounts, with the most affected belonging to the Toronto Star, Ottawa Citizen, National Post, True North Canada and CBC/Radio-Canada
• accounts belonging to over a dozen political figures, with the most affected belonging to Prime Minister Justin Trudeau, several ministers and the Leader of the Official Opposition.

Targets and content

The campaign uses deepfakes of a Chinese-speaking online commentator in Canada (Individual 1) who has posted material critical of the People’s Republic of China (PRC) in the past. The deepfakes accuse Canadian officials of criminal and ethical violations, including “corruption,” “sexual scandals” and “election bribery,” as follows:

• Minister of Foreign Affairs Mélanie Joly was involved in an “extramarital affair” with Prime Minister Trudeau^{Footnote 1}
• Prime Minister Trudeau mishandled the return of Michael Kovrig and Michael Spavor, and had former Canadian ambassador to China Guy Saint-Jacques cover up intelligence work carried out by the two Michaels in China^{Footnote 2}
• Prime Minister Trudeau bungled the response to the February 2022 “Freedom Convoy” in Ottawa by entrusting the clear-out of the convoy camp to former Ottawa Police Chief Peter Sloly, who allegedly “kept a mistress and misused his power to amass wealth”^{Footnote 3}
• Canada’s immigration process was thrown into “chaos” due to Prime Minister Trudeau’s incompetence^{Footnote 4}

In parallel, the campaign targets nine other Chinese-speaking online commentators in Canada through a publicly accessible doxing website that OpenAI attributed to Spamouflage in May 2024. These individuals have seen their private information, including their personal phone number, email address and home address, publicly released without their consent. Some of them are facing a barrage of daily harassment on X, including insulting and demeaning language. One of them (Individual 2) has been targeted by dozens of bot-like X accounts posting sexually explicit deepfake photos of them.

On September 16, 2024, Individual 2 tweeted that a series of fake accounts on X had duplicated their profile image and name. The intent behind these fake accounts was likely to make it more difficult for X users to locate the individual’s legitimate profile. Two days later, Individual 2 tweeted that multiple bot-like accounts had shared sexually explicit deepfake images of them, followed by a public release of their personal information, including their home phone number, birth date and passport number, via the above-mentioned public website.

RRM Canada notes that this is the first known instance in which a Spamouflage campaign has used sexually explicit deepfake photos to target an individual in Canada. This suggests a new approach on the part of the campaign operators that is particularly harmful and consequential to women and girls.

Prime Minister Trudeau, Minister Joly and other Canadian public figures are secondary targets.

Tactics, techniques and procedures

Background

Spamouflage (also known as Dragonbridge) is one of the world’s most widely studied foreign information manipulation campaigns. Graphika first reported on Spamouflage in 2019 and has since published half a dozen reports on the subject.^{Footnote 5} Mandiant and the Microsoft Threat Analysis Center have also published widely on Spamouflage.^{Footnote 6} All of these companies have linked the various permutations of Spamouflage to the PRC.

Spamouflage is a tactic that employs a network of new or hijacked social media accounts to post and amplify pro-PRC messaging across multiple social media platforms–including Facebook, X, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn. The word is a portmanteau of “spam” and “camouflage,” and describes the attempt to covertly spread spam-like content and propaganda hidden among more benign, human-interest-style content.

In September 2023, RRM Canada reported on a Spamouflage campaign that leveraged social media accounts of Canadian public figures in order to discredit and denigrate members of the Chinese diaspora in Canada. The 2023 campaign involved hundreds of bot-like accounts on X, YouTube and Facebook spamming members of Parliament with false accusations and deep fake videos of a Mandarin Chinese-speaking online commentator accusing Canadian public figures of engaging in unlawful or unethical behaviour.^{Footnote 7} The same commentator is targeted in the new campaign (Individual 1).

Spamouflage objectives in 2024 to 2025

Like the 2023 campaign, RRM Canada assesses that operators managing the 2024 to 2025 Spamouflage campaign aim to:

• discredit and denigrate targeted individuals, including via compromising deepfakes
• provoke Canadian authorities to investigate Individual 1 through a technique described as “swatting,” a type of cyber harassment in which malign entities generate a law enforcement response against a target under false pretenses
• render the social media accounts of targeted individuals unusable by inhibiting genuine engagement with other social media users

In addition, the Spamouflage 2024-2025 campaign aims to:

• harass and threaten targeted individuals by doxing them and by spreading doctored gendered disinformation about them.

Inauthenticity and coordination

RRM Canada has discovered several indicators suggesting that the campaign’s social media activity is both inauthentic and coordinated, including:

• obvious audio and video distortions indicating that both the videos and explicit photos are fully or partially AI-generated
• AI-generated profile images of some social media accounts
• text with obvious grammatical errors that suggest it was translated with online tools

Link to the People’s Republic of China

RRM Canada has high confidence that the entity carrying out this campaign is the PRC. To make this assessment, analysts used open source research guides from Microsoft,^{Footnote 8} Graphika^{Footnote 9} and Mandiant^{Footnote 10} to help identify whether the activity in question is Spamouflage. In August 2023, Meta’s threat intelligence team linked Spamouflage to “individuals associated with Chinese law enforcement.”^{Footnote 11} RRM Canada has uncovered a number of indicators, such as:

• Some of the tactics, techniques, and procedures used in the campaign to target Individuals 1, 2, 3, and 4 are identical to previous Spamouflage campaigns, including one seen in Canada last year^{Footnote 12}
• Over the past year, Meta and Graphika reported on Spamouflage bot networks targeting the Dalai Lama and candidates in the 2024 US elections.^{Footnote 13} RRM Canada observed remnants of both of those campaigns (i.e. bot accounts that were repurposed following the completion of the Tibet and U.S. campaigns) used to target Individual 1 and Individual 2^{Footnote 14}
• Errors and patterns that are typical of Spamouflage campaigns have appeared in the current campaign, including:
  1. accidental splicing in of Chinese characters;^{Footnote 15}
  2. accounts using “copypasta” techniques (i.e. repeating identical content) to drive two or three narratives across hundreds of posts;^{Footnote 16} and
  3. the use of profile images of celebrity figures in China, such as one account using a photo of Anastasia Cebulska, a Belarusian model working in Zhejiang province.^{Footnote 17}

Implications

Impact on targets

The objective of the campaign is to discredit, denigrate and harass targeted individuals. As such, the campaign is an example of digital transnational repression.

The public figures implicated in the false information spread by the campaign, including the Prime Minister and the Minister of Foreign Affairs, have also been negatively affected. The unconfirmed narratives propagated by the Spamouflage campaigns have the potential to exacerbate polarization in Canadian society.

Social media management teams associated with the GoC, Canadian media and Canadian political figures have also been impacted, as Spamouflage bots may have generated hundreds of daily notifications seeking to goad them into investigating Individual 1.

RRM Canada assesses that the impact of the 2024 to 2025 Spamouflage campaign on the general Canadian public has been minimal, as user engagement (i.e. “likes”, “shares” and “comments”) and impressions (i.e. “views”) have been low. Although the Spamouflage network has produced over 5,000 posts, these have received little public engagement. On X, for example, nearly all posts have recorded 0 or 1 engagements and between 0 and 30 impressions.

Gendered disinformation

Gendered disinformation refers to misogynistic online abuse directed against women and girls, including the use of false or misleading gender and sex-based narratives.

This is the first time RRM Canada has observed Spamouflage operators using generative AI to seed and spread sexually explicit content about a Canada-based individual. It is also the first known instance of Spamouflage operators targeting Minister Joly with gendered disinformation, including a narrative of an extramarital affair appearing under a September 20, 2024, X post from GAC about the Women Foreign Minister’s Meeting in September 2024.^{Footnote 18}

This is not, however, the first time such a technique has been used. Earlier this year, Radio Free Asia reported a similar Spamouflage campaign targeting an Australian journalist with non-consensual, sexually explicit imagery.^{Footnote 19} This new pattern suggests that Spamouflage operators are increasingly comfortable using gendered disinformation, which sets a dangerous precedent for the use of these techniques to target women and girls in the future.

Response

Like the response carried out in 2023, GAC has:

• notified affected parties, including the targeted individuals
• raised concerns with the Chinese embassy in Canada
• engaged relevant social media companies, some of which have since taken steps to remove the deep fakes from their platforms and halt the campaign

Despite these efforts, Spamouflage remains a persistent and recurring global threat that is difficult to eradicate. GAC will continue to monitor for continued signs of this campaign and take steps to stem any such activity.

Sample images

Global Affairs Canada has received permission from Individual 1 to use his personal image.