Memetic Warfare Weekly: Sogou wAIfu Edition
Welcome to Memetic Warfare Weekly.
My name is Ari Ben Am, and I’m the founder of Telemetry Data Labs - a Telegram search engine and analytics platform available at Telemetryapp.io - and Glowstick Intelligence Enablement.
Memetic Warfare Weekly is where I share my opinions on the influence/CTI industry, as well as share the occasional contrarian opinion or practical investigation tip.
Sogou wAIfu
ASPI is back at it again with a very solid report on a Chinese, AI-narrated YouTube content network, available here. The network posts medium-length, AI-narrated YouTube videos on various pro-China topics (primarily but not exclusively tech and geopolitics). Those of you in the space may have come across similar content in the past.
The report is super long, and I’d highly recommend reading it in its entirety. As readers may have noticed, I’ve been a bit busy recently and thus haven’t been able to write hands-on guides or otherwise in-depth content, so bear with me for a little while longer.
We’ll discuss the main points and some of my thoughts then below:
One of the main points to keep in mind is the “spammy” nature of content. While spammy, low-quality content is often considered a leading TTP for specifically Chinese activity (a claim with which I vociferously disagree for multiple reasons), in ASPI’s network it abounds.
The spammy content, though, appears to have its own specific YouTube-centric flavor to it, as shown by the below samples:
Titling videos “Shocking” or “Game Over” or so on is common for clickbait YouTube videos, but (and this isn’t scientific) less so on other platforms. In my opinion, this shows that the operator is aware of the broader YouTube landscape and attempts to fit in.
Let’s refer to a few other points, starting off with investigative methodology.
The methodology section of the report is a good overview of how to carry out investigations from “qualified entities”.
As I’ve discussed in the past here, identified quality disinformation/IO entities and pivoting from there is often the best method to identify networked activity. Quality entities are almost always amplified via coordinated activity, giving us an easy way to spot them.
Twitter is a great platform for this, and that’s how ASPI was able to identify this YouTube network, by pivoting from identified content from a specific account and searching for networked activity:
This leads us to the next important takeaway: networks are always lazy. YouTube is often a difficult platform to investigate without access to internal data and Telemetry, as account and channel information, identifiers and metadata are often unavailable or limited. Content investigation is also challenging due to the fact that content on YouTube is, by definition, video.
Without any other identifiers or connections to domains or entities on other platforms, YouTube channels and accounts are often dead-ends. This leaves investigators with less conclusive and more time-intensive investigative heuristics instead.
Considering the situation, ASPI did a great job by focusing on video design and style/aesthetics, narratives/content and also posting pattern heuristics.
The first heuristic is narrative and content analysis. The report shows a few examples of how network channels posted highly similar content and narratives within a given time frame by running keyword searches:
One of the highlights of this heuristic was the analysis of highly similar video opening sections - not just stylistically similar, but essentially identical sections to the level of font.
A side note: ASPI noted that the network utilized payment platforms such as Patreon, Paypal and Buymeacoffee. These didn’t bring in much money, but do provide the network with a veneer of legitimacy, so I agree with ASPI that the platforms are mainly useful to blend in:
wAIfus:
There’s a fair amount of AI-related content, unsurprisingly. Synthesia has been abused yet again by a network channel:
Here’s where it gets interesting. ASPI found a Sogou-generated avatar used in network videos, stating that “We believe the use of the Sogou avatar we identified to be the first instance of a Chinese company’s AI-generated human being used in an influence operation.”
Certainly a first, but probably not the last. Interesting that the video was unlisted as well.
Narratively, ASPI provides their overview of the network’s narratives in the context of past “Dragonbridge” identified activity regarding rare earth metals:
“the campaign’s focus on promoting narratives that establish China as technologically superior to the US presents detailed arguments on technology topics including semiconductors, rare earths, electric vehicles and infrastructure projects. In addition, it targets, via criticism and disinformation, US technology firms such as Apple and Intel. Chinese state media outlets, Chinese officials and online influencers sometimes publish on these topics in an effort to ‘tell China’s story well’ (讲好中国故事).3 A few Chinese state-backed inauthentic information operations have touched on rare earths and semiconductors, but never in depth or by combining multiple narratives in one campaign package. The broader set of topics and opinions in this campaign may demonstrate greater alignment with the known behaviour of Russia-linked threat actors.”
The author was kind enough to list the main few narratives (nothing new here to those who follow the space).
Lastly, attribution. The report’s most likely attribution, available below, is the most probable, but it was nice that ASPI included other possibilities, even if much less likely.
Get Help, Vladimir
For other similar and interesting TTPs regarding videos, take a look at Microsoft’s report from about three weeks ago, available here. The update itself is great, short and relevant so take a look at it!
The highlight though, was the use of “Cameo” to get celebrities to make videos calling on “someone called “Vladimir”” to “seek help” for substance abuse. These videos were then edited and modified to advance pro-Russia and anti-Ukraine claims regarding Zelensky’s alleged (and presumably false) alcoholism.
To be honest, this is the kind of malign IO content that I respect. Why not pay a few hundred bucks to have celebrities do your work for you, especially one utilizing some pretty big names like Elijah Wood. The fact that the actress that played Meredith in the Office is in this holding a bottle of Jameson just completes the picture.
That’s it for this week!