# TAG Bulletin: Q1 2023 **blog.google/threat-analysis-group/tag-bulletin-q1-2023/** Shane Huntley May 1, 2023 Threat Analysis Group This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 2023. It was last updated on April 27, 2023. ## January We blocked 2 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to individuals from Poland. The campaign was sharing content in Polish that was supportive of Russia and critical of the United States and Ukraine. We received leads from Mandiant, which is now part of Google Cloud, that supported us in this investigation. We terminated 87 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of the Wagner Group and Russia’s performance in the war in Ukraine. We terminated 7 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to actors tied to Russian intelligence and was sharing content in Russian that was supportive of the Russian government, the war in Ukraine, and the quality of daily life in Russia for the average Russian citizen. We terminated 4 YouTube channels as part of our investigation into coordinated influence operations. The campaign was sharing content in German that was critical of Ukrainian refugees. We terminated 40 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Persian, English, Hindi and Urdu that was supportive of the Iranian government and critical of protesters in Iran. We received leads from Graphika that supported us in this investigation. We terminated 1,088 YouTube channels as part of our investigation into coordinated influence operations linked to Azerbaijan. The campaign was sharing content in Azerbaijani that was supportive of Azerbaijan and critical of Armenia and critics of the Azerbaijani government. ----- We terminated 6,285 YouTube channels and 52 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels and blogs mostly uploaded spammy content in Chinese about music, entertainment and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports. ## February We terminated 207 YouTube channels and 10 Blogger blogs as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian and English that was supportive of Russia and Russia’s invasion of Ukraine. We terminated 193 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine, NATO, and the West. We terminated 15 YouTube channels, 10 Blogger blogs, and blocked 7 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Albania. The campaign was linked to the France and Albania-based National Council of Resistance of Iran (NCRI) and was sharing content in Persian, Pashto and English that was supportive of the People's Mujahedin Organization of Iran (MEK) and critical of the Iranian government. We received leads from LinkedIn that supported us in this investigation. We terminated 4,787 YouTube channels and 14 Blogger blogs as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment, and lifestyle. A very small subset uploaded content in Chinese and English about China, Taiwan, and U.S. foreign affairs. These findings are consistent with our previous reports. We received leads from LinkedIn that supported us in this investigation. ## March We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was sharing content in Russian and English of prank calls targeting Polish and Ukrainian government officials. We terminated 320 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to a Russian consulting firm and was sharing content in Russian that was supportive of Russia and Russian President Vladimir Putin and critical of Ukraine, NATO and the West. We terminated 112 YouTube channels as part of our investigation into coordinated influence operations linked to Russia. The campaign was linked to the Internet Research Agency (IRA) and was sharing content in Russian that was supportive of Russia and critical of Ukraine ----- We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Israel. The campaign was sharing content in English that focused on promoting or denigrating specific individuals. We terminated 10 YouTube channels and 4 Ads accounts as part of our investigation into coordinated influence operations linked to Venezuela. The campaign was sharing content in Spanish that was supportive of Venezuelan President Nicolás Maduro Moros. We terminated 21 YouTube channels, 2 AdSense accounts and 2 Blogger blogs as part of our investigation into coordinated influence operations linked to Nigeria. The campaign was sharing content in English that was supportive of the Indigenous People of Biafra (IPOB) movement and critical of voting and democratic processes in Nigeria. We terminated 6,930 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to China. These channels mostly uploaded spammy content in Chinese about music, entertainment and lifestyle. A very small subset uploaded content in Chinese and English about China and U.S. foreign affairs. These findings are consistent with our previous reports. POSTED IN: [Threat Analysis Group](https://blog.google/threat-analysis-group/%20) Related stories Threat Analysis Group **Ukraine remains Russia’s biggest cyber focus in 2023** Google's Threat Analysis Group shares first quarter cyber updates on the threat landscape from the war in Ukraine. By Billy Leonard Apr 19, 2023 Threat Analysis Group **How we’re protecting users from government-backed attacks from North Korea** Google's Threat Analysis Group shares information on ARCHIPELAGO as well as the work to stop government-backed attackers. By Adam Weidemann Apr 05, 2023 ----- Threat Analysis Group **Spyware vendors use 0-days and n-days against popular platforms** Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has… By Clement Lecigne Mar 29, 2023 Threat Analysis Group **Magniber ransomware actors used a variant of Microsoft SmartScreen bypass** New research from Threat Analysis Group on Magniber's exploitation of Microsoft 0day vulnerability. By Benoit Sevens Mar 14, 2023 Threat Analysis Group **Fog of war: how the Ukraine conflict transformed the cyber threat landscape** By Shane Huntley Feb 16, 2023 ----- Threat Analysis Group **Over 50,000 instances of DRAGONBRIDGE activity disrupted in 2022** An update on TAG's work to disrupt the information operation network DRAGONBRIDGE. By Zak Butler Jonas Taege Jan 26, 2023 . -----