{ "id": "37f11d5a-2a3f-4514-bccb-089a578ab6b7", "created_at": "2026-04-06T00:16:21.899709Z", "updated_at": "2026-04-10T03:31:42.491918Z", "deleted_at": null, "sha1_hash": "cfe30d21b9b9593b437ae4c7dbbf72ae48c2a339", "title": "Over 50,000 instances of DRAGONBRIDGE activity disrupted in 2022", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 47594, "plain_text": "Over 50,000 instances of DRAGONBRIDGE activity disrupted in\r\n2022\r\nBy Zak Butler\r\nPublished: 2023-01-26 · Archived: 2026-04-05 16:55:45 UTC\r\nAn update on the information operation network of spammy influence content across multiple platforms — and\r\nTAG's ongoing work to track and disrupt.\r\nJ\r\nJonas Taege\r\nThreat Analysis Group\r\nThreat Analysis Group’s (TAG) mission is to understand and counter serious threats, including actors engaged in\r\ncoordinated information operations (IO). Today, in connection with the release of the TAG Bulletin, we are\r\nsharing year-in-review insights for 2022 about DRAGONBRIDGE, the most prolific IO actor TAG tracks.\r\nDRAGONBRIDGE, also known as “Spamouflage Dragon,” is a spammy influence network linked to China that\r\nhas a presence across multiple platforms.\r\nMost DRAGONBRIDGE activity is low quality content without a political message, populated across many\r\nchannels and blogs. However, a small fraction of DRAGONBRIDGE accounts also post about current events with\r\nmessaging that pushes pro-China views. DRAGONBRIDGE narratives in 2022 spanned a wide range of news\r\ntopics — ranging from China’s Covid-19 response to the war in Ukraine — and included a higher volume of\r\ncontent critical of the US. The actor has primarily targeted Chinese speakers, but some narratives were in English\r\nand other languages.\r\nIn 2022, Google disrupted over 50,000 instances of DRAGONBRIDGE activity across YouTube, Blogger, and\r\nAdSense, reflecting our continued focus on this actor and success in scaling our detection efforts across Google\r\nproducts. We have terminated over 100,000 DRAGONBRIDGE accounts in the IO network’s lifetime. Despite\r\ntheir scale and profuse content production, DRAGONBRIDGE achieved practically no organic engagement from\r\nreal viewers — in 2022, the majority of DRAGONBRIDGE channels had 0 subscribers when Google disrupted\r\nthem, and over 80% of DRAGONBRIDGE videos had fewer than 100 views. Engagement for\r\nDRAGONBRIDGE’s blogs on Blogger was also low, with nearly 95% receiving 10 or fewer views for blogs\r\nterminated in December.\r\nDRAGONBRIDGE is the most prolific IO actor Google enforced against in 2022\r\nWhile DRAGONBRIDGE has not attracted an organic audience, they are persistent and adaptable. Since TAG\r\nstarted tracking the network in 2019, DRAGONBRIDGE has consistently experimented with new tactics, new\r\nformats and higher quality content. As they evolve over time, DRAGONBRIDGE’s coordinated inauthentic\r\nactivity may eventually attract the attention of real users. For this reason, TAG and Mandiant track\r\nhttps://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/\r\nPage 1 of 4\n\nDRAGONBRIDGE closely and Google has taken an aggressive approach to identifying and removing their\r\ncontent.\r\nContent without an audience\r\nIn 2022, the overwhelming majority of DRAGONBRIDGE content Google disrupted never reached a real\r\naudience. Among the 53,177 channels we disabled in 2022, 58% had zero subscribers and 42% of their videos had\r\nzero views. 83% of those videos had fewer than 100 views.\r\nNumber of views among disabled DRAGONBRIDGE YouTube channels\r\nIn the rare cases where DRAGONBRIDGE content did receive engagement, it was almost entirely inauthentic,\r\ncoming from other DRAGONBRIDGE accounts and not from genuine users. Comment activity was mostly from\r\nother DRAGONBRIDGE accounts.\r\nBlogger engagement metrics also show almost no authentic audience for DRAGONBRIDGE’s blogs. For blogs\r\nterminated in December, nearly 95% of DRAGONBRIDGE blogs received 10 or fewer views, and over 96%\r\nreceived no comments.\r\nNumber of views and comments on DRAGONBRIDGE blogs on Blogger disabled in December 2022\r\nLow quality and spammy\r\nA feature of DRAGONBRIDGE – and likely a contributing reason they have not gained an organic audience on\r\nYouTube and Blogger – is the low quality of their content, especially in English. Most of their posts are spammy,\r\nnonsensical material without an overt political message — often clips of animals, landscapes, food, sports and\r\nother content. Blurry visuals, garbled audio, poor translations, malapropisms, and mispronunciations are also\r\ncommon. The content is often hastily produced and error-prone — for example, neglecting to remove Lorem\r\nIpsum text from a video.\r\nDRAGONBRIDGE video content with “Lorem Ipsum” placeholder text\r\nPro-China narratives and increased criticism of the US\r\nA small fraction of DRAGONBRIDGE channels and blogs post on current events, promoting pro-China messages\r\nand criticizing the US. In 2022, DRAGONBRIDGE increased focus on and sharpened their criticism of the US\r\nwith posts mostly in Mandarin, in English and other languages.\r\nDRAGONBRIDGE’s pro-China content included narratives praising China’s pandemic response, criticism of pro-democracy protests, and significantly in 2022, more strident support for unification with Taiwan.\r\nWe saw an increase in DRAGONBRIDGE activity amidst heightened cross-strait developments. Following the\r\nannouncement of a possible visit to Taipei by then US House Speaker Nancy Pelosi in late July,\r\nDRAGONBRIDGE shifted some of its focus towards criticism of Speaker Pelosi, along with her family and\r\nfinances. This was in line with usual DRAGONBRIDGE patterns of attempting to discredit US political\r\nleadership.\r\nhttps://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/\r\nPage 2 of 4\n\nHowever, during and after the Chinese People’s Liberation Army’s (PLA) military drills straddling Taiwan in early\r\nAugust, DRAGONBRIDGE sharply escalated its rhetoric, uploading militaristic videos of the PLA and political\r\nvideos calling for Taiwanese President Tsai Ing-Wen and her political allies to “surrender,” moving away from\r\ncriticism of Speaker Pelosi. DRAGONBRIDGE displayed unusually coherent behavior in using uniform hashtags\r\nand titles across channels, while swiftly and repeatedly uploading topical, high-production-value content that was\r\nnot interspersed with the usual misdirecting spam. The pace and manner of this pivot highlighted\r\nDRAGONBRIDGE’s additional sensitivity to geopolitical developments in China’s immediate neighborhood, and\r\nTaiwan in particular.\r\nDragonbridge uploaded militaristic videos timed to coincide with large-scale PLA military drills straddling Taiwan\r\nIn 2022, DRAGONBRIDGE also posted narratives claiming the US was responsible for stoking tensions abroad\r\nand meddling in the domestic affairs of other countries. DRAGONBRIDGE’s US-focused narratives portrayed US\r\nsociety and democracy in a negative light, cycling through political and social narratives that evolved with the\r\nheadlines. In 2022, Google removed DRAGONBRIDGE content on topics such as US Covid-19 response, racial\r\ninequality, political divisions, inflation, and other controversial topics.\r\nIn the leadup to the 2022 US midterm elections, Google terminated channels where DRAGONBRIDGE attempted\r\nto spread narratives highlighting US political divisions, potential for political violence, and threats to democracy.\r\nThey presented election narratives as if they were short news clips. One video, previously reported by Mandiant,\r\nattempted to cast voting in the US as ineffective and a waste of time.\r\nBulk account infrastructure\r\nTo post their spam and IO content, DRAGONBRIDGE manages infrastructure consisting of thousands of\r\naccounts at any given time. Google has terminated 100,960 accounts associated with DRAGONBRIDGE over the\r\nnetwork’s lifetime.\r\nRather than build their account infrastructure themselves, DRAGONBRIDGE obtains Google Accounts from bulk\r\naccount sellers who create and sell accounts for profit. We have seen DRAGONBRIDGE reuse accounts that were\r\npreviously used for financially motivated activity, then went dormant before they resumed activity and posted\r\nDRAGONBRIDGE videos and blogs. We believe accounts like this are changing hands from other bad actors to\r\nDRAGONBRIDGE.\r\nEvolving tactics and experimentation\r\nDRAGONBRIDGE regularly experiments with new tactics, including producing a small number of channels with\r\nhigh quality, bespoke content. These evolving tactics underscore DRAGONBRIDGE’s willingness to experiment\r\nand their persistence. Tactics we saw DRAGONBRIDGE test include:\r\nHigh quality content with real human voice narration instead of a machine generated voice\r\nTalk show format with a real person on-camera discussing events in a “news like” format\r\nAnimated political cartoons\r\nIO content mixed in with high quality apolitical content, such as beauty advice and cooking tips\r\nhttps://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/\r\nPage 3 of 4\n\nConclusion\r\nDespite their failure to gain traction with an authentic audience, DRAGONBRIDGE generates high volumes of\r\ncontent across multiple platforms, is persistent and continues to experiment in their tactics and techniques. That is\r\nwhy we have scaled our efforts to disrupt DRAGONBRIDGE coordinated inauthentic activity on our platforms.\r\nWe encourage others in the community to continue tracking this actor and shedding light on their operations and\r\nwould like to thank Mandiant and Graphika for their partnership in countering DRAGONBRIDGE activity.\r\nSource: https://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/\r\nhttps://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "MISPGALAXY" ], "references": [ "https://blog.google/threat-analysis-group/over-50000-instances-of-dragonbridge-activity-disrupted-in-2022/" ], "report_names": [ "over-50000-instances-of-dragonbridge-activity-disrupted-in-2022" ], "threat_actors": [ { "id": "a90ae795-3c01-4419-8365-07b68df72661", "created_at": "2024-07-02T02:00:04.158227Z", "updated_at": "2026-04-10T02:00:03.668289Z", "deleted_at": null, "main_name": "Dragonbridge", "aliases": [ "Spamouflage Dragon" ], "source_name": "MISPGALAXY:Dragonbridge", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434581, "ts_updated_at": 1775791902, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/cfe30d21b9b9593b437ae4c7dbbf72ae48c2a339.pdf", "text": "https://archive.orkl.eu/cfe30d21b9b9593b437ae4c7dbbf72ae48c2a339.txt", "img": "https://archive.orkl.eu/cfe30d21b9b9593b437ae4c7dbbf72ae48c2a339.jpg" } }