[Interactive] A glimpse inside a Chinese influence campaign: How bogus news websites blur the line between true and false

In November of 2023, a joint team comprised of the South Korean intelligence agency and four cybersecurity firms revealed a dark corner of the web that few would have believed existed: an alleged Chinese influence campaign involving more than three dozen fake websites disguised to resemble South Korean news publications.

The National Cyber Security Center (NCSC) cyber threat analysis team traced the origin of these sites to two Chinese marketing firms and one newswire service, discovering that these entities were attempting to spread misleading articles through their media channels. From the names of the publications to the articles they posted, the haphazardly assembled fake websites were intended to blur the line between truth and falsehood, their aim being to deceive readers who stumble upon their front pages into accepting “fake news” as coming from legitimate news organizations.

A month after this initial discovery, a further 28 fake news sites were uncovered by the joint team. As it is near certain that Chinese influence campaigns will continue to be deployed against South Korea into the foreseeable future, The Readable has examined eighteen fake news sites out of “Shenzhen Haimai Yunxiang Media Co., Ltd,” one of the aforementioned Chinese marketing companies, to take a closer look at its efforts to mislead South Korean citizens.

Turning an eye to the blind spot: the local news organizations

Chungcheng Times

The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

Incheon Focus

One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.”

On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

The marketing firm also established a news organization under the Korean name -“Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.

In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.”

A spoonful of truth can muddle fake and real

One of the fake articles, published on September 5, 2022, criticized Japan for its decision to discharge treated radioactive water from the Fukushima nuclear plant into the sea and requested the South Korean government to protect its citizens from harmful aftereffects. The unknown writer included the direct statement of an official named “Kim So-geum” who is working at the Marine Environment Policy Division, who explained that it is difficult to fathom the seriousness of the case as the related research is still ongoing.

According to the initial report, the bogus news sites were posting articles produced by South Korean news outlets without their consent. The Readable accessed all eighteen websites on January 4 and discovered that fifteen websites were still publishing unauthorized articles, including one site that changed its main source of authentic articles to a new source not mentioned in the original report.

“It is possible to gain trust by mixing truth with falsehoods. Once there is some truth inside a piece of information, its credibility increases dramatically. People are more likely to lower their guards,” said Song, who is an expert on disinformation. “The Chinese also incorporate the tactic of posting genuine news produced by credible media outlets alongside fake news and create multiple fake websites, targeting the United States.”

Alongside these articles, the Chinese marketing company posted deceptive content through a newswire service named “TimesNewswire” from January of 2021 to October of 2023. This content, which was forty-two pieces in total, did not reveal the source or identity of the writer, only the user who uploaded the post, a poster going by the name of “Chunqt.” Posted simultaneously on all eighteen websites, most of Chunqt’s content either denounced Japan and the United States or promoted the Chinese government or its culture.

One of the fake articles, published on September 5, 2022, criticized Japan for its decision to discharge treated radioactive water from the Fukushima nuclear plant into the sea and requested the South Korean government to protect its citizens from harmful aftereffects. The unknown writer included the direct statement of an official named “Kim So-geum” who is working at the Marine Environment Policy Division, who explained that it is difficult to fathom the seriousness of the case as the related research is still ongoing.

The Marine Environment Policy Division is an authentic government organization under the Ministry of Oceans and Fisheries. The Readable reached out to the Ministry and requested the employment status of the quoted official. The Ministry of Oceans and Fisheries confirmed that there is no government official with that name or job title.

“From the perspective of strategic communication, a propaganda campaign can be classified into three different types: the black, the white, and the grey,” explained Yun Min-woo, a professor at the Department of Police Science & Security Studies at Gachon University. “This can be regarded as grey propaganda, which is in the middle of the black and white. It is where fabricators mix fact and falsehoods in their messages.”

Yun added that the impact of such influence campaigns could be immense as they can create fear in its target audience. “What is important is the fact that bad actors could include information that enhances the belief of the readers,” said Yun. “In the case of the article, the deception could occur merely by failing to differentiate between “treated radioactive water” and “radioactive water.” The latter suggests that radioactive water—which by implication is highly dangerous—could be discharged into the sea without treatment, which was not the case in reality.”

The Marine Environment Policy Division is an authentic government organization under the Ministry of Oceans and Fisheries. The Readable reached out to the Ministry and requested the employment status of the quoted official. The Ministry of Oceans and Fisheries confirmed that there is no government official with that name or job title.

A layer of prejudice as a defense mechanism against influence campaigns

The Readable tried to access all eighteen bogus news websites online. Only one, however, was accessible using Naver, the most prominent online search engine preferred by South Korean citizens to access news articles. Nine out of the eighteen bogus sites were accessible using Google.

The Korea Communications Standards Commission (KCSC), which reviews malicious information uploaded online and has the authority to block access to illegal content after internal deliberation, said to The Readable in an email statement on January 17 that they were aware of the problems and are in the process of deliberating the matter with the appropriate authorities.

The National Intelligence Service (NIS) said to The Readable on January 19 that they are working with relevant authorities such as the Ministry of Culture, Sports and Tourism (MCST), and the KCSC to block the fake news sites.

Although the true purpose of these activities has not yet been discerned, experts warn that Chinese propaganda will continue to target South Korean citizens. “People with a sharp eye might be able to distinguish the roughly crafted fake news sites from authentic media outlets,” said Song. “However, we also have to consider the possibility of a third party, for example, a politician or an academic, employing the accusation of “fake news” to mislead the South Korean public for his or her own personal gain.”

Ryu So-jun, a leader of the threat analysis team of the South Korean cybersecurity firm S2W, which participated in the joint cyber threat analysis team, explained that these influence campaigns could carry on their activities, as fake news sites are constantly being discovered. “We do not regard these websites as dangerous as they lack sophistication. However, we evaluate them as being potentially dangerous, as there is no way of knowing how these fledgling sites might evolve moving forward into the future,” said Ryu.

Yun stressed the importance of disseminating the facts related to Chinese influence campaigns as a countermeasure. “Normally the word ‘prejudice’ or ‘bias’ is used in a negative context. However, in the case of propaganda campaigns, this could accomplish the opposite by giving ordinary people an advantage,” explained Yun. “As people know more about how China is trying to carry out influence operations against South Korea, this could create a prejudice in readers, a filter in each person’s mind able to act as a self-defense shield against possible future interference.”

Cybersecurity News that Matters

Cybersecurity News that Matters

Turning an eye to the blind spot: the local news organizations

A spoonful of truth can muddle fake and real

A layer of prejudice as a defense mechanism against influence campaigns

Subscription