By Kuksung Nam, The Readable
Jan. 12, 2024 8:42PM GMT+9 Updated Jan. 19, 2024 7:55PM GMT+9
In November of 2023, a joint team comprised of the South Korean intelligence agency and four cybersecurity firms revealed a dark corner of the web that few would have believed existed: an alleged Chinese influence campaign involving more than three dozen fake websites disguised to resemble South Korean news publications.
The National Cyber Security Center (NCSC) cyber threat analysis team traced the origin of these sites to two Chinese marketing firms and one newswire service, discovering that these entities were attempting to spread misleading articles through their media channels. From the names of the publications to the articles they posted, the haphazardly assembled fake websites were intended to blur the line between truth and falsehood, their aim being to deceive readers who stumble upon their front pages into accepting “fake news” as coming from legitimate news organizations.
A month after this initial discovery, a further 28 fake news sites were uncovered by the joint team. As it is near certain that Chinese influence campaigns will continue to be deployed against South Korea into the foreseeable future, The Readable has examined eighteen fake news sites out of “Shenzhen Haimai Yunxiang Media Co., Ltd,” one of the aforementioned Chinese marketing companies, to take a closer look at its efforts to mislead South Korean citizens.
◇ Turning an eye to the blind spot: the local news organizations
On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.
The marketing firm also established a news organization under the Korean name “Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.
In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.”
◇ A spoonful of truth can muddle fake and real
According to the initial report, the bogus news sites were posting articles produced by South Korean news outlets without their consent. The Readable accessed all eighteen websites on January 4 and discovered that fifteen websites were still publishing unauthorized articles, including one site that changed its main source of authentic articles to a new source not mentioned in the original report.
“It is possible to gain trust by mixing truth with falsehoods. Once there is some truth inside a piece of information, its credibility increases dramatically. People are more likely to lower their guards,” said Song, who is an expert on disinformation. “The Chinese also incorporate the tactic of posting genuine news produced by credible media outlets alongside fake news and create multiple fake websites, targeting the United States.”
Alongside these articles, the Chinese marketing company posted deceptive content through a newswire service named “TimesNewswire” from January of 2021 to October of 2023. This content, which was forty-two pieces in total, did not reveal the source or identity of the writer, only the user who uploaded the post, a poster going by the name of “Chunqt.” Posted simultaneously on all eighteen websites, most of Chunqt’s content either denounced Japan and the United States or promoted the Chinese government or its culture.
One of the fake articles, published on September 5, 2022, criticized Japan for its decision to discharge treated radioactive water from the Fukushima nuclear plant into the sea and requested the South Korean government to protect its citizens from harmful aftereffects. The unknown writer included the direct statement of an official named “Kim So-geum” who is working at the Marine Environment Policy Division, who explained that it is difficult to fathom the seriousness of the case as the related research is still ongoing.
The Marine Environment Policy Division is an authentic government organization under the Ministry of Oceans and Fisheries. The Readable reached out to the Ministry and requested the employment status of the quoted official. The Ministry of Oceans and Fisheries confirmed that there is no government official with that name or job title.
“From the perspective of strategic communication, a propaganda campaign can be classified into three different types: the black, the white, and the grey,” explained Yun Min-woo, a professor at the Department of Police Science & Security Studies at Gachon University. “This can be regarded as grey propaganda, which is in the middle of the black and white. It is where fabricators mix fact and falsehoods in their messages.”
Yun added that the impact of such influence campaigns could be immense as they can create fear in its target audience. “What is important is the fact that bad actors could include information that enhances the belief of the readers,” said Yun. “In the case of the article, the deception could occur merely by failing to differentiate between “treated radioactive water” and “radioactive water.” The latter suggests that radioactive water—which by implication is highly dangerous—could be discharged into the sea without treatment, which was not the case in reality.”
◇ A layer of prejudice as a defense mechanism against influence campaigns
The Readable tried to access all eighteen bogus news websites online. Only one, however, was accessible using Naver, the most prominent online search engine preferred by South Korean citizens to access news articles. Nine out of the eighteen bogus sites were accessible using Google.
The Korea Communications Standards Commission (KCSC), which reviews malicious information uploaded online and has the authority to block access to illegal content after internal deliberation, said to The Readable in an email statement on January 17 that they were aware of the problems and are in the process of deliberating the matter with the appropriate authorities.
The National Intelligence Service (NIS) said to The Readable on January 19 that they are working with relevant authorities such as the Ministry of Culture, Sports and Tourism (MCST), and the KCSC to block the fake news sites.
Although the true purpose of these activities has not yet been discerned, experts warn that Chinese propaganda will continue to target South Korean citizens. “People with a sharp eye might be able to distinguish the roughly crafted fake news sites from authentic media outlets,” said Song. “However, we also have to consider the possibility of a third party, for example, a politician or an academic, employing the accusation of “fake news” to mislead the South Korean public for his or her own personal gain.”
Ryu So-jun, a leader of the threat analysis team of the South Korean cybersecurity firm S2W, which participated in the joint cyber threat analysis team, explained that these influence campaigns could carry on their activities, as fake news sites are constantly being discovered. “We do not regard these websites as dangerous as they lack sophistication. However, we evaluate them as being potentially dangerous, as there is no way of knowing how these fledgling sites might evolve moving forward into the future,” said Ryu.
Yun stressed the importance of disseminating the facts related to Chinese influence campaigns as a countermeasure. “Normally the word ‘prejudice’ or ‘bias’ is used in a negative context. However, in the case of propaganda campaigns, this could accomplish the opposite by giving ordinary people an advantage,” explained Yun. “As people know more about how China is trying to carry out influence operations against South Korea, this could create a prejudice in readers, a filter in each person’s mind able to act as a self-defense shield against possible future interference.”
What makes this article different from the others
1. The Readable looked into the titles of all eighteen fabricated news websites and compared them to local news organizations. The Readable learned that two of the fake news sites have a close resemblance to legitimate news outlets. We also discovered two websites that falsely bear the name of two genuine South Korean news publications.
2. The Readable contacted Song Tae-eun, an assistant professor at the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, who is an expert on disinformation, and included her insights on possible reasons why the Chinese fake news operators were seeking to impersonate South Korean news media outlets.
3. The Readable accessed all eighteen bogus news sites and looked into the changes after the publication of the report from the National Cyber Security Center (NCSC) cyber threat analysis team in November of last year. The Readable included news on the latest changes, such as whether the sites have continued to upload articles produced by credible South Korean news organizations.
4. The Readable analyzed the forty-two pieces of malicious content listed on the initial report from the joint analysis team and discovered that the operators cited a nonexistent government official working at the Ministry of Oceans and Fisheries. The Readable reached out to the Ministry and received confirmation that no such person was employed by the Ministry.
5. The Readable contacted Yun Min-woo, a professor at the Department of Police Science & Security Studies at Gachon University and included his insights on the characteristics of the Chinese influence campaign and its impact on South Korean citizens.
6. The Readable tried to access all eighteen fake websites using Naver and Google and included the number of websites able to be accessed using these online search engines in the article.
7. The Readable included the comment received from the Korea Communications Standards Commission (KCSC) and the National Intelligence Service (NIS) related to their efforts to block fraudulent websites.
The cover image of this article was designed by Areum Hwang. This article was copyedited by Arthur Gregory Willers.
What’s been updated: This article was updated to include a comment by the Korea Communications Standards Commission (KCSC) and the National Intelligence Service (NIS).
Kuksung Nam is a journalist for The Readable. She has extensively traversed the globe to cover the latest stories on the cyber threat landscape and has been producing in-depth stories on security and privacy by engaging with industry giants, foreign government officials and experts. Before joining The Readable, Kuksung reported on politics for one of South Korea’s top-five local newspapers, The Kyeongin Ilbo. Her journalistic skills and reportage earned her the coveted Journalists Association of Korea award in 2021 for her essay detailing exclusive stories about the misconduct of a former government official. She holds a Bachelor’s degree in French from Hankuk University of Foreign Studies, a testament to her linguistic capabilities.
