PRC Spying, Malware and Disinformation Campaigns Push Hong Kong Dissidents to Underground Communications Channels
Following the anti-extradition protests that spanned from 2019 into 2020, the Chinese Communist Party has stepped up its digital actions against Hong Kong activists and dissidents. A new report from threat intelligence firm Intsights finds that aggressive disinformation campaigns and related measures have forced organizers to move to the digital underground, using encryption and the dark web to keep the PRC from observing and inserting itself into their communications.
Disinformation campaigns, mass surveillance drive “dark web” uptick in Hong Kong
Though the Hong Kong street protests have since dissipated, tensions have nevertheless remained high as the Chinese government has aggressively moved to control the flow of information in the region. It has also made mass arrests of protesters under charges such as “subverting state power.” The PRC has also been conducting blanket surveillance that sweeps up even those that are not politically involved, for example monitoring and censoring Zoom conferences organized by businesses and schools. The country’s national security laws require companies based in its territory to turn over any information requested by the government.
Dissidents have responded to disinformation campaigns and surveillance by moving their communications to encrypted messaging apps and dark web forums. However, the researchers warn that this opens up inexperienced navigators to a new realm of criminal threats; some paid services have sprung up to safely guide activists and dissidents to the clandestine meeting places and resources that they are seeking.
The dark web is best known for the sale of illicit goods, everything from credit card skimming equipment to illegal drugs. This is the world that novices must learn to navigate, generally without assistance (unless they pay for it). And when they do find homes for political discussion, they are not necessarily ideologically friendly. The report finds that the most popular Chinese-language discussion forums on the dark web actually tend to be pro-PRC. And the dark web is not free from the eyes of the government; posts from users indicate that Chinese espionage agents monitor at least some of these sites and will occasionally make attempts to disrupt or take down the servers that host them.
The move away from mainstream social media sites has largely been driven by disinformation campaigns, even when those sites do not fall under the influence of China’s government. The PRC is also able to weaponize false claims of “disinformation” against activists by placing the poster in jail for spreading “fake news.” The government’s reach into foreign social media companies is substantial, at least judging by Twitter’s own internal numbers. The social media giant reports finding over 23,000 accounts spreading “geopolitical narratives favorable to the CCP” as part of disinformation campaigns in the past year, taking down thousands of them for abuse of the terms of service. These accounts appear to be supported by an additional network of at least 150,000 accounts that serve to “signal boost” the information that the primary accounts post by “liking” and retweeting it.
And when the Chinese government identifies and targets a dissident, surveillance and arrest is not their only concern. The government has been known to target activists with malware dating back to at least 2014. A recent example that has been seen in the wild is the use of the LightSpy malware, which targets iOS devices and allows the attacker to remotely execute commands. It is able to vacuum up quite a bit of a phone’s data: contact lists, call history, geolocation data and lists of installed apps among other items. A similar piece of malware called dmsSpy was seen to be targeting Android users via a fake app claiming to be associated with the Hong Kong Democracy and Freedom Movement.
The Chinese government has also been observed targeting dissidents with malicious PDF files that appear to come from trusted sources. This aspect of the disinformation campaigns is usually topical and ties into items of great interest to protestors; for example, one recent attack claimed to provide an update to United Kingdom PM Boris Johnson’s announcement that the country would take in up to three million refugees from Hong Kong.
Usage of encrypted communications
In addition to the dark web, activists are responding with an uptick in usage of encrypted communications apps and VPNs located outside of China to counter the disinformation campaigns. The messaging app Signal has become very commonly used in recent months; other popular choices are Telegram, Proton and the local mesh networking app Bridgefy.
Dissidents need all of the assistance they can get from these various tools, as they are up against one of the world’s most formidable hacking forces in addition to the social media disinformation campaigns. The report indicates that state-backed advanced persistent threat (APT) groups have turned their attention from cyber attacks to the business of tracking and exposing Hong Kong activists. These include Winnti Group (APT 41), known for attacking online games for over a decade, and Gothic Panda (APT 3).
Hong Kong is supposed to be politically and legally independent from China until 2047, but the PRC has called the treaty “unequal.” The UK views the implementation of the new security laws as a violation of the treaty and is considering sanctions as a response.
