Chinese hackers use Dragonbridge campaign to target rare earth mining companies
Threat intelligence firm Mandiant has identified and investigated a subset of information operations activity that it attributes to the Dragonbridge campaign across social media that targeted the Australian rare earth mining company, Lynas Rare Earths Ltd. The content criticizes its alleged environmental record and calls for protests of its planned construction of a rare earth processing facility in Texas.
“Subsequently in June, we observed additional DRAGONBRIDGE activity begin to target the Canadian rare earths mining company Appia Rare Earths & Uranium Corp and the American rare earths manufacturing company USA Rare Earth with negative messaging in response to potential or planned rare earths production activities involving those companies,” the company said in a Tuesday post.
Mandiant has contacted Lynas, Appia, and USA Rare Earth about this activity and social media platforms where this campaign promoted content. The campaign also promoted content criticizing the U.S. administration’s decision to invoke the Defense Production Act on March 31, 2022, to expedite the domestic production of critical minerals to end U.S. reliance on China for its supply.
In June, additional Dragonbridge social media accounts began targeting two additional rare earth mining and manufacturing companies, the Canadian rare earth mining company Appia Rare Earths & Uranium Corp and the American rare earth supplier USA Rare Earth, Mandiant disclosed. It added that accounts acted in response to announcements made by the respective companies regarding potential or planned operations, echoing previous criticisms centering around alleged environmental and labor concerns.
Since June 2019, Mandiant has reported to customers on the Dragonbridge influence campaign comprising a network of thousands of inauthentic accounts across numerous social media platforms, websites, and forums that have promoted various narratives supporting the political interests of the People’s Republic of China (PRC). The company has also since observed multiple shifts in Dragonbridge tactics and reported last September on an expansion of this campaign’s activity.
Mandiant said that Dragonbridge’s targeting of additional rare earth mining companies underscores the campaign’s ability to monitor developments and respond accordingly and its investment in attempting to ensure the PRC’s market dominance in the industry. “DRAGONBRIDGE accounts targeted Appia with negative messaging in response to the company’s announcement on June 1 that it had discovered a new rare earths bearing zone in Saskatchewan, Canada. As with the planned Lynas facility in Texas, accounts professed concern for the environmental implications of Appia’s actions and the health of its workers,” it added.
Following USA Rare Earth’s announcement of a planned rare earth manufacturing facility in Oklahoma on June 9, Dragonbridge reiterated concerns surrounding the alleged impact of rare earth mining and processing, highlighting similar themes on the risks involved.
Mandiant said that the Dragonbridge campaign targeted ‘an industry of strategic significance’ to the PRC, including specifically three commercial entities challenging the PRC’s global market dominance in that industry. Additionally, rare earth metals are a critical part of consumer and defense products such as missile guidance systems and aircraft engines, and China has used its supply chain dominance as geopolitical leverage, including by threatening a rare earth embargo on the U.S. during the height of the trade war between the two countries in 2019.
“In 2021, the U.S. Department of Defense signed an agreement with Lynas, the world’s largest rare earths mining and processing company outside China, to construct the Texas processing facility,” Mandiant said. In early June 2022, the Canadian rare earths miner Appia announced the discovery of a new rare earths bearing zone in Northern Saskatchewan, Canada. Similarly, the American rare earths supplier USA Rare Earth announced plans for a rare earths processing facility in Oklahoma in mid-June. Both statements prompted further activity from DRAGONBRIDGE in response, it added.
The firm also noted that further information operations activity in a similar vein may narrowly target other specific industries or companies that may be relevant to the PRC’s strategic interests, beyond promoting geopolitical narratives in line with PRC political interests.
Mandiant identified that the campaign leveraged more nuanced tactics than what is typically seen from pro-PRC information operations. For example, the campaign used inauthentic social media and forum accounts, including those posing as residents in Texas to feign concern over environmental and health issues surrounding the plant, including via posts to a public social media group predisposed to be receptive to that content.
Furthermore, “these accounts also leveraged criticism of Biden’s invocation of the Defense Production Act by real individuals, including U.S. politicians of both parties, to amplify campaign narratives,” according to Mandiant. “While the activity we detail here does not appear to have been particularly effective and received only limited engagement by seemingly real individuals, the campaign’s microtargeting of specific audiences suggests the possibility of using similar means to manipulate public discourse surrounding other U.S. political issues to the PRC’s advantage,” it added.
Mandiant also assessed that Dragonbridge’s broadly targeting of the rare earth industry, and Lynas, Appia, and USA Rare Earth specifically, demonstrates an interest in industries of strategic importance to the PRC that was not previously observed from the campaign. “Given Chinese President Xi Jinping’s continued emphasis on a broad, holistic understanding of PRC national security that encompasses areas including information and resource security, we may see other global competitors to PRC firms in other industries targeted by such information operations,” the firm added.
Additionally, Mandiant said that the Dragonbridge campaign has in this activity set demonstrated the use of incrementally more sophisticated tactics, such as the microtargeting of audiences favorable to its messaging and the leveraging of criticism by real individuals to support its narratives and agenda. However, it added that its poor execution remains a limiting factor in the campaign’s ability to garner significant engagement effectively.
Earlier this month, U.S. cybersecurity agencies released a joint Cybersecurity Advisory outlining how PRC state-sponsored hackers continue to exploit publicly known vulnerabilities to establish a broad network of compromised infrastructure.
Related
