More signals behind Covid-19 fake “confession” operation point to China

Accounts on Instagram spreading the “confession” alleging U.S. is responsible to Covid19.

In an earlier post I described the emergence of an anonymous “confession” blaming the U.S. Army Medical Research Institute for Infectious Diseases (USAMRIID) alongside Gilead Sciences, UNC, Jared Kushner and several other entities for the dissemination of SARS CoV 2. The post was published on Facebook, but despite coordinated efforts on the platform and on Twitter did not get a lot of traction. That said, on Chinese platform, Weibo, a screenshot of the post went viral with dozens of thousands of shares and likes.

An article by The Daily Beast, that was published several days later brought Facebook response to the incident: “the accounts use some of the same methods as a recently busted pro-China propaganda push.” The response mentioned a “red flag” according to which some of the accounts appeared to be operating from Bangladesh, which appeared in earlier reports of Pro-China operations (Spamoflague Dragon by Graphika). According to the article “the company suspended them and they’ll remain suspended unless and until they can prove they’re operated by an authentic person.”

But, over the past week (before the The Daily Beast article was published), There have been at least two other similar attempts to disseminate the “confession” on Facebook, with newly repurposed pages and dozens of accounts. Similar activity has been recorded on Twitter and Instagram too.

New activity on Facebook

“Cleveland Don”, once Chinese social media marketing page, now an American bio-lab whistleblower

On 8/19 (a day after Facebook suspended the original account) a screenshot of the confession was uploaded to a Facebook page . At the same day this page has changed its name from “Refund Service” to “Cleveland Don”. It was the third time the page name has been changed. Back in 2017 its original name was 社交媒体营销服务 (in English: social media marketing service). The latter served a website for “Amazon refunds” , which according to whois data was registered in China in 2018.

The new post and the comments, from the re-activated accounts

Hours after the post was uploaded to this page came waves of comments, and shares. The post did not get viral (~240 shares, 580 likes, 45 comments) , which made the inauthentic effort even more transparent. 72 hours after the post was published, all the comments (anti U.S. of course) came mainly from two clusters of users:

1. At least 15 accounts were reactivated over the past couple of months. The profile pictures of those accounts were usually of male models. Many of the accounts featured in this cluster were also connected to a page counterfeiting a crypto currency page and linking to some scammy promotion.
2. People who according to their Facebook profile are Egyptian residents, though some seem to have “connection” to Bangladesh.

A sample of the first cluster accounts that commented on the post. All were repurposed around the same dates.

The “Bangladeshi” pattern seems to be existing in the shares too. Further, the comments that were posted to the post were in many cases identical to comments that were posted earlier on Instagram posts with the “confession”.

comments on Instagram posts were identical to the comments on the latest Facebook post.

The “confession” was uploaded on 8/16 to another Facebook account with 1,100 followers. From this account it has been shared 80 times. Chinese versions of the “confession” have been shared from a qq blogspot, that was published also around 8/16.

New activity on Twitter

Similar to Facebook, newly created accounts have surfaced on Twitter, posting the confession to U.S. based users. One of the accounts @lucky50626797, which first tweeted on 8/18, not only tweeted the “confession” several times, but also started to argue with what seems to be American users online, bringing the confession as a proof. At some point the account presented itself as if it is located in Hong Kong. At least one more Twitter account showed a similar pattern. In addition to that the qq post that was mentioned earlier has been circulated on twitter too, with hundreds of retweets and likes.

As mentioned before, the posting of the “confession” is mixed into the already suspicious efforts on social media, to raise doubts and claim plausibility the U.S. is responsible to COVID-19. A propaganda effort that has been taking place publicly for months.

Instagram
In addition to all of the above, a network of several dozens Instagram accounts shared the content over the past ten days, and posted comments on them. Most of the accounts seem to be re-purposed for that, and scrapped earlier content they had on their accounts. Many of the posts contained comments and engagements from dozens of accounts that were either reactivated or created recently.

Three of the Instagram accounts that were repurposed to post the theory

Several of the accounts (such as @hkhk9154 and @hk4sdopk) that posted the content to Instagram might have been repurposed recently and were used in the past to spread propaganda related to Hong Kong.

Keeping the story alive

While the efforts on western based social media platforms to disseminate this piece of disinformation have not yielded fruit so far, and it is still not clear who is behind them, they might expose some key vulnerability: the success of the false story on Weibo combined with recurring attempts to disseminate the story on Facebook, Twitter (and perhaps Youtube) could allow it to gain traction despite platforms actions, especially as they struggle to attribute the activity.