Latest Trends and Considerationin APT41-Related InfoOps
MISAKI YOSHIDA、CHIH-YUN HUANG
JAN 26TH, 2023
1

Who am I
Misaki Yoshida

Chin-yun Huang(confirmation of contents)（speaker、research）
Junior in Tokyo Kasei University.
In 2022, I participated in security
camp, internships and part-timejobs at various security
companies.Twitter（@tdatwja）

CTI Analyst at TeamT5
Previous to TeamT5, Chih-yun worked at an
NGO in Washington DC focusing on USTaiwan relations.
Her research interests include information
operations, US-TW relations, and Chinastudies.
She received her M.A. in Public
Administration from Syracuse University
and her B.A. in Political Science fromNational Taiwan University.
2Agenda
1.
2.
3.
4.
5.
6.

Research Background
Survey Period and Method
Trends
Newly Discovered Features
Considerations and Questions
Summary3

1.Research Background▪ October(2022)、Mandiant（DragonBridge）
Fig.1▪ "APT41 is a US-backed actor"→In August 2020, the group indicted by the FBI
as a cyberattack group linked to the Chinese
government.
▪ Spoofing of Intrusion Truth
Fig.２→Group investigating China-related APT.
4

2.Survey Period and Method
Survey Period：October(2022)～, about 500 posts
Survey Method：Twitter,Facebook（Meta）、Instagram、YouTube、livejournal…
Search for "APT41"
Fig.3
5

3.Trends
APT41→claim of “cyber attacks by US”：COVID-19、rare earth、Uyghur…

Fig.４

Regularity of usernames and icons：No change as pointed out by Mandiant.
Fig.5
6

3.Trends

Fig.6

Fig.7

language：main Simplified Chinese, Traditional Chinese, English

English：#Chengdu404、#AmericanCyberHegemony#AmericanHegemony、#DarkUSOpenhegemony…
Chinese：#美國是個失敗的國家、#美國國家安全局、#美式自由、#美式霸权、#美国窃听…
reference→ https://securityboulevard.com/2022/12/exposing-a-massive-anti-nsa-chinese-themed-online-influenceand-propaganda-campaign-an-osint-analysis/
7

4.Newly Discovered Features
Mandiant's research(DragonBridge)
Spoofing of Intrusion Truth, US citizen

Fig.8✓ Spoofing of Person residing in South Korea✓ Username with Cyrillic lettersFig.98Other SNS▪ Instagram▪ FaceBook(Meta)、Livejournal▪ blog（Tumblr、BackChina.com、Ameba blog）

Fig.11

Fig.10

Fig.12
9

Content related to Japan?
Fig.13▪ Posts written in Japanese and hangul

Fig.14▪ Tumblr's profile image（Japanese animation）▪ The Great Translation Movement→They translate Chinese content into Japaneseand English and so on.

Fig.1510

As a side note…
My tweet got a response too.

Fig.16

Fig.1711

As a side note…②
I asked ChatGPT.

Fig.18
Fig.1912

5.Considerations and Questions
Massive posts on multiple services➢ Purpose is AI?
➢ Possibility of bot：It is devised not to be detected as a bot.
Who?
➢ DragonBridge（Mandiant）, Spamouflage（Graphika）
13

6.Summary▪claim：APT41＝US-backed actor▪posts：Japanese and hangul…
▪Instagram, Ameba blog, and so on▪Purpose is AI?
▪DragonBridge?Spamouflage?
14

Special Thanks
TeamT5@tamn1019
15

LinksFig.1. https://www.fbi.gov/wanted/cyber/apt-41-group

Fig.2. https://twitter.com/Carolin08309349
Fig.4. https://archive.md/OTGv5
Fig.5. https://twitter.com/AngelaJ14093518
Fig.6. https://twitter.com/ReginaB90616273
Fig.7. https://archive.md/4R9jJ
Fig.8. https://twitter.com/JerryHu82171595
Fig.9. https://twitter.com/Feodora98541327
Fig.10. https://ameblo.jp/kkisas/16

LinksFig.11. https://www.instagram.com/w.linta/
Fig.12. https://tommybaker.livejournal.com/
Fig.13. https://twitter.com/Michell51578657
Fig.14. https://www.tumblr.com/jeellyy
Fig.15. https://www.tumblr.com/albertinlaw
Fig.16.
https://twitter.com/tdatwja/status/1611579385412481024?s=20&t=YTd4N1wlMpij4BYFOC6Y6g

17