The following paragraph contains which ATT&CK v14 techniques and tactics(!importantly, i mean version 14)? Please give me their IDs and your explanations. 
In August 2022, Mandiant released a public report detailing an ongoing influence campaign leveraging infrastructure attributed to the Chinese public relations (PR) firm Shanghai Haixun Technology Co., Ltd (上海海讯社科技有限公司) (referred to hereafter as “Haixun”). This campaign, which we dubbed “HaiEnergy,” leveraged a network of at least 72 inauthentic news sites—which presented themselves as independent news outlets based in various regions across the world—and a number of suspected inauthentic social media assets to amplify content strategically aligned with the political interests of the People’s Republic of China (PRC).
When we released our initial report, we were unable to determine the extent to which Haixun was involved in, or even aware of this campaign, as our visibility was limited to the campaign’s use of infrastructure linked to the company. In recent months, however, we have identified additional evidence suggesting Haixun is not only aware of the campaign but is actively supporting it through the solicitation of for-hire freelancers via Fiverr to promote campaign content.
Additionally, we have identified new tactics, techniques, and procedures (TTPs) being employed by HaiEnergy, which includes the use of newswire services to distribute pro-PRC content to subdomains of legitimate U.S.-based news outlets. We also note the possibility the campaign is leveraging less conventional TTPs, citing a specific example in which an ad displaying pro-PRC messaging was possibly placed on a billboard in New York City’s Times Square.
Finally, and perhaps most noteworthy, we have evidence to suggest the campaign may have financed at least two staged in-person protests in Washington, D.C. The campaign then used the protests as source material in HaiEnergy-linked operations that promoted narratives surrounding highly divisive U.S. domestic issues and messaging critical of a June 2022 decision by the U.S. Government to ban all goods produced in China's Xinjiang region.
Since we published our initial report, Mandiant has identified additional dissemination vectors leveraged by HaiEnergy, which includes two self-described “press release” services—"Times Newswire" (timesnewswire.com) and "World Newswire" (wdwire.com)—and at least 32 subdomains of legitimate U.S.-based news outlets resolving to third-party infrastructure associated with a U.S.-based company named “FinancialContent, Inc.” (see Appendix for technical analysis).
We note that we have not observed evidence indicating that any of the impacted outlets were compromised. Based on our technical analysis of these subdomains, combined with insights gleaned from open-source reporting, it is possible FinancialContent, Inc. provided these outlets with a service that supplies stock and financial news data to be displayed on the subdomains we have identified. According to at least one source, content provided by FinancialContent, Inc. is sometimes published to these subdomains without approval or review.
We have attributed the use of these vectors to HaiEnergy based on overlapping content published to these newly-observed entities and to previously known HaiEnergy infrastructure,as well as observations surrounding the coordinated amplification of content published to all sites we now attribute to the campaign (see next section).
Despite the common denominator of having been leveraged by the HaiEnergy campaign, we currently lack technical evidence to suggest an underlying connection between Haixun and World Newswire, Times Newswire, or FinancialContent, Inc. and thus currently view them as distinct entities.
Our previous understanding of Haixun’s involvement in HaiEnergy was limited to the campaign’s use of infrastructure linked to the PR firm; namely, at least 72 suspected inauthentic news sites which all leveraged content from the server “02100.vip” that was registered by Haixun. However, recent observations associated with the company’s presence on Fiverr, a global online marketplace for freelance services, has given us additional evidence suggesting the company is complicit in the broader campaign, as well as insight into the methods in which it outsources content promotion.
Specifically, we identified a Fiverr account we attribute to Haixun actively engaged in soliciting individuals to promote content both consistent with the political narratives promoted by the HaiEnergy campaign and sourced to infrastructure we attribute to it (Figure 5). Additionally, we observed numerous reviews from the Haixun Fiverr account as a “buyer” placed on identified “seller” accounts. Likewise, we observed identified “sellers” confirming this transactional relationship between both parties by leaving reciprocal reviews.
Based on the number of paid promoter accounts that we identified with a substantial following (i.e., over 100,000 followers), we surmise that Haixun selectively targeted for-hire accounts that could maximize campaign reach. Despite the use of these for-hire accounts within the context of a campaign we assess to be both coordinated and inauthentic, we detail the activity of these accounts solely to demonstrate the level of coordination exhibited by the campaign’s operators, and refrain from making any assertions pertaining to the authenticity of individual for-hire accounts or whether these individuals are witting or unwitting participants.
In addition to users we believe were commissioned by Haixun, Mandiant also identified two clusters of suspected inauthentic accounts operating on Twitter engaged in the concerted promotion of source material originating from HaiEnergy-linked sources. One cluster was used to tweet links to articles sourced to various subdomains leveraged by the campaign, while the second cluster was used to reply to these tweets in a likely attempt to feign authentic engagement. In at least one instance, accounts we identified used first-person pronouns to feign concern over the recent Ohio train derailment in early February 2023, implying that they were U.S.-based individuals (Figure 8).
In addition to commissioning campaign support in the dissemination phases of HaiEnergy-attributed operations, we have evidence to suggest the campaign may have also financed at least two staged in-person protests in Washington, D.C. Both protests, which occurred around June and September 2022, were documented via video and subsequently used as source material to support campaign-promoted narratives published by assets and infrastructure leveraged by HaiEnergy.
The first protest we suspect to have been manufactured by the campaign was allegedly in response to the 2022 International Religious Freedom (IRF) Summit—an annual event held in Washington, D.C. aimed at bringing awareness to restrictions on religious freedom. The second protest appears to have been manufactured in response to a June 2022 decision by the U.S. Government to ban all goods produced in China’s Xinjiang region—a decision which came under the backdrop of continued allegations of human rights abuses against China’s ethnic-minority Uyghur population. In both videos, two small groups of protesters can be observed demonstrating in Washington, D.C., holding placards and chanting slogans intended to highlight U.S. domestic issues, such as racial discrimination and abortion, as well as criticize U.S. policy impacting the import of solar industry-specific components from Xinjiang—a key supplier of cheap critical components used by the solar panel manufacturing industry. As previously alluded to, HaiEnergy subsequently leveraged these videos to bolster campaign messaging.
Attempts by the campaign to manufacture source material offline for subsequent use in HaiEnergy-linked operations may not be isolated to the aforementioned protests in Washington, D.C. Specifically, we observed an article published to Times Newswire claiming that protests occurred in response to Taiwanese President Tsai Ing-wen’s recent transit through the U.S. and referencing a pro-PRC message vis-à-vis Taiwan displayed on a billboard in New York City’s Times Square (Figure 14). We lack evidence to confirm that the ad was actually placed on the billboard or that it was paid for by the campaign. However, we note the possibility, given our understanding of the campaign, Haixun’s self-promoted strategy of “LED digital marketing services” specifically referencing ad placement in “Times Square, New York” (Figure 15), and an identified service that sells digital advertisements on the specific billboard featured in the Times Newswire article.
In our August 2022 report, we noted that while we currently track HaiEnergy and DRAGONBRIDGE as separate campaigns, we have observed some, albeit limited, overlap between the two activity sets, mainly vis-à-vis the prevailing themes present in observed narratives promoted by both campaigns and, to a lesser extent, the use of some conventional TTPs. Since the publication of that report, we have acquired additional data points demonstrating further overlap between the two campaigns, making it at least plausible that these observations could be the result of shared tasking or group overlap. Despite these additional data points and absent any technical indicators linking the two, we still opt to treat these activity sets as distinct campaigns, though we are actively investigating the relationship between the two. For reference, we include some of the more notable newly-observed overlaps:
To date, pro-PRC influence campaigns that Mandiant currently tracks have largely failed to generate substantial engagement from authentic users, with most seemingly operating within the confines of their own echo chambers despite campaign operators’ use of multiple platforms and dissemination vectors to reach target audiences. Just as researchers within the disinformation space search for new and novel ways to measure the impact of influence campaigns, threat actors, conversely, are recalibrating their efforts to achieve maximum effectiveness. As early as 2020, researchers within the disinformation space have acknowledged the pivotal role high-profile influencers can play in furthering the reach of IO campaigns. Based on our most recent observations associated with HaiEnergy, it is plausible that operators behind this campaign have recognized the ineffectiveness of past tactics and now look to expand the campaign’s overall reach by outsourcing certain aspects of its operation. The possible financing of at least two staged in-person protests for use as source material in HaiEnergy-linked information operations is, in particular, a significant escalation in TTPs employed by this campaign, and further evidence suggesting the campaign is expanding its tactics to maximize potential impact.
Based on our technical analysis, we judge that the content displayed on the 32 subdomains of websites belonging to legitimate U.S. news outlets is intended to masquerade as content published on the main websites (second-level domains) of these outlets. All 32 subdomains have leveraged infrastructure that can be attributed to the FinancialContent, Inc. company.
Based on our analysis of these subdomains and insights gleaned from open-source reporting, it is possible FinancialContent, Inc. provided these outlets with a service that supplies stock and financial news data to be displayed on the subdomains we have identified. According to at least one source, content provided by FinancialContent, Inc. is sometimes published to these subdomains without approval or review.
Name
URL
CNAME
IP
The Arizona Republic
finance.azcentral.com
markets.financialcontent.com
104.247.86.162
Pittsburgh Post-Gazette
markets.post-gazette.com
markets.financialcontent.com
104.247.86.163
Starkville Daily News
business.starkvilledailynews.com
markets.financialcontent.com
104.247.86.163
The Kane Republican
business.kanerepublican.com
markets.financialcontent.com
104.247.86.162
Sweetwater Reporter
business.sweetwaterreporter.com
markets.financialcontent.com
104.247.86.162
The Daily Press
business.smdailypress.com
markets.financialcontent.com
104.247.86.163
Poteau Daily News
business.poteaudailynews.com
markets.financialcontent.com
104.247.86.163
The Call
business.woonsocketcall.com
markets.financialcontent.com
104.247.86.163
Mammoth Times
business.mammothtimes.com
markets.financialcontent.com
104.247.86.163
The Evening Leader
business.theeveningleader.com
markets.financialcontent.com
104.247.86.163
The Post and Mail
business.thepostandmail.com
markets.financialcontent.com
104.247.86.162
My Mother Lode
money.mymotherlode.com
markets.financialcontent.com
104.247.86.162
The Inyo Register
business.inyoregister.com
markets.financialcontent.com
104.247.86.163
The Punxsutawney Spirit
business.punxsutawneyspirit.com
markets.financialcontent.com
104.247.86.162
Borger New-Herald
business.borgernewsherald.com
markets.financialcontent.com
104.247.86.163
The Times
business.pawtuckettimes.com
markets.financialcontent.com
104.247.86.162
Statesman Examiner
business.statesmanexaminer.com
markets.financialcontent.com
104.247.86.163
Decatur Daily Democrat
business.decaturdailydemocrat.com
markets.financialcontent.com
104.247.86.162
The Pilot News
business.thepilotnews.com
markets.financialcontent.com
104.247.86.163
The Newport Daily Express
business.newportvermontdailyexpress.com
markets.financialcontent.com
104.247.86.163
Malvern Daily Record
business.malvern-online.com
markets.financialcontent.com
104.247.86.162
Southern Rhode Island Newspapers
business.ricentral.com
markets.financialcontent.com
104.247.86.163
Wapakoneta Daily News
business.wapakdailynews.com
markets.financialcontent.com
104.247.86.163
Times Record
business.times-online.com
markets.financialcontent.com
104.247.86.162
The Guymon Daily Herald
business.guymondailyherald.com
markets.financialcontent.com
104.247.86.162
Daily Times Leader
business.dailytimesleader.com
markets.financialcontent.com
104.247.86.163
The Ridgway Record
business.ridgwayrecord.com
markets.financialcontent.com
104.247.86.163
Big Spring Herald
business.bigspringherald.com
markets.financialcontent.com
104.247.86.162
The Observer News Enterprise
business.observernewsonline.com
markets.financialcontent.com
104.247.86.162
The Saline Courier
business.bentoncourier.com
markets.financialcontent.com
104.247.86.162
The Buffalo News
markets.buffalonews.com
markets.financialcontent.com
104.247.86.163
The Community Post
business.minstercommunitypost.com
markets.financialcontent.com
104.247.86.163
Special thanks to <PRESIDIO_ANONYMIZED_PERSON> and numerous other individuals who provided valuable insights and analysis.