It is rare for researchers to link such operations to specific entities. Citizen Lab said the campaign began in mid-2020 and traced the network to public relations firm Shenzhen Haimaiyunxiang Media Co Ltd, also known as Haimai.
The company did not respond to a Reuters request for comment and a phone number listed on an archived version of its website was not reachable.
“As a principle, it is a typical bias and double standard to allege that the pro-China contents and reports are ‘disinformation’, and to call the anti-China ones ‘true information,’” a spokesperson for China’s embassy in Washington said in an emailed statement.
Citizen Lab said one of the websites in the campaign was Roma Journal, which looks every bit like a local Italian news outlet: Headlines discuss the Italian prime minister’s political prospects, a hot air balloon festival in a northern province and a book launch.
But a “press releases” button at a corner of its homepage leads to a range of Chinese state media articles on topics such as China’s contribution to the global economic recovery and its push towards technological innovation.
Much of the content on the sites Citizen Lab found was sourced from a press releases service called Times Newswire, which analysts at cybersecurity firm Mandiant last year found to be at the centre of a separate Chinese influence operation that targeted US audiences.
While online influence campaigns are increasingly common as powerful people and governments around the world seek to manipulate public opinion, experts tracking such operations say China is one of the biggest sources of such drives alongside Russia and Iran.
Chinese influence operations have increased and expanded well beyond Asia, social media giant Meta said in a report in November, calling it “the most notable change in the threat landscape” since 2020.
Citizen Lab dug deeper into the network it found after a series of such websites popped up in South Korea and Italy.
South Korea’s National Cyber Security Center (NCSC) – part of the country’s national intelligence agency – exposed 18 of the sites in a report in November, also linking the operation to Haimai. Roma Journal was not legally registered as a news outlet in Italy, the country’s Il Foglio newspaper reported.
It was not unusual the campaign was found to be low-engagement, said Dakota Cary, a China-focused consultant at cybersecurity firm SentinelOne.
“I think that’s really important, because they still think that it’s worthwhile to fund these campaigns,” he said. “And so I think, if anything, we should expect to see this continue.”