Baybridge. Anatomy of a chinese information influence ecosystem

Ce rapport, fruit d’une collaboration entre Paul Charon, directeur de domaine de recherche à l’IRSEM, et l’équipe Tadaweb, opérateur en « Open Sources INTtelligence » (OSINT), s’intéresse à un vaste écosystème de manipulation l'information chinois. Un écosystème de manipulation de l’information qui cible des publics dans des dizaines de pays. La recherche menée cartographie l'architecture du réseau « Baybridge », retrace ses liens avec l'appareil de propagande de l'État chinois, décrypte les stratégies discursives déployées à l'égard des publics étrangers, en souligne la portée mais également les limites.

Paul CHARON
Tadaweb  

Online disinformation has become a major challenge for our democratic societies. The development of social networks and the acceleration of information dissemination have created new opportunities for malicious actors seeking to manipulate opinions and interfere in political processes. While Russia’s information warfare tactics have dominated public discourse and scholarly attention, other state actors have been developing their own distinct approaches to informational influence. The People’s Republic of China, though less frequently examined through the lens of active disinformation campaigns, has nonetheless constructed sophisticated mechanisms for shaping international narratives. These operations, distinguished by their commercial camouflage and bureaucratic complexity, exploit digital infrastructures in ways that diverge markedly from the more direct propaganda models typically associated with authoritarian information manipulation. Yet this very complexity, as our investigation reveals, generates its own vulnerabilities and contradictions. Since 2022, a series of investigations has uncovered a vast ecosystem of inauthentic websites, linked to Chinese companies officially offering digital marketing and public relations services and, in reality, also serving to disseminate content aligned with Beijing’s positions to foreign audiences. These works, conducted successively by different research teams, have gradually revealed the scope, modi operandi, and interconnections of this network dubbed ‘GLASSBRIDGE’. Our analysis, however, reveals that the network’s operational center of gravity lies not in Shanghai alone, but also within the Greater Bay Area — that ambitious megalopolitan project encompassing Guangdong, Hong Kong, and Macau. The key stakeholders, their academic affiliations, and their business activities are deeply embedded in this region’s unique political-economic ecosystem, where the boundaries between public mission and private enrichment prove remarkably porous. We therefore propose the designation ‘BAYBRIDGE’ to more accurately reflect both the geographic anchoring and the structural ambiguities that characterize this infrastructure. The progressive unveiling of this infrastructure’s technical architecture and operational dysfunction requires careful examination of how successive investigations have contributed to our understanding of this paradoxical system.

The first landmark study on the subject was published in August 2022 by Mandiant, a renowned American cybersecurity company now part of Google Cloud. The result of a long investigation about ‘HaiEnergy operation’, this report ^[1] describes in detail how a Chinese public relations company based in Shanghai, Shanghai Haixun Technology Co. Ltd, used its digital infrastructure (servers, domain names, websites), normally devoted to marketing and press release dissemination, to host and disseminate pro-Chinese government propaganda, particularly targeting American audiences. The Mandiant team identified a network of at least 72 seemingly independent websites, presenting themselves as legitimate media covering news from different countries, but in reality all linked to Haixun and publishing content in 11 languages promoting Chinese interests while criticizing the United States and their allies. This foundational discovery highlighted a new mode of state disinformation, relying on private actors and multiple fake media outlets to reach diverse audiences.
The following year, in November 2023, a new investigation conducted by the NCSC Joint Analysis Team,^[2] including the Korean National Intelligence Service (NIS), considerably enriched knowledge about this network. Beyond confirming Haixun’s involvement, the NCSC report revealed the central role of another Chinese digital marketing company, Shenzhen Haimai Yunxiang Media Co. Ltd, and especially the use of newswires as the backbone of the disinformation infrastructure. Korean analysts were able to trace the path of propaganda content, injected at the source into these newswires by Haimai, then automatically picked up and disseminated on a large scale by an entire network of websites posing as legitimate media in different countries, particularly in Southeast Asia. This ‘syndication’ mechanism allows rapid and massive amplification of messages while obscuring their real origin. The NCSC thus brought to light a particularly sophisticated system, combining technical content generation and viral dissemination capability.

In February 2024, the understanding of this network’s operation and purposes reached a new level thanks to a thorough study ^[3]published by The Citizen Lab, a research laboratory at the University of Toronto. Naming the operation ‘PAPERWALL’, researchers focused their efforts on the Haimai company and managed to precisely map a set of more than 100 fake news sites active in thirty countries, including about ten specifically targeting French-speaking audiences. Through advanced content analysis, the study reveals a balanced mix of legitimate information, often directly copied from real local media, and elements of pro-Chinese propaganda or pure information manipulation (conspiracy theories, ad hominem attacks against dissidents, etc.). The report emphasises that this approach makes it possible to build both credibility and a substantial audience while propagating biased narratives, and remaining largely under the radar of the public and authorities. Citizen Lab thus highlights the formidable effectiveness of this mechanism combining familiarity and manipulation.
A few months later, in October 2024, a new milestone was set by the publication of a study^[4] by two researchers from Singapore’s S. Rajaratnam School of International Studies, who examined the specific targeting of Southeast Asia. Their main contribution was revealing the technical and editorial interconnections between the ‘Haixun network’ and another network, called ‘SeaPR Network’, also dedicated to disseminating manipulated information to Southeast Asian public opinion under the guise of innocuous content. Their analysis emphasizes the democratic risks associated with the weaponisation of traditional marketing companies for information manipulation purposes. By imitating familiar local media and mixing authentic and deceptive content, these operations can mislead the public, distort political debate, and pollute a country’s information ecosystem, without even the usual safeguards (media literacy, fact-checking, etc.) being able to effectively counteract them.

Finally, in November 2024, a blog post published by Google’s Threat Analysis Group (TAG) provided an overview of the ‘GLASSBRIDGE’ nebula,^[5] combining previous work with their own analyses. According to TAG experts, the various Chinese entities involved (Haixun, Haimai, but also two previously unknown organizations named ‘DURINBRIDGE’ and ‘Shenzhen Bowen Media’) would actually all be linked together, coordinated, and taking instructions from a single decision-maker, whose identity remains unknown at this stage. The report estimates that at least hundreds of fake news sites, in dozens of languages and countries, would thus be centrally controlled to disseminate discourse aligned with Beijing’s interests. The main contribution of the TAG study is thus documenting the relative centralization of this apparently scattered system and its ability to deploy massive and customised influence campaigns depending on target audiences.
The progressive unveiling of the GLASSBRIDGE infrastructure by experts since 2022 reveals the existence of an information manipulation ecosystem of unprecedented scope and sophistication. However, despite advances made possible by these works, our understanding of this nebula remains partial. The involvement of multiple private actors in creating inauthentic media websites allows obscuring trails, exploiting vulnerabilities in digital spaces, and reaching varied targets on a large scale, according to a flexible and poorly traceable model that evokes a particularly advanced form of ‘outsourcing’ of Chinese state influence, similar to what the Anxun (I-Soon) leak revealed about cyber operations.^[6]
The scope of this network, the similarity of disseminated content despite local adaptations, and the numerous revealed interactions between entities suggest strong capabilities for penetrating foreign audiences. While Google TAG’s assessment points toward a relative centralization of this seemingly dispersed system, our research suggests a more nuanced operational reality within the GLASSBRIDGE ecosystem. Evidence indicates that although strategic coordination may exist at higher levels, implementation frequently exhibits considerable decentralization. Numerous information operations appear to be executed exclusively by local actors who maintain significant autonomy.
This operational flexibility further complicates analysis, as many grey areas persist regarding the identity of the commissioners, the actors involved, the exact distribution of roles, or the degree of coordination of this tentacular system.
More broadly, GLASSBRIDGE illustrates the immense challenges posed to democracies by these new disinformation strategies that operate in regulatory blind spots, blur the lines between legal and illegal, legitimate and illegitimate, and rely on the private sector to multiply their impact while staying under the radar. Faced with these diffuse, polymorphous, and poorly traceable threats, it is crucial to continue research efforts to decrypt the workings of these campaigns.
This is precisely the ambition of the present study, which intends to make a contribution to understanding this complex ecosystem that we now label “Baybridge”, by articulating three objectives: 1) propose as exhaustive a mapping as possible of the network, completing and coherently assembling elements revealed by previous investigations; 2) present new evidence attesting to Chinese state actors’ involvement in piloting this infrastructure; 3) deeply analyse disseminated content to decrypt deployed discourse strategies and targeting methods. Through these new insights, this work hopes to promote a finer understanding of this phenomenon and lay an additional brick in the still-under-construction edifice of the fight against online information manipulation.