Full Report
A China-linked information campaign is using a network of WeChat accounts to attack Canadian Prime Minister Mark Carney ahead of the country’s upcoming federal election, authorities said.
Analysis Summary
# Threat Actor: China-linked Information Operations Actor (State-Sponsored)
## Attribution & Identity
Attributed to a **Chinese state agency** responsible for policing, intelligence, and internal security. The operation is linked to official Chinese state apparatus, evidenced by the nature and scope of the influence efforts.
## Activity Summary
This actor is conducting a targeted, inauthentic, and coordinated **information operation (influence campaign)** leveraging a network of WeChat accounts ahead of the Canadian federal election scheduled for April 28th. The primary focus of the current campaign is to influence political perceptions surrounding **Canadian Prime Minister Mark Carney** (a former central banker running for a parliamentary seat). The narratives shifted from initial praise of Carney's alignment with U.S. policies to later attacks on his credentials. Previous targeting includes Canadian official **MP Michael Chong** (June 2023) and **Deputy Prime Minister Chrystia Freeland** (January 2025).
## Tactics, Techniques & Procedures
- **Inauthentic Coordination:** Using a coordinated network of accounts to artificially amplify content visibility.
- **Narrative Laundering/Shifting:** Promoting evolving narratives designed to shape public opinion.
- **Coordinated Amplification:** Utilizing a network of approximately 30 smaller WeChat accounts to boost the visibility of central posts, ensuring they remain high in algorithmic feeds.
- **High Reach Dissemination:** Achieving engagement levels (up to 3 million views) far surpassing typical state-run outlets.
- **Exploitation of Platform Gaps:** Using WeChat, which is understudied by information integrity researchers, to conduct covert influence operations with minimal scrutiny.
- [No specific MITRE ATT&CK IDs were explicitly mentioned in the source material, but this activity aligns broadly with **T1592 - Gather Victim Identity Information** and **T1564.003 - Impersonation: Social Media** within the Defense Evasion or Persistence tactic groups if viewed through a cyber lens, or more appropriately under **TA0011 - Command and Control** in the context of influence operations.]
## Targeting
- **Sectors:** Politics/Government (specifically federal election interference).
- **Geography:** Canada.
- **Victims:** Canadian electorate, specifically focusing on the **Canadian-Chinese communities** who speak Chinese languages. Targeted high-profile politicians include Mark Carney, Michael Chong, and Chrystia Freeland.
## Tools & Infrastructure
- **Malware Families Used:** None mentioned (Influence Operation focused).
- **Infrastructure (C2, domains, IPs):**
- **Primary Account:** "Youli-Youmia" (Anonymous news account on WeChat).
- **Supporting Infrastructure:** A network of approximately 30 smaller, subordinate WeChat accounts.
- **C2/Denial:** The Chinese embassy spokesperson denied involvement, framing the accusations as "absurd and unjustified."
## Implications
This operation demonstrates a sophisticated, ongoing, and state-backed attempt by China to interfere with Canadian democratic processes, specifically leveraging platforms popular within expatriate and diaspora communities (WeChat). The shift in targeting (from high-level policymakers to candidates in specific ridings, like Carney in Nepean) suggests a granular and persistent strategy to influence electoral outcomes, amplified by recent geopolitical tensions (e.g., retaliatory tariffs imposed by Beijing). The success in reaching millions of views indicates a high level of operational effectiveness on this platform.
## Mitigations
- Increased monitoring and scrutiny of inauthentic activity on platforms like WeChat, particularly during election periods.
- Continued enforcement of policies barring the use of potentially compromised/vulnerable platforms (like WeChat) on government devices (as implemented in October 2023).
- Diplomatic engagement and public attribution regarding foreign influence operations to counter the intended effects of the narratives.