Full Report
As Chinese warships and fighter jets staged massive drills around Taiwan in December, a parallel action was unfolding on smartphone screens. On Douyin, China’s version of TikTok, a news outlet run by the Chinese Communist Party posted a 51-second video of Taiwan opposition leader Cheng Li-wun accusing President Lai Ching-te of inviting Chinese aggression. Lai,…
Analysis Summary
# Threat Actor: Chinese State-Linked Influence Operations
## Attribution & Identity
* **Actor Identification:** Chinese Communist Party (CCP) state-run media outlets and propaganda apparatus.
* **Aliases/Associated Groups:** Chinese state media, Douyin-based news outlets (TikTok's domestic version).
* **Affiliated Entities:** The article references research from the Taipei-based group **IORG (Information Operations Research Group)**.
## Activity Summary
The actor is engaged in a sophisticated "Information War" synchronized with kinetic military drills (December 2025/2026 timeframe). Recent operations involve the systematic amplification of internal Taiwanese political dissent. A specific campaign highlighted involves the creation and cross-platform dissemination of a 51-second video featuring Taiwanese opposition leader Cheng Li-wun. This video, which blamed the ruling Democratic Progressive Party (DPP) for Chinese aggression, originated on Douyin and was pushed onto platforms popular within Taiwan to influence public perception during a period of heightened military tension.
## Tactics, Techniques & Procedures
* **Content Hijacking/Amplification:** Using legitimate domestic political criticism from the target country to validate foreign propaganda.
* **Cross-Platform Migration:** Originating content on China-controlled platforms (Douyin) and aggressively moving it to Western/Taiwanese platforms (Facebook, YouTube).
* **Multi-Vector Pressure:** Coordinating digital narrative shifts simultaneously with physical military exercises (massive drills by warships and fighter jets).
* **Narrative Leveraging:** Exploiting internal political divisions (KMT vs. DPP) to frame the target's leadership as "dragging" the population toward a "road to death."
**MITRE ATT&CK Mapping (Adversary Tactics/Techniques):**
* **T1584.004:** Compromise Infrastructure: Social Media Accounts (Amplification)
* **T1592.002:** Gather Victim Org Information: Communications (Monitoring political speeches)
* **T1583.008:** Acquire Infrastructure: Personal Social Media Accounts (Influence/Bots)
## Targeting
* **Sectors:** Government, Defense, Political Civil Society.
* **Geography:** Taiwan.
* **Victims:**
* **Democratic Progressive Party (DPP):** The primary political target.
* **Taiwanese Public:** 23 million citizens targeted for psychological operations.
* **Specific Individuals:** President Lai Ching-te (targeted for delegitimization).
## Tools & Infrastructure
* **Malware:** None mentioned (focus is on Cognitive/Information Operations).
* **Infrastructure:**
* **Douyin:** Source platform for content creation.
* **Social Media Ecosystems:** Facebook, YouTube (distribution channels).
* **URLs (Defanged):**
* https[:]//iorg[.]tw/_en
* https[:]//threatbeat[.]com/adversaries/china-turns-taiwans-own-voices-against-it-information-war/
## Implications
The actor has moved beyond simple external propaganda to a "reflexive control" model—where they use the target nation's own democratic processes and political voices to undermine its security. By timing these information bursts with military maneuvers, the actor creates a pincer effect: physical intimidation matched by internal psychological fracturing. This suggests a high level of strategic coordination between the CCP's media arm and the People’s Liberation Army (PLA).
## Mitigations
* **Establish Information Integrity Organs:** Increase support for organizations like IORG to map the provenance of viral political content.
* **Cross-Platform Cooperation:** Better API monitoring between regional platforms (Douyin) and global platforms (Facebook/YouTube) to flag "coordinated inauthentic behavior" (CIB).
* **Public Awareness Campaigns:** Educating the populace on "voice-hijacking" techniques where domestic critiques are laundered through state-run media to serve adversary interests.
* **Critical Infrastructure Protection:** Enhancing monitoring of communications networks during periods of active military exercises.