Loading threat actor…
Nine-emdash Line is a PRC-origin covert influence operation focused on cross-platform social media manipulation and narrative shaping aligned with Chinese state interests. The operation used AI-generated content to support inauthentic activity, primarily on X, with additional observed use on platforms including TikTok and Instagram. Its messaging concentrated on South China Sea and West Philippine Sea disputes, criticism of Philippine President Ferdinand Marcos, attacks on Hong Kong pro-democracy figures, support for Hong Kong national security legislation, and some commentary on political issues in the United States. English-language content also promoted narratives about Vietnam’s alleged environmental impact in disputed maritime areas. The operation displayed characteristics similar to broader China-origin influence ecosystems such as Spamouflage, although no conclusive technical linkage was established. It relied on bulk generation of social media posts and comments in multiple languages, including English and Cantonese, and used coordinated inauthentic personas to seed, amplify, and sometimes simulate engagement with its own content. Reported tactics included generating derogatory commentary portraying Hong Kong pro-democracy activists as criminals or traitors, producing anti-Marcos narratives, and attempting to exploit existing social media trends and hashtags for wider reach. Beyond content generation, the operators used AI for reconnaissance and operational support tasks, including identifying niche blogs, forums, and less regulated online platforms in Europe, the Americas, and Southeast Asia; developing persona elements such as names; and seeking advice on social media growth strategies and campaign formats such as TikTok challenges. The operation appears to have been low impact overall, with limited authentic engagement and much of the observed interaction coming from accounts controlled by the operators themselves.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously identified PRC-origin covert influence operation mentioned because of content overlap with the current campaign on X.
A China-origin covert influence operation that used AI-generated content for cross-platform social media influence activity focused on South China Sea disputes, criticism of Philippine President Ferdinand Marcos, attacks on Hong Kong pro-democracy figures, and to a lesser extent US political issues.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.