Loading story…
Mandiant reported that the pro-PRC influence operation DRAGONBRIDGE targeted rare earths mining companies in an effort to weaken competitors to the PRC’s dominance in the global rare earths market. The campaign focused on shaping public perception around mining projects and companies involved in developing alternative supply chains outside China, using coordinated online narratives intended to erode support for those operations.
The activity reflects a broader use of information operations to advance strategic economic interests, with rare earths remaining critical to technology, defense, and industrial manufacturing. By aiming messaging at firms and projects that could expand non-PRC production, the campaign sought to hinder market rivalry and preserve the PRC’s leverage over a sector central to global supply chains.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant published research describing a pro-PRC DRAGONBRIDGE influence campaign aimed at rare earths mining companies, framing it as an effort to hinder competition with China's market dominance. No earlier discrete event details are provided in the reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that a pro-PRC influence campaign broadened its operations across dozens of social media platforms, websites, and online forums, publishing content in at least seven languages to reach audiences well beyond a single region. The activity reflects a coordinated information operation designed to amplify narratives favorable to the People's Republic of China while increasing resilience through a wide, multi-platform presence. Researchers said the network went beyond online messaging and attempted to physically mobilize protesters in the United States, marking an escalation from digital influence into real-world action. The campaign's multilingual reach and cross-platform distribution indicate a sustained effort to shape public discourse, extend audience penetration, and translate online propaganda into offline political activity.
Jul 12, 2026
OpenAI said two likely China-linked influence operations used ChatGPT to generate images and social media posts aimed at divisive U.S. debates over AI infrastructure and trade policy. The clusters, dubbed **"Data Center Bandwagon"** and **"Tech and Tariffs,"** produced English- and Chinese-language content that portrayed data center expansion as driving up electricity prices, straining power grids, consuming water, and harming the environment, while separate posts framed U.S. tariffs as a covert tool for controlling the global technology landscape. OpenAI said the operators likely originated in China, used VPNs, prompted ChatGPT in simplified Chinese, and posed as Americans on platforms including **X** and **YouTube**. OpenAI assessed that neither campaign achieved meaningful engagement and found no evidence the operators created the underlying controversies or materially shaped them, but the activity showed how AI tools can be used to amplify existing domestic disputes. The company also found the actors used ChatGPT for operational support, including editing work reports containing OPSEC details and discussing ways to exploit Facebook’s ecosystem and evade Meta’s coordinated inauthentic behavior detection. A separate analysis said the activity appeared tied to a private Chinese technology contractor serving provincial government clients, reflecting a deniable, scalable model aligned with broader Chinese propaganda patterns and strategic competition over U.S. AI and data center buildout.
Jul 31, 2026
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026