By Alexandre Alaphilippe, Executive Director, EU DisinfoLab
In February 2024, CitizenLab unveiled an information operation dubbed “PAPERWALL”. This Chinese-originated influence operation has built a network of 123 dummy media outlets worldwide, with a strong presence in Europe. The exposed assets included a Belgian and a Luxembourg website.
PAPERWALL: a web of inauthentic online media outlets
From the perspective of an ordinary Internet user, Boic Post or Gaul Journal display all the typical characteristics of an online news site based in Belgium or Luxembourg. In the former, the content analysed for this investigation was mostly in Dutch (one of Belgium’s official languages) and touched on local topics related to the economy, housing, or political news. The latter presents the same type of content but in Luxembourgish, German, and French.
The two websites do not disclose the names or contact details of journalists working for these outlets. Moreover, there is no contact form, privacy section, or company name that could be held accountable for managing these sites.
Going further, the content has been copy-pasted from other sources; two verification methodologies allowed us to identify the original source that had been plagiarised.
First, we looked at numerous articles published in Boic Post or Gaul Journal and searched for similar wording using Google Dorks. A sample of 12 articles on each website returned the following results (see Appendix for table):
- Boic Post:
- Het Nieuwsblad: a daily newspaper circulating in Flanders;
- Belga: the Belgian press agency;
- Gazet Van Antwerpen: a daily newspaper circulating in Flanders;
- Gaul Journal:
- RTL: the national public broadcaster;
- Luxemburger Wort: a German-language daily newspaper;
- L’essentiel: a daily French-speaking newspaper.
The second verification flow consisted of reproducing CitizenLab’s evidence: investigating the provenance and hosting of images on the website. To do this, we inspected the source code of both websites and found that:
- Boic Post seems to refer to pictures hosted on the Het Nieuwsblaad website;
- Gaul Journal seems to refer to pictures hosted on the websites of RTL Luxembourg, Wort and its English version LuxTimes.
PAPERWALL dummy media outlets are updated more than once a day with fresh plagiarised content. Given the vastness of the network, it is likely that both the collection of external content and the publication are automated. EU DisinfoLab already showed this low-cost technique was used to populate online assets in the Indian Chronicles operation. However, low costs are made at the expense of credibility, as automation sometimes leads to reproducing errors or failure.
Having established that these websites are not producing original news content, one could wonder what the point of maintaining these assets is. Indeed, we did not notice any ads being displayed, which refutes the hypothesis these websites are designed to attract online advertising revenue.
However, one element stands out as striking. A part of the website content is not in Dutch or Luxembourgish but in English. And surprisingly, this English-speaking section does not touch on local news but blatantly promotes Chinese interests.
This content, collected under a category called “Press Release”, appears to be paid content promoting Chinese companies’ products or CGTN, media outlet owned by the Chinese Communist Party’s. The incoherent use of the English language in regional websites suggests that there is little effort to target local populations with advertising content directly. The exact reproduction of the same content indicates a strategy of providing multiple occurrences of the same content over a variety of apparently unrelated websites. Many online services provide this backlink service, designed to artificially grow visibility on search engine results, often at the expense of the final client. Looking deeper into the hosting of this allegedly paid content leads us to timesnewswire.com, another online asset where we could find the same content in the Press Release section promoted on PAPERWALL websites.
The TimesNewswire website description states that “TimesNewswire Can Guarantee Distribution to Top News Websites in the World. TimesNewswire distributes press releases in English, Korean Japanese, German, French, Italian, Arabic, Portuguese, Spanish.” The wording seems to indicate that the TimesNewswire’s objective is to circulate press releases to a network of websites. At this stage, there is no evidence showing that the PAPERWALL dummy media outlets, such as Boic Post or Gaul Journal, and TimesNewswire, are managed by the same actor. However, disinformation and smear campaigns observed on other related PAPERWALL websites, such as the campaign against Yan Limeng, have not been observed on the Belgium-Luxembourg assets. The reason for this is unknown.
Who’s behind it?
In 2022, Mandiant, a Google company, already exposed a very similar operation named HaiEnergy. CitizenLab makes a clear reference to this early exposure which should require the reader’s attention.
This operation has already been exposed in 2023 in other countries. On 25 October 2023, Il Foglio, an Italian newspaper, revealed a network of six fake news websites targeting Italian audiences, which were not registered as legitimate news outlets in Italy. These sites, each named after an Italian city followed by a generic term (e.g. ‘Venezia Post’ or ‘Roma Journal’), featured content heavily skewed towards China, raising suspicions of Chinese government involvement. This was further suggested by their connection to an IP address owned by Tencent, a major Chinese corporation. Additionally, on 13 November 2023, the South Korean National Cyber Security Center exposed eighteen similar fake news sites in Korea linked to a Chinese PR firm, Haimai, indicating a pattern of misinformation efforts attributed to Chinese sources.
What’s next?
Multiple media exposures of PAPERWALL seem not to disrupt the overall operation. However, in early March 2024, we noticed that access to the two websites described in this investigation was slow or failing. On some pages, an error message stated that the connection to the website’s database could not be established. We are unable to provide an assessment of the cause of these failures. On the other hand, the publications of press releases in TimesNewswire were still active in early March 2024.
APPENDIX
To support further research, a STIX file is available for research organisations using the Disarm Framework format.
TTPs
Following the Disarm Framework, we identified some Tactics, Techniques, and Procedures that PAPERWALL has implemented to conduct its operation. This list is not exhaustive.
T0098 “Establish Inauthentic News Sites”
The main technique used in this operation is establishing a network of inauthentic news sites or dummy media outlets. This technique has been employed in similar information operations revealed by EU DisinfoLab, such as Indian Chronicles, Doppelganger, or InfoRos. Many malicious actors rely on creating assets whose names recall news organisations to piggyback on the credibility associated with the media. Nevertheless, in this case, these websites lack any legal mentions, a privacy policy, or an “About us” section.
T0072.001 “Geographic Segmentation”
From our observation, these websites (and others present in the same network) share many similarities:
- The website design and naming policy are very similar;
- The hosting of these websites is on the same IP addresses;
- Each website is dedicated to a specific region or country.
This effort to localise content clearly shows that the operators have been conducting geographic segmentation targeting specific audiences and languages, i.e., Dutch speakers in Belgium and Luxembourgish speakers in Luxembourg.
T0084.002 “Plagiarise Content”
A major issue malicious actors face when establishing inauthentic news websites is populating these sites with legitimate content. However, producing local content is a costly task and, therefore, incompatible with the business model of “pay to play” websites, where actors remunerate intermediaries in exchange for online visibility.
In the case of PAPERWALL, the operators have plagiarised content from legitimate sources such as:
- Pictures from Het Nieuwsblad, RTL Luxembourg, Wort.lu;
- Written content from Het Nieuwsblad, Belga, Gazet van Antwerpen, L’essentiel, Wort, RTL.
T0049.007 “Inauthentic Sites Amplify News and Narratives”
It is noteworthy that this operation does not appear to have engaged with social media amplification but has relied mostly on the reproduction of content across multiple dummy news outlets.
The previously described techniques consist of concealing/masquerading the inauthentic online content vehicles used to host news and narratives. The narratives can be categorised into two groups:
- Press releases from Chinese companies (car manufacturers, bitcoin platforms);
- Press releases from Chinese Communist Party media, such as CGTN.
