[Special Topic] Gray Battlefield / 3 Waves of 'Breaking News' Simultaneously Flooding Pages, Cybersecurity Experts: Building Fan Pages Targeting Taiwan's Elections
B
bellala 央廣＠＠3h ago
On the afternoon of June 15th, breaking news with almost identical layouts suddenly appeared on Facebook, including 'National Alert Suddenly Rings Loudly,' 'Kaohsiung City Urgently Announces,' and 'Emergency Suspension of Work and Classes.' Cybersecurity experts believe this is a common tactic from China's Hebei Qinhuangdao-based 'Borderless Group,' aiming to drive traffic and build fan pages using real news, with the ultimate goal of preparing to interfere with Taiwan's local elections at the end of this year.
3 Waves of Breaking News with Identical Layouts, Dozens of Fan Pages Push Simultaneously Within Minutes
A cybersecurity expert familiar with the incident revealed that the three waves of breaking news – 'National Alert Suddenly Rings Loudly,' 'Kaohsiung City Urgently Announces,' and 'Emergency Suspension of Work and Classes' – were all real events that had been reported by the media. However, on the afternoon of June 15th, they were all presented with eye-catching text and highly consistent content, titles, and formats, leading to a concentrated flood of posts on Facebook by numerous fan pages within minutes, engaging in coordinated operations. In a short period, 383 posts were published, with the most intense period seeing 34 posts in 5 minutes, concentrated across 163 fan pages such as 'Fun Breaking News,' 'Soul Makeup Room,' 'Always Here,' and 'Don't Be Afraid. I'm Here.'
During these three waves of operations, these accounts would relay posts in the same order. Most posted intensively within minutes, with up to 14 different fan pages posting simultaneously in a single minute, averaging one account joining every 10 seconds. Experts analyzed that these fan pages cover different topics but post in the same order. Especially with dozens of accounts posting together in the same minute with a fixed sequence, it no longer resembles natural content dissemination. It's more like using the same backend and scheduling posts according to the same account list.
Cybersecurity experts pointed out that posts like 'National Alert' and 'Kaohsiung City Urgently Announces' were primarily initiated by Taiwanese news websites, with farm pages subsequently spreading the same content. As for 'Emergency Suspension of Work and Classes,' it was directly initiated by self-media, with multiple accounts following suit within 10 seconds. This method of amplifying existing material from news media through farm accounts is consistent with past cross-border manipulation tactics; that is, coordinated accounts use original media posts as material for flooding, attempting to attract followers through coordinated posting, thereby increasing follower counts and expanding the influence of fan pages.
Furthermore, after comparing the original post data, it was found that 98.4% of the 383 posts across the three waves had at least one comment with a link. Posts without comments embedded links, which would direct clicking users to content farms, allowing them to monetize through traffic.
Operators Mostly Overseas, Nearly Half of Fan Pages Have Changed Names to 'Wash' Their History
After cross-referencing Facebook fan page transparency information, cybersecurity experts found that among the administrators of these 163 fan pages, a staggering 154, or about 94.5%, were managed by overseas personnel. Among them, Hong Kong accounted for 106, Malaysia for 82, and even 17 had administrators explicitly located in China. Only 9 were managed purely by Taiwanese individuals. Additionally, the location for 22 fan pages could not be obtained, and 11 had their locations intentionally hidden by administrators, a common practice among overseas farm accounts.
Cybersecurity experts revealed that nearly half of these 163 fan pages, a total of 80, had changed their names, some up to 6 times. Many were repurposed from old pages containing pornographic or adult content. One fan page, currently named 'Breaking Entertainment News,' was originally named '18 Adult Pornography, Erotic Text, Erotic Pictures' when established in 2015. Another, now called 'Taiwan Fresh News,' was previously 'Sexual Happiness Classroom.' Sources analyze that by renaming old accounts with high follower counts, they can bypass the trust threshold for new accounts and quickly gain reach.
Comparing the last renaming dates of these 80 fan pages, it was found that pages renamed around the same time often shared the same management location and had similar original naming patterns. For instance, in October 2015, a batch of fan pages originally named 'I am Melaka,' 'I am Kedah,' and 'I am Terengganu' were renamed in the same month, with Melaka, Kedah, and Terengganu being Malaysian states. In early 2021, a batch of accounts originally with Malay or English names were uniformly renamed to Chinese movie and drama commentary fan pages within one to two months. Cybersecurity experts infer that many of these accounts were originally local or miscellaneous Malaysian fan pages, acquired and renamed en masse by the same operator into Chinese farm fan pages, representing the specific process of 'acquiring overseas accounts, nurturing them, and then deploying them.'
Suspected Origin from PLA System 'Borderless Group'
Based on posting patterns, overseas management, and traffic diversion to content farms, cybersecurity experts who have long studied overseas information manipulation believe this wave of operations is highly suspected to originate from the 'Borderless Group.' This group belongs to the PLA's cognitive warfare system. It originated in Qinhuangdao, Hebei, China, in 2014, formerly known as Wuwei Technology. It previously operated the well-known content farm 'Huanxiang Network.' In 2020, it signed a cooperation agreement with Qinhuangdao Radio and Television Station, gaining official endorsement. In 2023, the group's legal representative established a company in New Taipei City under the guise of daily necessities wholesale, which is believed to be a preliminary step in establishing a physical presence in Taiwan.
Scholars have previously exposed this group's modus operandi of controlling Taiwanese fan pages through Hong Kong accounts. Cybersecurity experts also point out that Wang Hongen, a scholar from the University of Nevada, Las Vegas, discovered in 2024 that several employees of this Qinhuangdao-based company controlled fan pages and groups to promote content farms. During the preliminary stages of the 2024 presidential election, they supported specific candidates and attacked the ruling party. The Tech, Democracy, and Society Research Center has also revealed that several active 'Complain About' series fan pages are actually controlled by the Borderless Group, and this operation involved fan pages like 'Complain About Girlfriend.'
Nurturing Fans Normally, Deploying During Critical Times, Experts: Preparing for Election Interference
Recent operations by the Borderless Group show signs of AI upgrades. During the US-Iran conflict in March 2026, Wang Hongen also noted in an article that the group used its non-political fan pages (e.g., parenting education, film and television, health and wellness) to publish pro-Iran and anti-US commentary articles. These articles originated from blogs on China's Sina.com, were originally in simplified Chinese, and the Borderless Group used ChatGPT to convert them to traditional Chinese. Furthermore, due to forgetting to delete AI prompts in their editing records, it was directly confirmed that the group used AI to rewrite posts tailored for Taiwanese audiences to attract them.
Cybersecurity experts warn that such operations typically use soft content like gossip, lifestyle, and health to 'attract fans' in large numbers, nurturing accounts into fan pages with a certain reach and diverting traffic to content farms for profit. Once it enters sensitive periods like elections, these accounts, having already accumulated a large number of followers, can switch from health and gossip to political messaging. Research by the Taiwan Democracy Lab in April this year found that the proportion of political content from accounts managed by the Borderless Group is usually low but significantly increases during election periods, warning that similar situations may recur in the 2026 local elections.
Cybersecurity experts advise the public to pay attention to the management location and renaming history of fan pages when encountering such sensational breaking news, and to be vigilant about unknown links embedded in comments. After all, today's breaking news might be about class suspensions, but tomorrow it could be a rewritten and packaged political message designed to guide people to support a specific candidate, thereby interfering with Taiwan's democratic elections.
Source Link: https://www.rti.org.tw/news?uid=3&pid=215647
How does this article make you feel?
0 people reacted