Thousands of accounts with suspected links to the Chinese Communist Party (CCP) have been removed by social media platform X over the past month.
The accounts, which exhibited inauthentic activity, had been used to boost articles published by The New York Times that targeted a religious group persecuted in China.
One of the articles, a Chinese-language version of an attack piece on Shen Yun Performing Arts, was boosted so much it became the most shared New York Times article on X in more than a year, according to data from BuzzSumo, a social media analytics tool.
“It looks like a nation-state automated bot attack,” said Rex Lee, a cybersecurity expert at My Smart Privacy who has advised major corporations and government agencies, including the Department of Homeland Security and the National Security Agency.
Most of the accounts were taken down by X after The Epoch Times sent the platform the results of an extensive investigation into the issue. The platform then launched its own investigation.
“We take reports like these very seriously, and continue to action millions of accounts per week for platform manipulation and spam violations,” Dave Heinzinger, X’s head of media strategy, told The Epoch Times in an emailed statement.
The Target
The New York Times over the past eight months has published 10 articles attacking Shen Yun. Eight of them were also published in the outlet’s Chinese-language edition. The articles were all heavily promoted on X by accounts that don’t appear to be authentic users.
Shen Yun is a New York-based performing arts company that showcases traditional Chinese culture as it existed before communism. The company was founded by practitioners of Falun Gong, a spiritual discipline that includes meditative exercises and teachings based on the principles of truthfulness, compassion, and tolerance. The CCP sees Shen Yun, and Falun Gong more widely, as a threat because both make a point of exposing the regime’s human rights abuses.
The CCP has long been known to manipulate American social media, both through automated spam accounts and through deceptive “troll” or “shill” accounts.
The less sophisticated part of such operations relies on the CCP’s “50-cent Army,” a legion of thousands of low-paid workers tasked with making online posts in support of CCP goals.
The more sophisticated parts are likely run directly by CCP operatives or by the CCP military, the People’s Liberation Army (PLA), according to Casey Fleming, senior intelligence cybersecurity expert and CEO of Black Ops Partners, a company that advises major corporations, governments, and the military on intelligence, strategy, and cybersecurity.
Last year, several CCP whistleblowers came forward warning that in 2022, the CCP launched a new campaign against Falun Gong overseas, using Western media, social media, and social media influencers to besmirch the practice and various ventures founded by its practitioners, primarily Shen Yun.
The whistleblowers, who had high-level access to the CCP security apparatus, said the new campaign directly utilizes information collected by CCP intelligence networks to craft malicious narratives against Falun Gong. One of the individuals identified by whistleblowers as being used by the CCP in this way stated on X that he assisted The New York Times with its articles targeting Shen Yun.
The New York Times didn’t respond to a request for comment.
Social media companies are well aware of the CCP bot and troll problem. Meta, which operates Facebook and Instagram, produced a report in 2023 that discussed its efforts to identify and take down a network of thousands of CCP-linked accounts across more than 50 platforms “that were part of what appears to be the largest known cross-platform covert influence operation in the world.”
One such network, dubbed “Spamouflage,” was used to interfere in the 2024 election by hijacking political conversations. It also targeted human rights groups critical of Beijing, according to Graphika, a firm that tracks online networks.
Army of Bots
The Epoch Times analyzed X data available through BuzzSumo and discovered that an unusual volume of threadbare X accounts, with few to no followers, posted The New York Times’ main attack article on Shen Yun published in August 2024, as well as the other nine articles the paper produced against the company since then.
The Chinese-language version of the main hit piece was posted and reposted on X more than 28,000 times, making it the most shared New York Times article on X for the past year and the second most shared in more than two years, according to BuzzSumo data.
But fewer than 6 percent of the accounts that shared the article had more than 50 followers. That is extremely unusual. The number is well above 90 percent for other New York Times articles or for Epoch Times articles that gain traction on X, according to a review of BuzzSumo data.
In fact, 80 percent of the accounts that shared the Chinese-language hit piece had no followers at all.
Low follower count is one of the signs of bot activity, Lee told The Epoch Times. Other tells include repetitive posts, little or no engagement with other accounts, or high-frequency posting.
“There’s also an echo chamber effect, where some bots operate in networks, retweeting, liking each other’s posts,” he said. The Epoch Times manually reviewed the content of hundreds of the low-follower accounts and found clear signs of inauthentic activity. Typically, such accounts were set up around April 2024 or later and only posted or reposted anti-Falun Gong content.
Some only ever posted one or more of the New York Times articles attacking Shen Yun. Others posted large amounts of anti-Falun Gong content, often crude cartoons mirroring CCP propaganda that portray Falun Gong as death or the devil and they make extreme anti-Falun Gong comments.
Some of the accounts were set up earlier, in late 2023 and even go back as far as 2019. Those accounts often started off posting some generic content, such as photos of nature, architecture, young women, or various viral videos.
Over time, they started to mix in some anti-Falun Gong content or at some point switched to exclusively anti-Falun Gong content.
“It’s another way of them trying to get credibility of having those accounts being aged,” Fleming said.
Commonly, such accounts used inauthentic profile photos. Some pictures, it appears, were computer generated, others stolen or purchased from the internet. In many cases, they used images of young women. Sometimes, they also posted content praising China or the CCP or they'd attack other Chinese dissidents.
How a one man boy farm looks like. There are more computers around.
— Defense Politics Asia (@DefensePolitics) March 9, 2025
The bots also seemed to simulate human behaviors like going in and out of the X app.
By the way, the background voice is speaking in chinese in a very deep accent pic.twitter.com/9nncqyDZps
Upon alerting X to the issue, The Epoch Times reviewed hundreds of accounts that shared the main Chinese-language hit piece and found that X suspended more than 96 percent of the accounts with only one or no followers.
The enforcement has been much spottier for accounts with more followers, where The Epoch Times found that the majority of accounts exhibiting inauthentic behavior remained active. The Epoch Times then randomly picked and manually reviewed about 100 such accounts and provided them to X, upon which 75 percent of them were suspended or restricted.
The bot campaign appears to be persisting. The Epoch Times found new accounts, set up in December and January, solely dedicated to anti-Falun Gong propaganda and sharing the New York Times attack articles.
The efficiency of such operations has been greatly increased by artificial intelligence (AI), Fleming and Lee concurred. An AI platform can generate semi-believable usernames, profile bios, and profile pictures, and constantly pump out bot accounts.
Even among larger accounts that have shared the main New York Times hit piece—those with more than 10,000 followers—about half showed clear signs of inauthentic activity, The Epoch Times found.
Typically, this type of inauthentic account had been set up between 2008 and 2016 and was dedicated to a specific purpose, such as marketing a business. Yet it ceased posting content years ago. Then, some time between 2022 and 2024, the account started posting again, only this time, the content was anti-Falun Gong propaganda or comments disparaging Falun Gong, usually in Chinese.
Sometimes, the oldest posts on such accounts only go back a year or two, indicating that any previous content had been deleted.
Inauthentic account operations on X have long been known to use hijacked or purchased older accounts with an already established follower base, Fleming said.
X policies prohibit such behavior.
A 2021 report by the Centre for Information Resilience described much the same methodology used by a network of social media accounts “to push pro-China, anti-Western narratives.”
Crypto Bots, Trolls, and Shills
A significant number of the accounts sharing the New York Times main hit piece were otherwise solely focused on crypto currencies and other topics popular in the crypto community, such as gaming, Elon Musk, and pictures of women.
Oftentimes, they had some pro-China content mixed in. At least in some cases, such accounts showed up in BuzzSumo data as having shared the New York Times hit piece, but when examined, the post no longer existed. Such accounts usually posted little or no original content.
Another category of likely inauthentic accounts was focused on opposing Falun Gong in replies to other posts. Almost all of their activity consisted of responding to posts critical of the CCP or supportive of Falun Gong with disparaging remarks, accusations, or various anti-Falun Gong content.
There were also accounts with the apparent purpose of supporting other anti-Falun Gong accounts. They focused on prolifically responding with praise and approval to social media influencers that have produced anti-Falun Gong content.
There were also some accounts that purported to be former Falun Gong practitioners. They were usually set up in 2024 and claimed that they had practiced Falun Gong for a long time, but recently abandoned the practice. Their activity was solely focused on pushing anti-Falun Gong content and promoting the anti-Falun Gong content of other accounts. They often made outlandish accusations. In some cases, they made openly pro-CCP comments.
In a typical bot operation, these accounts would be run by actual people with the goal of seeding content that could then be amplified by bots, according to Fleming.
Read the rest here...
