Cyberattackers are targeting rare earth mining companies in a new campaign designed to keep China in a dominant market position.

Security

Cyber security 101: Protect your privacy from hackers, spies, and the government

Simple steps can make the difference between losing your online accounts or maintaining what is now a precious commodity: Your privacy.

Read now

On June 28, Mandiant published new research into Dragonbridge, a misinformation program focused on disrupting rare earth facilities. 

The rare earths market is driven by demand for consumer products, including smartphones and PCs, due to their role in the development of electronics, circuit boards, and batteries. The aerospace and military tech industries also rely on rare earth supplies. 

China is one of the world's largest exporters of rare earth elements. Despite the country's current dominant position, the Dragonbridge group, known to promote the political interests of the People's Republic of China (PRC), is working to disrupt suppliers and rare earth processors outside of the country. 

Dragonbridge is a vast network comprising thousands of accounts on numerous social networks and communication channels. According to Mandiant, the network has been active since 2019, twisting and publishing narratives online that benefit China's ruling party. 

However, recently, the researchers have monitored a change in tactics, leading to an expansion into misinformation campaigns targeting mining companies. 

Among the firms on the target list are Australian mining company Lynas Rare Earths Ltd. 

Now, Dragonbridge is turning its attention to Canada and the United States. This month, the misinformation group was linked to propaganda activities focused on tarnishing the reputations of Canada's Appia Rare Earths and Uranium Corp., as well as USA Rare Earth. 

Specifically, the group appears to be promoting material in criticism of new mining and production facilities. 

Appia has located a potential site for mining in Northern Saskatchewan, Canada, while USA Rare Earth intends to construct a new facility in Oklahoma later this year.

The misinformation network runs thousands of fake accounts on platforms including Facebook and Twitter. The majority of content is posted by fake concerned US "citizens" in English, with a scattering of posts also written in the Chinese and Malay languages. 

A potential reason for this shift in tactics is the US 2022 Defense Production Act (DPA) Title III. The act has been signed by US President Biden to encourage the domestic production of rare earths and other materials, thereby lessening reliance on exports from other countries, including China. 

It should also be noted that companies targeted by Dragonbridge are large enough that they could potentially threaten China's dominant position in the future. 

"While the activity we detail here does not appear to have been particularly effective and received only limited engagement by seemingly real individuals, the campaign's microtargeting of specific audiences suggests the possibility of using similar means to manipulate public discourse surrounding other US political issues to the PRC's advantage," the researchers said.

Mandiant has contacted the companies at the heart of Dragonbridge's campaigns, alongside the social networks used by the group to promote its narratives.

"An economic decoupling with China will only encourage more victimization of the private sector by Chinese actors," commented John Hultquist, VP of Mandiant Intelligence. "Unfortunately, businesses will be on the front lines of a fight that may not be fair."

Previous and related coverage

• Chinese hackers Deep Panda return with Log4Shell exploits, new Fire Chili rootkit
  
• Chinese hackers perform 'rarely seen' Windows mechanism abuse in three-year campaign
  
• Microsoft: Chinese hackers are targeting Zoho ManageEngine software
  

---

Have a tip?Get in touch securely via WhatsApp Signal at +447713 025 499, or over at Keybase: charlie0

---

Security

8 habits of highly secure remote workersHow to find and remove spyware from your phoneThe best VPN services: How do the top 5 compare?How to find out if you are involved in a data breach -- and what to do next

• 8 habits of highly secure remote workers
• How to find and remove spyware from your phone
• The best VPN services: How do the top 5 compare?
• How to find out if you are involved in a data breach -- and what to do next