Tall Tales How Chinese Actors Use Impersonation and Stolen Narratives to Perpetuate Digital Transnational Repression
Tall Tales: How Chinese Actors Use Impersonation and Stolen Narratives to Perpetuate Digital Transnational Repression
In collaboration with the International Consortium of Investigative Journalists (ICIJ), we identified what we conclude to be two separate actors aligned with the People’s Republic of China. Operators tracked as GLITTER CARP both targeted and impersonated various ICIJ members, while SEQUIN CARP primarily targeted ICIJ journalist Scilla Alecci and other international journalists writing about topics of critical interest to the Chinese government. This dual targeting of the ICIJ—with distinct approaches and tactics—gives insight into the Chinese government’s practice of digital transnational repression (DTR) and its shift to a Military-Civil Fusion system of state-sponsored attacks carried out by private contractors. 🚀
The Chinese government has a long history of harassing its perceived overseas opponents. Under President Xi Jinping (2012-present), China is a leading perpetrator of transnational repression, with documented targeting against groups like Tibetans, Uyghurs, Falun Gong practitioners, Taiwanese independence advocates, and pro-democracy activists, which it views as the “Five Poisons.” A key component of the Chinese government’s campaign of transnational repression has been the use of digital threats against overseas opponents, including deploying malware to covertly surveil digital devices and using online platforms to amplify intimidation campaigns. 🔍
China’s approach to digital operations has evolved toward a more distributed model that increasingly depends on commercial actors to strengthen and extend the capabilities of state cyber actors. In 2017, Xi Jinping elevated Military-Civil Fusion (MCF, 军民融合) to a formal national strategy, requiring private companies to cooperate with state authorities and fostering a contractor ecosystem. Documents leaked from the Chinese contracting firm I-Soon (Citizen Lab tracks I-Soon as POISON CARP), revealed a system where private-sector contractors develop offensive cyber tools including spyware, phishing kits, and hardware implants, selling them to state customers such as the MSS, PLA, and local Public Security Bureaus. The I-Soon leaks also highlighted how cost-effective this model has been; collecting data from Vietnam’s Ministry of Economy was priced at approximately $55,000 USD, while access to a Vietnamese traffic police website was valued at just $15,000. Legal proceedings further reinforce this ecosystem: in March of 2025, the U.S. Department of Justice indicted 12 Chinese nationals alleged to have participated in a “hackers-for-hire” ecosystem operating at the direction of the MSS and Ministry of Public Security (MPS) to “…suppress free speech and dissent globally.” ⚖️
The implications of this industrialized model for communities vulnerable to digital transnational repression are significant. When offensive cyber capabilities can be procured at such low price points, the cost of targeting overseas diaspora communities drops substantially, lowering the threshold for governments engaging in transnational repression to conduct widespread campaigns. The outsourcing of operations to private security contractors also provides state actors with a layer of plausible deniability, allowing them to project power while complicating attribution. 🌍