Threat Management, Critical Infrastructure Security, Risk Assessments/Management

China-aligned information ops targets Western rare earth mineral firms

Mandiant researchers announced a Chinese-aligned operation called Dragonbridge that targeted rare earth mineral firms in the U.S., Australia and Canada. Pictured: The Chinese flag is raised inside the stadium during the closing ceremony of the 2022 Beijing Winter Paralympics on March 13, 2022, in Beijing. (Photo by Zhe Ji/Getty Images for Internati...

A Chinese-aligned information operation known as Dragonbridge targeted American, Australian, and Canadian rare earth mineral companies in an apparent bid to shore up Chinese market dominance, researchers at Mandiant announced Tuesday.

China produces the vast majority of the 17 rare earth minerals that are critical in the manufacture of electronics. As geopolitical and supply chain concerns have emerged, so has the sourcing of the rare earth minerals. China threatened an embargo of rare earths in 2019, during a trade war instituted by the Trump administration. Earlier this month, the United States, European Union and nine additional countries, including the UK, South Korea, Australia and Canada, signed an agreement to create additional supply.

"'It is something that's a necessity elsewhere that gives them a sort of a decisive advantage in negotiations and pressure they can put on others because rare earth metals are so important in the manufacture of modern goods and weapons," John Hultquist, vice president of intelligence analysis at Mandiant, told SC Media.

In June of 2021, the Department of Defense announced an agreement with the Australian firm Lynas to open a processing facility in Texas.

The social media campaign launched by the pro-Chinese group dates back only a few months and continued through June on Twitter. In it, Dragonbridge actors pretended to be Texan residents upset about health and environmental effects of the plant. Dragonbridge leveraged photographs from Malaysian protests against Lynas as well as comments from politicians of both parties responding to President Joe Biden's use of the Defense Production Act to ramp up domestic production. The group primarily posted in English, with additional tweets in Chinese and Malay.

This month, the attacks began targeting two additional companies, the U.S. importer USA Rare Earth and Canadian miner Appia Rare Earths & Uranium Corp, which announced a facility in Oklahoma. The tweets took a similar tact, singling out health concerns for workers as well as environmental concerns.

The campaigns do not appear to have been particularly effective.

Hultquist noted that the supposedly Texan tweets ranged in English proficiency, making some of the inauthentic tweets easy to spot.

But the bigger issue than affectiveness is a new reality where nations use information operations against businesses, pitting companies against better-resourced adversaries on a new front.

"When I first got into this business. There was this moment when companies recognized that they were going to have to deal with cyber espionage from governments. It was not something that they naturally understood; they were companies that didn't necessarily work for the DIB [defense industrial base]," said Hultquist. "They had to learn to deal with that risk or manage that risk. This is another similar type of risk that is now no longer just a problem of governments. It's going to be the private sector's problem, and it may affect their bottom line."

The shift of information operations from a matter of governments to a matter of business has been speculated on in the past but had yet to come to fruition in any consistent manner.

Mandiant linked this campaign to other Dragonbridge campaigns through previous tweets from the same accounts targeting "s content critical of the Chinese businessman Guo Wengui (Miles Kwok), former White House Chief Strategist Steve Bannon, and Chinese virologist Dr. Yan Limeng, as well as narratives pertaining to the origin of COVID-19," including a fake report from the Asian group the Milk Tea Campaign.

Joe Uchill

Joe is a senior reporter at SC Weekly, focused on policy issues. He previously covered cybersecurity for Axios, The Hill and the Christian Science Monitor’s short-lived Passcode website.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.