Thousands of accounts with suspected links to the Chinese Communist Party (CCP) have been removed by social media platform X over the past month.

The accounts, which exhibited inauthentic activity, had been used to boost articles published by The New York Times that targeted a religious group persecuted in China.

One of the articles, a Chinese-language version of an attack piece on Shen Yun Performing Arts, was boosted so much it became the most shared New York Times article on X in more than a year, according to data from BuzzSumo, a social media analytics tool.

“It looks like a nation-state automated bot attack,” said Rex Lee, a cybersecurity expert at My Smart Privacy who has advised major corporations and government agencies, including the Department of Homeland Security and the National Security Agency.

Most of the accounts were taken down by X after The Epoch Times sent the platform the results of an extensive investigation into the issue. The platform then launched its own investigation.

“We take reports like these very seriously, and continue to action millions of accounts per week for platform manipulation and spam violations,” Dave Heinzinger, X’s head of media strategy, told The Epoch Times in an emailed statement.

The Target

The New York Times over the past eight months has published 10 articles attacking Shen Yun. Eight of them were also published in the outlet’s Chinese-language edition. The articles were all heavily promoted on X by accounts that don’t appear to be authentic users.

Shen Yun is a New York-based performing arts company that showcases traditional Chinese culture as it existed before communism. The company was founded by practitioners of Falun Gong, a spiritual discipline that includes meditative exercises and teachings based on the principles of truthfulness, compassion, and tolerance. The CCP sees Shen Yun, and Falun Gong more widely, as a threat because both make a point of exposing the regime’s human rights abuses.

The CCP has long been known to manipulate American social media, both through automated spam accounts and through deceptive “troll” or “shill” accounts.

The less sophisticated part of such operations relies on the CCP’s “50-cent Army,” a legion of thousands of low-paid workers tasked with making online posts in support of CCP goals.

The more sophisticated parts are likely run directly by CCP operatives or by the CCP military, the People’s Liberation Army (PLA), according to Casey Fleming, senior intelligence cybersecurity expert and CEO of Black Ops Partners, a company that advises major corporations, governments, and the military on intelligence, strategy, and cybersecurity.

Last year, The Epoch Times reported that Chinese regime leader Xi Jinping in 2022 launched a new campaign against Falun Gong overseas, using Western media, social media, and social media influencers to besmirch the practice and various ventures founded by its practitioners. Several CCP whistleblowers confirmed the campaign was underway, primarily targeting Shen Yun.

The whistleblowers, who had high-level access to the CCP security apparatus, said the new campaign directly utilizes information collected by CCP intelligence networks to craft malicious narratives against Falun Gong. One of the individuals identified by whistleblowers as being used by the CCP in this way stated on X that he assisted The New York Times with its articles targeting Shen Yun.

The New York Times didn’t respond to a request for comment.

Social media companies are well aware of the CCP bot and troll problem. Meta, which operates Facebook and Instagram, produced a report in 2023 that discussed its efforts to identify and take down a network of thousands of CCP-linked accounts across more than 50 platforms “that were part of what appears to be the largest known cross-platform covert influence operation in the world.”

One such network, dubbed “Spamouflage,” was used to interfere in the 2024 election by hijacking political conversations. It also targeted human rights groups critical of Beijing, according to Graphika, a firm that tracks online networks.

Army of Bots

The Epoch Times analyzed X data available through BuzzSumo and discovered that an unusual volume of threadbare X accounts, with few to no followers, posted The New York Times’ main attack article on Shen Yun published in August 2024, as well as the other nine articles the paper produced against the company since then.

The Chinese-language version of the main hit piece was posted and reposted on X more than 28,000 times, making it the most shared New York Times article on X for the past year and the second most shared in more than two years, according to BuzzSumo data.

But fewer than 6 percent of the accounts that shared the article had more than 50 followers. That is extremely unusual. The number is well above 90 percent for other New York Times articles or for Epoch Times articles that gain traction on X, according to a review of BuzzSumo data.

In fact, 80 percent of the accounts that shared the Chinese-language hit piece had no followers at all.

Low follower count is one of the signs of bot activity, Lee told The Epoch Times. Other tells include repetitive posts, little or no engagement with other accounts, or high-frequency posting.

“There’s also an echo chamber effect, where some bots operate in networks, retweeting, liking each other’s posts,” he said. The Epoch Times manually reviewed the content of hundreds of the low-follower accounts and found clear signs of inauthentic activity. Typically, such accounts were set up around April 2024 or later and only posted or reposted anti-Falun Gong content.

Some only ever posted one or more of the New York Times articles attacking Shen Yun. Others posted large amounts of anti-Falun Gong content, often crude cartoons mirroring CCP propaganda that portray Falun Gong as death or the devil and they make extreme anti-Falun Gong comments.

Some of the accounts were set up earlier, in late 2023 and even go back as far as 2019. Those accounts often started off posting some generic content, such as photos of nature, architecture, young women, or various viral videos.

Over time, they started to mix in some anti-Falun Gong content or at some point switched to exclusively anti-Falun Gong content.

“It’s another way of them trying to get credibility of having those accounts being aged,” Fleming said.

Commonly, such accounts used inauthentic profile photos. Some pictures, it appears, were computer generated, others stolen or purchased from the internet. In many cases, they used images of young women. Sometimes, they also posted content praising China or the CCP or they'd attack other Chinese dissidents.

Upon alerting X to the issue, The Epoch Times reviewed hundreds of accounts that shared the main Chinese-language hit piece and found that X suspended more than 96 percent of the accounts with only one or no followers.

The enforcement has been much spottier for accounts with more followers, where The Epoch Times found that the majority of accounts exhibiting inauthentic behavior remained active. The Epoch Times then randomly picked and manually reviewed about 100 such accounts and provided them to X, upon which 75 percent of them were suspended or restricted.

The bot campaign appears to be persisting. The Epoch Times found new accounts, set up in December and January, solely dedicated to anti-Falun Gong propaganda and sharing the New York Times attack articles.

The efficiency of such operations has been greatly increased by artificial intelligence (AI), Fleming and Lee concurred. An AI platform can generate semi-believable usernames, profile bios, and profile pictures, and constantly pump out bot accounts.

Even among larger accounts that have shared the main New York Times hit piece—those with more than 10,000 followers—about half showed clear signs of inauthentic activity, The Epoch Times found.

Typically, this type of inauthentic account had been set up between 2008 and 2016 and was dedicated to a specific purpose, such as marketing a business. Yet it ceased posting content years ago. Then, some time between 2022 and 2024, the account started posting again, only this time, the content was anti-Falun Gong propaganda or comments disparaging Falun Gong, usually in Chinese.

Sometimes, the oldest posts on such accounts only go back a year or two, indicating that any previous content had been deleted.

Inauthentic account operations on X have long been known to use hijacked or purchased older accounts with an already established follower base, Fleming said.

X policies prohibit such behavior.

A 2021 report by the Centre for Information Resilience described much the same methodology used by a network of social media accounts “to push pro-China, anti-Western narratives.”

Crypto Bots, Trolls, and Shills

A significant number of the accounts sharing the New York Times main hit piece were otherwise solely focused on crypto currencies and other topics popular in the crypto community, such as gaming, Elon Musk, and pictures of women.

Oftentimes, they had some pro-China content mixed in. At least in some cases, such accounts showed up in BuzzSumo data as having shared the New York Times hit piece, but when examined, the post no longer existed. Such accounts usually posted little or no original content.

Another category of likely inauthentic accounts was focused on opposing Falun Gong in replies to other posts. Almost all of their activity consisted of responding to posts critical of the CCP or supportive of Falun Gong with disparaging remarks, accusations, or various anti-Falun Gong content.

There were also accounts with the apparent purpose of supporting other anti-Falun Gong accounts. They focused on prolifically responding with praise and approval to social media influencers that have produced anti-Falun Gong content.

There were also some accounts that purported to be former Falun Gong practitioners. They were usually set up in 2024 and claimed that they had practiced Falun Gong for a long time, but recently abandoned the practice. Their activity was solely focused on pushing anti-Falun Gong content and promoting the anti-Falun Gong content of other accounts. They often made outlandish accusations. In some cases, they made openly pro-CCP comments.

In a typical bot operation, these accounts would be run by actual people with the goal of seeding content that could then be amplified by bots, according to Fleming.

“Those are what are called ‘anchor accounts,’ to give credibility to their movement of persecution and intimidation,” he said. “Usually, that person [operating such accounts] is a PLA soldier or a CCP operative.”

Such accounts would often interact with, reply to and share each other’s posts.

Despite not being automated, these accounts may be running afoul of X’s policies on deceptive behavior, such as the use of “manufactured identities” as well as impermissible multiple account operation and coordination.

Much the same dynamics that applied to The New York Times main hit piece also applied to the other attack articles on Shen Yun and Falun Gong. On average, more than 70 percent of the accounts that shared them on X had fewer than 10 followers.

By comparison, for other New York Times articles that have gained traction on X, the number is around 2 percent. For Epoch Times articles popular on X, the average number is less than 1 percent, according to a review of BuzzSumo data.

Whistleblowers Proven Accurate

The evidence of inauthentic activity pushing anti-Falun Gong content online aligns with the accounts of the CCP whistleblowers, who warned that the regime is trying to use social media to drive public opinion in America against Falun Gong.

The campaign was authorized directly by CCP leader Xi Jinping, according to some of the whistleblowers. It was authorized to use undercover agents within the Falun Gong community to cause internal division, other whistleblowers said. Indeed, some of the anti-Falun Gong accounts profess to have insider knowledge and some posted content indicating surveillance of the Falun Gong community in the United States.

Some accounts posted content that indicated detailed knowledge of personal, nonpublic information, such as family background of people within the Falun Gong community and even their activities, both in the United States and before they left China. Chinese dissidents have long been aware that the CCP is keeping tabs on them, but such information would rarely be used publicly by the regime.

“That shows you the trend and the brazenness of the CCP, that they’re no longer just operating in the shadows,” Fleming said.

“They’re actually coming out of the shadows. That’s a huge wake-up call.”

One whistleblower said the campaign seeks to preempt a scenario in which the U.S. government becomes sympathetic to Falun Gong to the point that the government launches a formal investigation into CCP’s crimes against Falun Gong practitioners in China.

The crimes include inhuman torture and forced organ harvesting on a large scale, numerous independent investigations have found. A formal investigation by the U.S. government, perhaps resulting in prosecution of CCP leaders involved in the crimes, could topple the regime, the whistleblower said.