China is running fake news websites in Korea to spread propaganda, NIS says

Chinese companies are spreading Chinese propaganda in Korea using 38 malicious websites in disguise of Korean news media, the National Intelligence Service (NIS) said Monday.

Home pages of fake news websites that pose themselves as Korean news outlets run by Chinese public relations companies Haimai and Haixun [NATIONAL CYBER SECURITY CENTER]

Chinese companies are spreading Chinese propaganda in Korea using 38 malicious websites in disguise of Korean news media, the National Intelligence Service (NIS) said Monday.

China-based public relations companies Haimai and Haixun circulated fake news, delivering pro-China and anti-U.S. messages, using websites they generated with addresses and names similar to Korean news media.

Some of the names they used include "Seoul Press" and "Busan Online," with domains seoulpr.com and busanonline.com.

These sites posed themselves as members of the Korean Digital News Association, an organization that oversees and manages the copyrights of news articles from its members posted online.

They also infringed on the intellectual property rights of Korean news organizations by republishing their stories without permission.

The intelligence agency identified the 38 websites in cooperation with Korean digital security firms, including EST Security, Wins and SK Shieldus.

In June, one of the malicious websites, Daegu Journal, ran an article titled "Nuclear waste water from Japan likely to affect Korean food supply chain," using the term "nuclear waste water" instead of more neutral "treated radioactive water."

The term reflects the Chinese government's opposition to Japan's treated water release. The website posed the article as a reliable report from a Korean news outlet.

In March, another fraudulent website named Seoul Press featured an article saying Korea will face more losses than gains by attending the U.S.-led Summit for Democracy.

"[The websites] incited pro-China and anti-U.S. sentiment by denouncing Korea's decision to co-host the summit as a misguided choice," an NIS official said.

They used video clips and comments to spread their political messages.

Replies in the comment section of an article published in one of the Chinese fake news websites that poses itself as a Korean news outlet. [NATIONAL CYBER SECURITY CENTER]

In October last year, they posted a YouTube link with the article titled "Mysterious experiment at U.S. military germ lab in Korea."

The article had replies that seemed to be written by non-native Korean speakers in its comment section, with IDs that are presumed to be randomly generated.

"It seems that they removed the logo from the Korean broadcasters' news clips and edited them as if the clips are produced by them," an NIS official said.

A U.S.-based cyber security company, Mandiant, listed 72 fraudulent websites owned by Haixun, which were caught by the NIS on its report in July.

Nine of them were providing services in Korean.

"In the past, these shady schemes used to target Western countries, mostly the United States. However, there is a growing number of attempts aiming at Koreans by creating false news websites and posts and circulating them on social media," the intelligence agency said.

Last December, a floating Chinese restaurant on the Han River in Jamsil, Seoul, faced an allegation of running a secret Chinese police station to identify Chinese people against Xi Jinping and force them back to China.

BY PARK HYUN-JU, LEE SOO-JUNG [lee.soojung1@joongang.co.kr]