Interesting research:

TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.

• One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.
• Hong Kong’s democracy movement gets apps that leak. Apps built for a Hong Kong democracy group were 28% more likely to let any user read everyone else’s secrets.
• Asking for secure code didn’t help. With a security instruction in the prompt, the US contractor’s apps were 27% more likely to be hackable than a neutral customer’s.
• Westernized Qwen3-Coder closed all three gaps. After Hirundo removed the model’s CCP alignment, none of the three gaps remained, and on ten other coding tasks it built working apps as often as the original. It is available on Hugging Face.

I would like more details on how the bias was removed.

This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs.

Two weeks after Moscow’s full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst onto the set of the evening newscast. She held up a hand-drawn sign behind the anchor’s head that read: “Stop the war. Don’t believe propaganda. They’re lying to you!” She shouted, “No to war!” until she was dragged away.

No one has protested the war on Russian television since then, partly as a result of tighter security and a general climate of fear. But in October 2024, Margarita Simonyan, one of Russia’s chief propagandists, gave another explanation. A growing number of the RT network’s anchors, she explained to an interviewer, are not real. “That face doesn’t exist. We generated the voice and everything else.” They were, she meant, produced by artificial intelligence. In a follow-up interview with the newspaper Vedomosti, she spelled out the logic: “These anchors don’t need a salary or insurance,” she said. “They won’t get arrested, and the police won’t search their homes. It’s all wonderful and terrifying at the same time.”

This is AI’s promise to every autocratic ruler: the ability to maintain control without delegating tasks to unreliable humans. It is an extremely attractive prospect. No matter how powerful, dictators have always needed subordinates—censors, propagandists, security guards, police officers, intelligence analysts, and local bureaucrats—to carry out their orders. But subordinates always pose a potential threat. They could shirk, steal, lie, leak, or conspire against their boss. As a result, one of the oldest dilemmas facing autocrats is how to empower agents to carry out orders without also enabling them to turn against their leader. Autocrats have usually managed the tradeoff by filling key positions with mediocrities whose incapacity is, as the political theorist Hannah Arendt put it, “the best guarantee of their loyalty.” But this inevitably makes it harder for dictatorships to govern and survive crises.

AI appears to offer autocrats two ways to resolve this long-standing dilemma. First, it means they can now easily monitor and discipline their followers in real time. A change in a local official’s spending habits or meeting schedules can be flagged automatically by an AI system, without any need for self-interested informants. Second, AI can eliminate underlings altogether. By automating tasks that once required human discretion, rulers can replace unreliable intermediaries with faithful algorithms that cannot be bribed or manipulated. Officials in autocratic regimes have said as much. AI “can definitely replace half of officials,” Russia’s Digital Development Minister, Maksut Shadaev, told a Moscow data forum in April 2025, adding, “maybe slightly more.”

Yet these promises of a self-running state are illusory, because AI is never truly autonomous. Systems have to be built and maintained by a cadre of engineers and data scientists whose expertise political leaders cannot evaluate. The ruler who turns to AI to reduce a dependence on unreliable humans may end up relying, more blindly than before, on the few AI specialists who keep the system running. And this new digital Praetorian Guard may have the same weaknesses as the old, which makes it a threat to the ruler.

Eyes and Ears

China is in the lead when it comes to developing AI systems that can monitor or replace subordinates. Smart city programs in Beijing, Shanghai, and other urban centers use AI to track performance and centralize oversight of local officials who once operated in comfortable obscurity, subjecting them to an algorithmic performance review. China also developed a “Zero Trust AI system,” which it deployed across roughly 30 counties and cities over the past decade. This system cross-referenced more than 150 government databases to catch embezzlement and nepotism by local officials. It worked a little too well, flagging 8,700 officials before local governments, under pressure from the bureaucrats it was monitoring, began rolling it back. But Beijing has not gotten rid of its new e-government portals, which use automated systems for issuing documents and permits, reducing face-to-face interactions that bred petty corruption or favoritism. The Chinese Communist Party, meanwhile, has plowed ahead with researching what it calls “thought management,” or how to use AI to create microtargeted propaganda. China’s army of Internet commentators, once composed of paid humans, is already being replaced by bots.

Russia has been pursuing the same goals with a similar fervor. Moscow’s citywide facial recognition system, deployed across 200,000 cameras, was used to identify and apprehend protesters during the 2021 antigovernment demonstrations. The central government has started using automated data collection and aggregation to bypass regional officials who could taint the data or use it to promote their own interests. In 2023, Russia’s Internet regulator launched Oculus, an AI system that scans hundreds of thousands of images per day for prohibited content, including political content—orders of magnitude beyond what human censors could process. The Russian security service’s Meliorator tool has been used to create over a thousand profiles of fictitious Americans, primarily on X (formerly Twitter), to spread Kremlin narratives at a fraction of the cost of human troll farms.

Other autocracies are following in Beijing’s and Moscow’s footsteps. In April 2025, the United Arab Emirates created a Regulatory Intelligence Office that uses AI to draft and amend federal laws, work once done by legislative staff. A year later, UAE Prime Minister Sheikh Mohammed bin Rashid al-Maktoum announced that autonomous AI agents would take over half of the federal government’s operations within two years and that “the performance of ministers, directors general, and entities will be assessed based on their ability to adopt this transformation.”

These innovations may reduce the number of bureaucrats autocrats need. But they cannot actually create what dictators want most: a self-running state. Even AI-generated television anchors need people to build and maintain them, and censorship systems need people to retrain them as the vocabulary of dissent shifts. Behind every AI model, there is a small group of engineers and data scientists doing essential maintenance, and their work is so technical that rulers cannot understand it.

This dependence thus becomes another form of power. The engineers who maintain an autocrat’s surveillance apparatus, for example, can shape what the ruler sees. They decide what information is important enough to pass along and in what form to present it. They determine which threats get flagged, and they can adjust the algorithms that select what content gets suppressed and who gets arrested. And they can do this without anyone in the palace noticing. Autocrats who turn to AI to escape a dependence on unreliable subordinates have only transferred their vulnerabilities onto a new group of officials.

In fact, this new Praetorian Guard could be more dangerous than previous elites. That is in part thanks to the opacity of AI technology but also because this clique is much smaller. Roman emperors typically had tens of thousands of people serving in the Praetorian Guard; modern autocrats rely on standing armies. But with AI, autocrats will need only a small clique of engineers to build and maintain large-scale AI systems. This might benefit rulers since they will have fewer people to watch, yet it also concentrates points of failure, since a devastating disruption requires only a handful of engineers and makes it easier for members to scheme against the leader. The new guard’s members may also be indispensable. A dictator can replace generals without destroying the army. But running complex machine-learning systems requires such a specialized set of skills that engineers can be difficult to replace without disruptions, giving these actors great leverage.

The Indispensables

The importance of tech workers to autocracies has already become apparent. When IT specialists began to flee Russia after the full-scale invasion of Ukraine in February 2022, for example, the Kremlin responded not with threats but with inducements, offering tech workers deferments from conscription. It exempted their firms from taxes and subsidized their mortgages. When Russian President Vladimir Putin ordered the mobilization of 300,000 men seven months later, IT workers were granted full-on waivers. This might seem like overkill, given that an AI system needs only a few engineers to run it. But a regime cannot know in advance which engineers it will need, and it cannot train replacements quickly, so it has to hold on to the entire talent pool from which these few are selected.

These measures did not stem the outflow of roughly 100,000 specialists—about a tenth of Russia’s tech workforce—over the course of 2022. But Moscow stuck to bribery, because expertise is extremely difficult to conscript at gunpoint and because conscripted experts might be less likely to do as instructed. Even so, money and privilege cannot guarantee that these elites will stay loyal. Autocrats should recall the lesson of the original Praetorian Guard: for a time, it provided Roman emperors with protection and security. But then the praetorians discovered their own indispensability, and by the second century, they were auctioning off the empire to the highest bidder. This new set of elites can do the same. In June 2023, when the column of Yevgeny Prigozhin‘s Wagner paramilitary company moved up the highway toward Moscow, Putin depended on his security services to tell him what was happening. Future rulers in Putin’s position will receive such warnings through machines: intercepted communications sorted by software, camera feeds filtered through recognition systems, regional reports compiled into dashboards. The engineers who run those systems could strike a deal with an upstart challenger and then drag their feet. They could delay the data, let alerts arrive a few hours late, degrade feeds at inconvenient moments, or make a recognition system stop functioning. In that scenario, the ruler would be operating blind. The Praetorian Guard did not need to kill Emperor Nero to replace him. It simply had to abandon him for a rival.

These programmers are unlikely to seize power for themselves, because they are unlikely to carry what coup leaders ultimately require: guns. But there is already precedent for engineers using their power to shape leadership challenges. In 1991, when the Soviet army attempted to seize control from Mikhail Gorbachev, a handful of programmers at the Relcom network kept information flowing abroad and relayed Russian President Boris Yeltsin’s decrees to audiences inside the country and abroad. The plotters could not stop the news of Yeltsin’s defiance from spreading, and the coup collapsed within three days.

Slimming Down

AI will not let autocrats dismiss all their enforcers. Someone still has to make arrests and run the prisons, and autocrats can buy loyalty by offering supporters state jobs. But it will let authoritarians downsize, and the number of officials ultimately matters less than how the ruler oversees them. Keeping track of scheming or incompetent subordinates has always been the autocrat’s chief burden. AI could lighten it, letting rulers watch their officials more closely without paying as much active attention.

In the near term, then, AI may greatly benefit autocracies. Despite the many obstacles to deployment, the technology is already bringing autocratic regimes the upsides of cheaper surveillance, smarter censorship, and fewer human subordinates to fear and distrust. But for autocratic rulers, the temptations of artificial intelligence may re-create the same trap they are seeking to escape. The more a regime depends on AI, the more it depends on the people who keep AI running. And those people, like every other praetorian class in history, will quickly discover what their indispensability is worth.

Introduction

The modern cyber threat landscape has seen a fundamental shift in how threat actors manage and deploy their infrastructure. Advanced persistent threats (APTs) have almost completely moved away from static command-and-control (C2) servers, opting instead to build complex, multi-layered botnets known as Operational Relay Box (ORB) networks. 

Project ORBITAL (which stands for Operational Relay Box Intelligence, Tracking, & Analysis Lexicon) was established as a centralised intelligence matrix to track, analyse, and ultimately help defenders disrupt this highly evasive infrastructure.

To construct these networks, adversaries systematically compromise unpatched, end-of-life devices. By targeting legacy, unpatched Small Office/Home Office (SOHO) router and Internet-of-Things (IoT) devices attackers can create a sprawling, decentralised mesh of proxy nodes. By routing their operations through layers of compromised devices, adversaries mask their true origins, making malicious activity blend seamlessly with legitimate regional traffic.

Blogs by my colleagues at Team Cymru as well as Google offer detailed explanations as to why and how these ORBs have grown over many years and continue to expand.

Project Background

Project ORBITAL represents a centralised Open Source Intelligence (OSINT) collection driven by public reporting from advanced research teams across the cybersecurity and technology sectors. This initiative aggregates telemetry and findings from top-tier vendors including Cisco Talos, CrowdStrike, Google, GreyNoise Labs, Lumen Black Lotus Labs, Microsoft, SecurityScorecard, Sekoia, SentinelLabs, Sygnia, and Team Cymru. Furthermore, it incorporates critical alerts and intelligence shared publicly by United States government agencies, specifically the Federal Bureau of Investigation (FBI), the Cyber National Mission Force (CNMF), and the National Security Agency (NSA).

This repository builds on the methodology of my previous OSINT tracking initiatives. It is heavily inspired by the structure and community success of my earlier matrix projects, specifically the Ransomware Tool Matrix (RTM) (here), the Ransomware Vulnerability Matrix (RVM) (here), and the Russian APT Tool Matrix (RUTM) (here). By applying a similar, structured approach to mapping Operational Relay Box (ORB) networks, this project aims to provide defenders with a clear, actionable lexicon for hunting and tracking evasive edge-device botnets.

Graph Visualisation

Once Project ORBITAL was initially assembled, it was then possible to use a GitHub Action automation with NetworkX and PyVis to create a Graph Visualisation using the data collected. Once in this view, some interesting patterns could be observed.

Analysis of the extracted data uncovered that ASUS devices were the most targeted out of all of the targeted devices by ORBs from the public reports.

Another interesting point the graph highlighted is that the LapDogs ORB network had the highest number of reported targeted devices.  

In most reported scenarios, a singular threat group used a dedicated ORB network. However, from extracting the details from the Google and SentinelLabs reports, an adversary like APT15, reportedly leverages both SPACEHOP and PurpleHaze ORB networks, alongside two other separate adversaries UNC2630 and UNC5174.

The overlap in ORB usage suggests these APTs aren't all building their own botnets from scratch. These overlaps likely indicate there are provisioning teams, such as specialised contractors, like Beijing Integrity Tech, who build and maintain these ORB networks and then lease access to the broader Chinese intelligence community in the Ministry of State Security (MSS) and People’s Liberation Army (PLA).

Panda-monium

Below is the list of well-known China-nexus APTs listed using CrowdStrike’s naming scheme and their Google or Microsoft aliases that are all mentioned in Project ORBITAL.

1. CAULDRON PANDA (aka UNC3886)
2. ETHEREAL PANDA (aka Flax Typhoon)
3. JUDGMENT PANDA (APT31, Violet Typhoon)
4. KEYHOLE PANDA (aka UNC2630, APT5)
5. MURKY PANDA (aka Silk Typhoon)
6. VANGUARD PANDA (aka Volt Typhoon)
7. VIXEN PANDA (aka APT15, Nylon Typhoon) 

The most notable aspect about this list is that it contains APTs with wildly different mandates. VANGUARD PANDA (Volt Typhoon) is famous for pre-positioning within critical infrastructure with the potential disruptive attacks, while KEYHOLE PANDA (APT5) and JUDGMENT PANDA (APT31) are long-running cyber-espionage and IP theft operators. The fact that both the saboteurs and the spies have all adopted ORB networks goes to show that this tactic is not niche but instead is the baseline standard for Chinese APT operational security (OPSEC).

How to Access

You can find Project ORBITAL on my GitHub repository below:

Warning: Includes graphic descriptions of animal harm and images of animal parts from the outset.

A Bellingcat investigation has uncovered a Myanmar-based wildlife trafficker who has operated openly across social media for at least six years, claiming to have sold tiger bones, rhino horn, elephant skin and other products from protected and endangered species to customers in Myanmar, China and Thailand.

By analysing hundreds of adverts and customer conversations, Bellingcat traced more than US$21,000 in sales, identified cross-border shipments linked to multiple payment accounts, and geolocated the dealer’s home address. The seller frequently used graphic images to convince buyers that his wildlife products were genuine, sharing footage of animals before and after they were killed as proof of authenticity.

Following this investigation, Meta removed 10 Facebook accounts, WeChat suspended three accounts and revoked their payment functions, TikTok and YouTube each removed one account, and authorities in Myanmar and Thailand said they would examine the findings further.

On December 21 2022, a Facebook account shared a reel of a tiger cub lying unconscious beneath the caption: “Time for winemaking”, followed by several laughing face emojis. Four days later, the same account shared another reel, this time of an adult tiger lying motionless on an orange plastic sheet as a man approaches with a knife.

Two separate videos posted to Facebook by the account known as MB.

The account behind both videos belongs to Mei Ba (hereafter MB), a self-described Traditional Chinese Medicine (TCM) doctor based in Myanmar. In TCM, plants and animal products are used to prepare remedies based on established medicinal formulas. These remedies can take many forms, including herbal teas, simmered concoctions, ingredients steeped in wine, and pills. TCM is also sometimes associated with pseudoscientific beliefs, such as the idea that consuming an animal’s organ can nourish the corresponding organ in the human body.

A Bellingcat investigation has found that MB frequently advertises the trafficked parts of critically endangered and vulnerable species to customers in Myanmar, Thailand and China. An analysis of social media posts published by MB over six years found references to sales involving parts of bears, elephants, leopards, musk deer, otters, pangolins, rhinos, seahorses and tigers, all of which are protected species.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

Profiting from Protected Species

For at least six years, MB has used ten different Facebook accounts under versions of his name to advertise animal parts and products for sale, including those derived from vulnerable and protected species. 

MB has advertised tiger body parts and products, including skins and wine made from bones. Myanmar’s wild tiger population was last estimated at a minimum of 22 animals (in a 2019 study published before the civil war). Licensed tiger farms, described as being similar to zoos, also operate in the country. However, Myanmar law prohibits the killing of any tiger, wild or captive. 

Bellingcat has also identified adverts offering leopard body parts, including skin, bones and gallbladders, as well as a product described as a “whip”, a euphemism for a penis. Many of the adverts explicitly stated that the body parts came from wild animals. The Indochinese leopard is classified as critically endangered, with fewer than 800 mature individuals believed to remain in the wild across mainland South-East Asia.

MB has advertised body parts and other products derived from Asian elephants, an endangered species, including skin sold in pieces and powdered form, as well as their genitals.

One of MB’s more graphic posts showed a recently killed and butchered moon bear – a type of Asian black bear which is classified as a vulnerable species. MB has also advertised various bear body parts for sale, including paws, heads, gallbladders, bile and fat.

Whole rhino horns, as well as bracelets and medicinal products made from rhino horn, have been advertised by MB. Although rhinos have been extinct in Myanmar since the 1980s, the country remains a known transit route for rhino products moving from India to China and elsewhere in South-East Asia, suggesting the items advertised by MB originated outside Myanmar.

Rhino products as advertised by MB on Facebook. Labels added by Bellingcat.

Under Myanmar law, anyone convicted of killing, possessing or trading a “completely protected species,” or its parts, faces a minimum prison sentence of three years and a fine under a conservation law introduced in 2018. Completely protected species advertised by MB include Asiatic black bears, elephants, leopards and rhinos.

Bellingcat contacted multiple Myanmar government authorities for comment regarding MB’s wildlife trade. The Myanmar embassy in London confirmed receipt of Bellingcat’s request and said it would consult the relevant authorities in Myanmar. 

Convincing Customers

Counterfeits are common in the illegal wildlife trade. Buffalo horn is often carved to resemble rhino horn, while cattle penises are passed off as tiger parts. Much of MB’s promotional strategy therefore focuses on persuading buyers that his products are genuine. 

To market rhino horn, MB has posted images of the items on scales or held up against a light, which he claims demonstrates the texture of genuine horn. For tiger bones, in one post he said that a patch of skin would be left attached to demonstrate their authenticity. 

MB has also posted videos of recent leopard and tiger kills. He has shared footage of live tigers in cages followed by images of the same animals being butchered for their skins, bones, skulls, claws and fangs.

Bellingcat only analysed open source evidence, including social posts, customer conversations, visible transactions and shipping receipts. Therefore, the authenticity and composition of the wildlife products advertised or sold could not be independently verified.

Nevertheless, given the volume and graphic nature of these posts, MB’s ability to operate on Facebook for at least six years raises questions about why his accounts remained active up until Bellingcat contacted Meta.

Evading Platform Moderation

For years, MB has openly advertised his business on Facebook, posting hundreds of adverts across ten profiles and various groups. He often uses coded language, including Chinese-language euphemisms in his comments. 

For example, he uses “eraser” (橡皮) to refer to “elephant skin” (象皮), a Mandarin homophone with characters that are also visually similar, shown below.

MB also uses pinyin, the phonetic system for spelling Mandarin Chinese words using Latin letters. For example, in one post, he abbreviates the pinyin word for “rhino” (xīniú) as “X”, advertising “X horn powder”, and uses “Y” (pinyin: yào) as shorthand for “medicine”. He also frequently uses animal emojis, including tiger, elephant, rhino, deer and bear, to refer to products derived from those animals without naming them directly.

Asked why MB had been able to operate for so long without being banned and how it detects common evasion tactics such as coded language, Meta responded: “Bad actors constantly evolve their tactics to avoid enforcement, which is why we partner with groups and invest in tools and technology to detect and remove violating content.”

Cross-Border Trade

To map the scale of MB’s business, Bellingcat analysed more than 500 screenshots of customer conversations spanning May 2021 to May 2026. Originally taking place on Facebook, Viber and WeChat, these exchanges were later reposted by MB on Facebook.

Often blurred or cropped, the material appears to have been shared as part of a strategy to present MB as a trusted seller who reliably delivers to customers. However, given the content frequently included shipping labels with names and addresses, product descriptions, and price discussions, Bellingcat was able to trace part of MB’s customer base and income. Notably, only content MB chose to repost was available for analysis, meaning the findings represent only a sample of his overall activity. 

Across the dataset, Bellingcat identified more than 150 transactions totalling US$21,000. The United Nations estimated Myanmar’s annual per capita income at between $300 and $430 in 2023.

Bellingcat analysis of MB’s digital footprint showing revenue earned per species by MB. Currency in US$. Trade values are estimated based on yearly average black market exchange rates.

Based on delivery records, Bellingcat identified 119 deliveries within Myanmar, 27 to mainland China, and nine to Thailand. Within Myanmar, shipments were most often sent to shared pickup points in cities or towns, whereas those to China were more frequently sent directly to individual addresses. 

Shipments within Myanmar most often involved small quantities of powders or medicines, such as 3 to 7 g of rhino horn powder or 5 g of bear gall bladder. By contrast, deliveries to China more often included whole animal parts such as rhino horn or tiger bones, or larger quantities of products, including 500 g to 1 kg of elephant skin powder or 10 to 40 bottles of medicine.

MB’s highest-value recorded transaction was to a customer in Yiyang, Hunan Province, China and involved two tiger femur bones weighing just over 2.5 kg. Sold in July 2022, the bones fetched 23,500 Chinese Yuan (US$3,494). The customer was asked to provide a screenshot as proof of payment. MB later reposted this on Facebook, alongside a photograph of the bones wrapped in cling film and a shipping label for Deppon Logistics attached. 

Bellingcat contacted Deppon Logistics for comment, sharing the image and tracking number shown below, but received no response at the time of publication.

Under Chinese law, buying, transporting, or selling protected or endangered species can, in the most serious cases, carry prison sentences of more than 10 years. Asian elephants and wild tigers are listed as “Class 1” protected animals. A permit system does exist for the use of captive-bred tigers, although it remains controversial. 

Under the Convention on International Trade in Endangered Species of Wild Fauna and Flora (CITES) Appendix I, international trade in any endangered species, including Asian elephants and tigers, as well as their derivatives such as skin powder, scales and bones, is prohibited. China, Myanmar and Thailand are all parties to the treaty. 

Bellingcat contacted the General Administration of Customs of China for comment on MB’s wildlife sales to China but did not receive a response at the time of publication.

Related articles by Bellingcat

Asia-Pacific

The Hunt for Malaysia’s Elusive Wildlife Trafficker

Bellingcat also found evidence of nine deliveries to Thailand, including a tiger penis and several TCM powders said to contain dog, yak and seahorse, all species regulated by Thai law and protected under CITES.

The Thai Natural Resources and Environmental Crime Division told Bellingcat that it already monitors packages falsely declared as traditional medicine but found to contain protected wildlife parts or ingredients derived from them. Following Bellingcat’s findings on MB’s activities, the division said it would investigate further.

A large proportion of MB’s exports to all three countries were bottles of TCM powders or tablets. For example, a “kidney replenishing medicine” was purported to contain deer, dog, gecko, praying mantis, seahorse and yak, while a “prostate medicine” was said to include deer, seahorse and dog. 

Under Chinese law, all packaged TCMs must carry labels clearly displaying the manufacturer’s name, full ingredient list, production and expiry dates, and information on side effects and safety. None of these details were present on MB’s labels.

Multiple banks accounts

Over six years of reposted conversations with customers, Bellingcat observed MB requesting payments to at least 15 different accounts, including seven via WeChat Pay, two via Alipay and six via third-party bank accounts, which MB described as belonging to friends or family.

For example, in May 2022, a customer purchased 1kg of elephant skin powder to be shipped to Chiuchow, Guangdong Province, China. MB told the customer his WeChat account could not currently receive the payment and instructed them to send the funds to his “sis” [female associate], shown below.

Both WeChat Pay and Alipay’s terms and conditions prohibit the use of their services to receive payments for illegal activities.

After being contacted by Bellingcat, WeChat suspended three accounts, revoking all payment functions and removing associated content. 

Alipay did not respond to Bellingcat’s request for comment.

Identifying MB

MB’s brazen online activities include operating at least ten Facebook profiles, two TikTok accounts, one WeChat account and one YouTube channel. He is the sole administrator of a Facebook group with nearly 1,000 members. Across these platforms, he has amassed some 12,000 followers. 

While using variations of “Mei Ba” (MB) across most of these accounts, he also uses the Chinese name “Mei Xiangfu” on his personal WeChat account. The name “May Kyin Phu” also appears alongside payment QR codes when customers are asked to transfer funds. Below is a QR code for Myanmar’s largest bank, KBZ, which includes what appears to be MB’s legal name: U May Kyin Phu, with “U” used as an honorific equivalent to Mr.

Since 2019, MB has used the same ID photo as his profile picture across multiple platforms, as well as his wedding photo as his TikTok profile picture and Facebook banner image. His wife, identified in the wedding photo and in other images posted by MB, has also been found advertising vulnerable and protected species via her Facebook account.

With more than 3,100 followers, she frequently reposts MB’s adverts while also sharing screenshots of conversations with customers. For example, in one WeChat exchange later reposted to Facebook, she discusses the cash sale of five “real” tiger penises.

From MB’s posts, Bellingcat geolocated a house in Lashio, eastern Myanmar, used to photograph animal parts for sale in his advertisements. MB has posted content from this property since 2020.

In the images below, what MB describes as “leopard gallbladders” can be seen hanging from a balcony, revealing the layout of the property’s backyard and the rooftops of adjacent buildings. Although Lashio is not covered by Street View, the distinctive roof visible in MB’s images matched with user-uploaded photographs on Google Maps.

Bellingcat contacted both MB and his wife for comment on the findings of this report. Both were reached via WeChat and appear to have received the request, but did not reply at the time of publication.

Data visuals by Galen Reich, Graphics by Merel Zoet, Editor, Claire Press.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Rhino Horn, Leopard Skin and Tiger Claws Sold Openly on Facebook appeared first on bellingcat.

The challenges of conducting open-source research in China are well-documented. Consistently named one of the most digitally oppressive countries in the world, China blocks some of the world’s largest social media platforms, such as Facebook, Google, and YouTube. Those that are still accessible are mostly Chinese-owned, strictly regulated and monitored in real time by AI systems as well as tens of thousands of “internet police”. 

But despite these strict controls, Chinese apps – which boast more than a billion estimated users – remain an information goldmine for investigative journalists covering stories both within and outside China.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

Since most foreign sites are banned, Chinese platforms are the largest resource available to journalists and researchers interested in what’s going on in the world’s second-most populous country. Even when a topic is being censored, patterns in the censorship can themselves serve as investigative leads: a 2020 BuzzFeed News investigation, for example, mapped out detention camps in Xinjiang by examining areas that had been blanked out on China’s Baidu Maps.

With millions of Chinese people living overseas, social media activity by members of the diaspora can also turn into global stories.

Serial rapist Zou Zhenhao, a Chinese PhD student, was jailed in London last year after one of his victims posted a warning on Xiaohongshu, also known as Little Red Book or Rednote, an app popular with young Chinese women living abroad. Another woman Zou had raped reached out to the original poster, who put her in touch with the police – leading to the conviction of a man described by police as possibly one of the worst sexual predators in British history.

Founded in 2013 as a Hong Kong shopping guide, Xiaohongshu has evolved into a lifestyle and e-commerce platform that has been compared with Instagram, Pinterest and Amazon. Last year, it reported about 300 million monthly active users, rivalling some of China’s largest social media platforms.

The app’s 600 million daily searches by the end of 2024 also accounted for half of market leader Baidu’s search volume, demonstrating that it is emerging as a critical search and discovery engine, not just a social platform.

Although primarily a Chinese-language app, Xiaohongshu gained attention in the English-speaking world last year, when millions of American TikTok users flocked to the platform in anticipation of a TikTok ban under US President Donald Trump. 

Responding to the surge of international users – sparked by the #TikTokRefugees trend – Xiaohongshu rolled out an AI-powered translation feature, making the app more accessible to non-Chinese audiences. This also meant that journalists without Chinese language skills can more easily communicate on and navigate the platform.

Despite its growing popularity both within and outside China, the app is relatively new and underexplored compared to more well-established platforms such as Weibo. 

This guide aims to provide a starting point for those looking to explore Xiaohongshu for open-source investigations, including an overview of its main user demographics, potential topics to explore and strategic search methods specific to the app. 

User Demographics and Topics

According to Xiaohongshu’s official data, the platform’s demographic profile is mainly young, female and urban. As of 2024, 70 percent of its users were women, with half of all users belonging to Gen Z and living in China’s largest cities. 

As previously mentioned, the app has also gained popularity with the Chinese diaspora. Many Chinese nationals living abroad use it as a search engine for local information, posting and searching for content related to their daily lives, from restaurant recommendations and apartment hunting to navigating foreign bureaucracies and finding community resources. 

This demographic profile makes Xiaohongshu particularly well-suited for investigating stories about consumer fraud and urban livability issues. For example, Chinese outlets like Jiemian have used Xiaohongshu posts to expose the grey-market ecosystem of paid reviews and fake endorsements tied to the platform’s e-commerce model, while in 2022, International Financial News traced a mother-and-baby store scam that defrauded over 400 parents back to product recommendation posts on the platform.

Given its predominantly female user base, Xiaohongshu has also evolved into one of China’s most important spaces for feminist discourse and women’s issues. Academic researchers have used content on the platform to analyse local discussions on menstrual shaming, sexual harassment, and the controversial “divorce cooling-off period” introduced in 2021. As Rest of World reported, women have increasingly congregated on Xiaohongshu, where they outnumber male users and have found ways to trick the app’s recommendation algorithm so their posts are shown mostly to other women.

The Relevance of Censorship

Political content and current affairs about China are largely absent from the app – a result of both active censorship and platform design. 

All Chinese social media platforms, including Xiaohongshu, operate under strict content moderation requirements from the Cyberspace Administration of China. A leaked 143-page internal document published by China Digital Times in 2022 revealed how Xiaohongshu censors respond to government directives in “real-time”, blocking content related to politically sensitive topics such as criticism of the Chinese Communist Party, labour strikes and student suicides. Xiaohongshu’s commercial focus also makes it less likely that these topics would be discussed on the platform: as Rest of World reported, the platform functions less like Weibo – a public square for current events – and more like “a giant mall, where shoppers tell each other what to buy”.

Related articles by Bellingcat

Resources

The Challenges of Conducting Open Source Research on China

Coverage of international affairs is also tightly controlled: only state-owned or state-controlled news organisations can obtain licences to publish original news content. However, content about life abroad, particularly stories about the cost of living, healthcare, or social problems in Western countries, circulates more freely on platforms including Xiaohongshu, and provide journalists with insight into how Chinese diaspora communities engage with local political systems. 

For example, when the 2025 Miss Finland was accused of making anti-Asian gestures, searching for “芬兰小姐” (Miss Finland) and “投诉” (complaint) on Xiaohongshu revealed a trove of collective action: users shared different complaint pathways, posted templates for filing reports, and documented various outcomes from their complaints. 

For such large-scale public events, Xiaohongshu can be both an organising platform and a rich source for tracking how diaspora communities coordinate responses to discrimination, providing journalists with insight into grassroots activism and transnational advocacy networks.

Getting Started

Xiaohongshu is available for download on both Apple’s App Store and Google Play worldwide, or can be accessed via a web browser. In international app stores, the app appears under the name “RedNote,” but this is the same application as Xiaohongshu – content and accounts are shared across both. The key difference is that RedNote users who register with overseas phone numbers are automatically tagged as international users, which affects the content the algorithm surfaces to them.

For users who download the app outside mainland China, Xiaohongshu automatically detects the device language and location. Upon first login, international users are prompted with an option to automatically translate all content into English (or their device language). If enabled, posts and comments will display with translations by default, and the algorithm will prioritise English-language content and posts created by or for international users, such as expat influencers.

For researchers and journalists seeking to observe the platform as Chinese users experience it, consider disabling automatic translation. This allows you to see content as it natively appears and helps you distinguish between posts created for international audiences versus those created for domestic users – a distinction that matters when assessing how representative your sample is for the relevant topic.

The default home feed, or the “Explore” tab, is where the algorithm surfaces content based on your engagement history, location and user profile. The feed uses a grid layout displaying post thumbnails with titles and like counts.

On the top right corner of the screen, the search bar also allows keyword searches across posts, users and topics. Results can be filtered by content type (e.g. notes, videos, users or products) and sorted by relevance or recency.

Using the Search Bar

Xiaohongshu’s search function is relatively basic. You can search by keywords and filter by time and location, but the options are general: time filters include “past day,” “past week,” or “past six months,” while location filters offer “same city” or “nearby”. 

For example, searching “Canada” returns posts tagged with that keyword, which you can then sort by recency or proximity. 

For breaking news events, try searching location names or names of individuals involved in the incident, filtering for the most recent posts to capture real-time reactions and on-the-ground accounts before they’re censored or deleted.

Xiaohongshu primarily uses algorithms to curate and push content through personalised feeds. For journalists using Xiaohongshu for investigative purposes, it can be useful to actively search for topics of interest to train your algorithm – the more you search and engage with specific content, the more relevant posts the algorithm will surface to you.

However, if you are researching the platform itself – studying what content Xiaohongshu promotes, how censorship operates, or what narratives dominate – you may want to start from a clean slate. In that case, consider periodically turning off personalised recommendations (Settings → Privacy Settings → Personalisation Options), clearing your browsing history, clearing cached data, or using a fresh account to observe what the platform shows to a “neutral” user.

Language and Lingo

During the influx of “TikTok refugees” in January 2025, Xiaohongshu launched a translation feature for users outside mainland China, enabling the automatic translation of comments and posts. 

However, this does not translate search queries. The platform’s search engine is still optimised for Chinese, though there is a “prioritise English” filter for overseas users, and searching in English will return some results.

But the language you search in shapes far more than just your results – it determines which version of the platform you see. When you search in English or use an international account, the algorithm treats you as a foreign user and surfaces content accordingly: influencers explaining why they love living in China, comparisons showing Chinese life favourably against the West. 

This isn’t a neutral cross-section of the platform – it is a curated bubble. To access what Chinese users actually discuss among themselves, it would be more effective to search in simplified Chinese and, ideally, use a China-registered account if you have access to one. If you don’t read Chinese, you can also consider using a translation tool (Google Translate, DeepL, or an AI assistant) to convert your search terms into simplified Chinese before entering them.

Despite such tools and the in-app translation feature, it is always useful when researching using Chinese platforms to work with a native speaker familiar with the local context. They can flag when an innocuous-seeming term actually carries hidden meaning, and help identify coded conversations about a censored topic.

On Xiaohongshu specifically, this coded language extends beyond political topics to include anything the platform’s algorithm might flag as “vulgar” or promotional. For example, users substitute fruits and neutral terms for body parts or sexual content to avoid being flagged as inappropriate – the peach emoji for buttocks, or 炒菜 (“cooking”) for explicit material. They may also use abbreviations and emojis for commercial terms to evade anti-marketing filters, such as “vx” (the abbreviation of how WeChat is pronounced in Chinese) or “绿” (“plus green”, apparently referring to WeChat’s green logo) for WeChat, or “米” (rice) or the moneybag emoji for money.

Advanced Search Strategies

For more sophisticated searching, consider using third-party marketing analytics tools like Xinhong and Qiangu, which can show trending topics, popular posts and engagement metrics, as well as identify key content creators posting about specific subjects. 

For example, on Xinhong, when you search for “Canada” in Chinese, it also shows show trending related searches such as “加拿大总理” (Canadian Prime Minister). Clicking through these suggestions leads to recent posts—for example, posts about Mark Carney’s latest statements at Davos, along with user comments and reactions.

While these tools are designed for marketers, they provide journalists with valuable capabilities: tracking how topics evolve, identifying influential voices in specific communities, and discovering related hashtags or discussions that might not surface through basic platform search. These tools often require paid subscriptions but can significantly enhance research efficiency for long-term investigations.

Another valuable feature is Xiaohongshu’s group chat function, where users gather around shared keywords and topics—from city-specific communities to niche interests. These groups are often highly active and provide access to candid community discussions that don’t appear in public posts. To find relevant groups, go to Messages → Group Square, where you can browse categories or search by keyword and request to join.

Monitoring active group chats related to relevant topics, whether that’s a specific city, industry, or issue, can help journalists and researchers stay updated on emerging issues and detect potential story leads before they become widely visible on public feeds.

Preserving the Evidence

Chinese social media content can disappear quickly and without warning due to censorship, making immediate preservation critical. 

Always take two preservation steps immediately upon discovering relevant content:

First, screenshot the entire post, including the URL, timestamp, username, like/comment counts, and location tags. These metrics establish context and authenticity. Use tools that capture full-page screenshots rather than just visible portions, as posts can be long and comments extensive. Second, archive the web page using services like archive.today or Wayback Machine. Note that these services capture only static content – comments and engagement metrics may not be fully preserved and should be screenshotted separately.

For Xiaohongshu specifically, always preserve the user’s unique ID found in their profile URL when viewed on a browser, which follows the format “user/profile/[unique ID]”. Users can change their display names, but this unique identifier remains constant, allowing you to track accounts over time even after name changes. This is critical for long-term investigations or when monitoring specific sources.

Xiaohongshu operates under the same legal and censorship constraints as all Chinese social media platforms, and researchers should approach it with appropriate caution. Content moderation is extensive: users who post about sensitive subjects risk having their content removed or their accounts suspended, and the platform is required to comply with government data requests. For researchers, this means the information you find represents only what has survived the censorship process.

That said, Xiaohongshu remains a remarkably rich resource for open-source research. Its strength lies precisely in its apolitical, lifestyle-oriented identity: while political discussion is suppressed, candid conversations about everyday life flourish. For journalists willing to invest in learning the platform’s rhythms, building Chinese-language search skills, and understanding its coded vocabularies, Xiaohongshu offers a window into how ordinary Chinese people talk among themselves – an area that remains largely untapped by international media.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Mining China’s ‘Little Red Book’ for Open Source Gold appeared first on bellingcat.

In this report, we describe how we tracked for several months a sustained espionage campaign against the government, media, and news sectors in several countries including Laos, Cambodia, Singapore, the Philippines and Indonesia.

Since early 2025, China’s involvement in the Indo-Pacific has been more prolific, from escalating maritime tensions, to being peacebroker in Myanmar’s military junta and more recently, espionage activities on joint exercises the Philippines naval forces have been conducting together with the US, Australia, Canada and New Zealand.

The attacker, which we believe is a China-nexus threat actor, showcases a love of DLL sideloading techniques in order to compromise their targets of interest. Governments and media are high-value targets because they shape policy, public opinion, and international alignment.

The report details the full attack chain of one particular compromise we discovered, and goes further into detail on victimology, other campaigns and finally lists indicators of compromise.

 Link to the report: https://cyberarmor.tech/blog/autumn-dragon-china-nexus-apt-group-targets-south-east-asia