Russia's Hybrid War Against the West Relies More Than Ever on Chinese Infrastructure

Photo: Rafael Henrique

A few weeks before Romania's presidential election, 25,000 fake TikTok accounts emerged in support of the surprise candidate Călin Georgescu. In mid-November, the Chinese cargo ship Yi Peng 3 was disrupting communication cables in the Baltic Sea. These events characterize the past year as examples of Russian hybrid operations leveraging Chinese infrastructure.

Marek Kohv, head of the "Security and Crisis Resilience" research program at the International Center for Defense and Security (ICDS), states that collaboration between Russia and China in the area of disinformation is a reality. “In 2019, they signed a cooperation agreement committing to ‘stand for truthful and factual information worldwide’—whatever that actually means,” he remarks.

“Leaked materials from related meetings show that Russia was mainly interested in China’s Great Firewall—how to block VPNs, stop people from using [the anonymity software] Tor, and restrict internet access in general. Meanwhile, the Chinese were eager to learn how Russia employs disinformation to influence public opinion, such as inciting unrest,” Kohv explains.

Commenting on the events on TikTok during Romania's presidential elections—whose results have since been annulled—an ICDS expert notes that it’s hard to determine whether this was an instance of Russian-Chinese cooperation, coordinated activity, or simply Beijing looking the other way.

Marek Kohv investigates Russia's hybrid warfare activities at the International Center for Defense and Security.
Marek Kohv investigates Russia's hybrid warfare activities at the International Center for Defense and Security. Photo: Sander Ilvest

“It’s clear that TikTok’s response was inadequate, and those fake accounts were essentially allowed to operate until the last moment. If evidence emerges showing that China and Russia genuinely collaborated in this, it would be very serious,” he remarks.

Kohv points out that unlike other social media platforms, such as Facebook or Twitter, TikTok is a Chinese company and operates under the principle that private enterprises must serve the state when required. “Their security law, passed a few years ago, essentially obliges every individual to cooperate with state authorities or intelligence services,” he notes.

“This couldn’t have happened without the Chinese knowing about it, much like the cutting of Baltic Sea cables,” Kohv says. “It’s hard to believe that the Russians would simply take a Chinese flag, carry out all sorts of activities under it, and the Chinese wouldn’t care.”

Beijing’s own disinformation campaigns and broader hybrid activities in the West tend to focus on their diaspora abroad. “With China, you can see that they target the same groups abroad that they suppress at home: human rights activists, political dissidents, Tibetans, Uyghurs, and critical journalists,” Kohv lists.

“Perhaps the most striking example is the illegal police stations in Europe. This is a direct undermining of our legal system,” Kohv remarks. “There is no reasonable justification for foreign police to be operating here.”

“Although China claims these stations are meant to assist their citizens—issuing visas, renewing documents—the real goal is to silence their diaspora entirely,” he adds.

Diana Sosoaca, leader of the SOS party, is live streamed on TikTok as she talks to her supporters at her book launching, two days before the parliamentary elections, in Bucharest, Romania, November 29, 2024.
Diana Sosoaca, leader of the SOS party, is live streamed on TikTok as she talks to her supporters at her book launching, two days before the parliamentary elections, in Bucharest, Romania, November 29, 2024. Photo: ANDREEA CAMPEANU

According to public reports, China established 102 such stations between 2016 and 2022 in Europe, Africa, the Americas, and other Asian countries. Investigations were launched in 14 countries, including Australia, the Netherlands, the United States, and the United Kingdom, following the revelation of these secret outposts.

A review by the Brookings Institution this year highlights that it remains unclear how many of these stations were ultimately shut down. For instance, in the Netherlands, authorities couldn’t locate a station allegedly operating in Amsterdam, while in the UK, there wasn’t sufficient evidence to claim that the Chinese acted illegally.

In response to the question of why countries where China operated its police stations have not taken significant public action, Kohv notes that there are several reasons.

The first reason, Kohv explains, is the embarrassment faced by the security services of those countries, as they failed to detect such activities. “Unlike Estonia, where the Internal Security Service has always taken the approach of making everything public as a deterrence measure, many other countries historically dealt with espionage cases quietly—there would be expulsions, but the public might never hear about it,” he says.

“The second reason is China's significant pressure on various countries, often through trade relations, development projects, or technology partnerships,” Kohv adds. “Then there are countries like Hungary, which have openly welcomed such activities, even stating that they’re happy to have Chinese patrols on their streets,” he continues.

Kohv also notes that Beijing has promised to shut down these police stations. “But the issue is that many of these illegal outposts are unmarked, operate in random locations, and are, in many ways, hidden,” he explains.

The Chinese diaspora, which is the primary target of these stations, rarely trusts European authorities enough to report their existence.

This year, the concept of the "new Axis of Evil" has gained traction as a term linking China and Russia. Alongside them are the longstanding members of the original "Axis of Evil," as described by former U.S. President George W. Bush: Iran and North Korea. All are active in hybrid warfare and engage in conventional security cooperation as well.

The Chinese ship Yi Peng 3, suspected in the undersea cable breakage incident, was near Danish waters in the Kattegat Strait on November 20, 2024.
The Chinese ship Yi Peng 3, suspected in the undersea cable breakage incident, was near Danish waters in the Kattegat Strait on November 20, 2024. Photo: MIKKEL BERG PEDERSEN

For instance, during the Green Wave uprisings in Iran in 2009–2010, China sold technology designed to restrict and shut down the internet.

“In 2023, Russia sold China various cameras, photographic equipment, and lie detectors,” Kohv continues.

“Russia and Iran have also cooperated in the cyber domain, but so far this has been limited to sharing information about U.S. cyber activities, mostly in a defensive context. It’s believed that the exchange of offensive technologies or tactics has been hindered by a lack of trust—there is no love lost between these nations either,” he explains.

Similar to China, Iran's activities around the world are largely community-based, both in terms of targets and perpetrators.

“Iran has dozens of cases in Europe where their agents or representatives of the Revolutionary Guard have attempted to murder or, for example, assault dissidents and journalists,” Kohv says. “They’ve been expelled from several countries, attacked Israeli embassies—like in Sweden—made bombs, and thrown grenades.”

Kohv recalls a warning issued by Sweden, highlighting that Iran exploits groups operating within the country for political purposes. “In Sweden, these tactics are incredibly cynical; they even recruit children, taking advantage of their age to avoid criminal liability,” he describes.

The highly publicized Quran-burning incidents in Sweden and Denmark, Kohv notes, were an unusually high-profile case for Iran. “Generally, Iran’s activities in our region are rather crude. They lack extensive networks apart from their diaspora. Even those Swedish criminals involved in some cases often have Iranian roots,” he adds.

Compared to its axis partners, North Korea is less visible on the international stage, but Kohv does not rule out the possibility that Pyongyang could become more active at some point.

“They have a colorful history of sabotage and similar activities. Since the Korean War, they’ve been very active in harassing South Korea, even attempting to assassinate its president,” Kohv recalls. “They’ve conducted kidnappings and orchestrated bizarre situations, such as abducting a director and his ex-wife, a famous actress.”

A photo of Soldier Mateusz Sitek, the first NATO soldier killed on the Polish border in the spring of 2024 during the ongoing cross-border hybrid attack.
A photo of Soldier Mateusz Sitek, the first NATO soldier killed on the Polish border in the spring of 2024 during the ongoing cross-border hybrid attack. Photo: Krzysztof Zatycki

The latter case had a cultural motive: to elevate North Korea’s film industry. In the 1970s, under the directive of then-dictator Kim Jong-il, North Korea kidnapped Shin Sang-ok and Choi Eun-hee, who had brought fame to South Korea’s film industry in the 1960s. Following their abduction in 1978, they were tasked with producing quality films for North Korea.

“They’ve shot down an aircraft and were caught with a submarine near South Korea. Their most recent high-profile operation of this kind was the poisoning of Kim Jong-nam, Kim Jong-un’s half-brother, with VX nerve agent in Malaysia—a very extreme action, considering the potency of the poison,” Kohv says, adding, “North Korea is believed to have vast stockpiles of nerve agents.”

North Korea has now become an important supporter of Russia in the war in Ukraine. “For example, the EU launched a high-profile initiative to supply one million shells to Ukraine, which hasn’t been fully realized yet. Meanwhile, North Korea has provided about eight million shells to Russia,” Kohv explains. “They’ve also supplied ballistic missiles and even soldiers.”

The biggest uncertainty now, Kohv notes, is what North Korea receives in return from Russia. This question is causing significant concern for Japan, South Korea, and the United States.

“If Russia starts providing North Korea with submarine or nuclear weapons-related technology, that’s a serious cause for alarm,” Kohv warns.

At the same time, there’s also room for optimism—perhaps Moscow won’t fulfill its promises to North Korea. “It wouldn’t be the first time the Russians simply duped someone,” Kohv says hopefully.

Copy
Top