[Special Topic] The Gray Battlefield / 3 Waves of 'Breaking News' Simultaneously Flooding Pages, Cybersecurity Experts: Building Fan Pages Targeting Taiwan's Elections

On the afternoon of June 15th, breaking news with almost identical formats suddenly appeared on Facebook, including 'National-Level Alert Suddenly Rings Loudly,' 'Kaohsiung City Emergency Announcement,' and 'Emergency Suspension of Work and Classes.' Cybersecurity experts believe this is a common tactic from China's 'Boundless Group' (无边界集团) based in Qinhuangdao, Hebei. Their goal is to drive traffic and build up fan pages using real news, with the ultimate aim of preparing to interfere with Taiwan's local elections at the end of this year. 3 Waves of Breaking News with Identical Formats, Dozens of Fan Pages Push Simultaneously Within Minutes A cybersecurity expert familiar with the incident revealed that the three waves of breaking news – 'National-Level Alert Suddenly Rings Loudly,' 'Kaohsiung City Emergency Announcement,' and 'Emergency Suspension of Work and Classes' – were all real events that had been reported by the media. However, on the afternoon of June 15th, they were all presented with eye-catching text and highly consistent content, titles, and formats, leading to a concentrated flood of posts by a large number of fan pages on Facebook within minutes, indicating coordinated operations. In a short period, 383 posts were published. At the peak, 34 posts were made in 5 minutes, concentrated across 163 fan pages such as 'Juicy Revelations,' 'Soul Makeup Room,' 'Always Here,' and 'Don't Be Afraid. I'm Here.' During these three waves of operations, these accounts would relay posts in the same order. Most posted intensively within minutes, with up to 14 different fan pages posting simultaneously in a single minute, averaging one account joining every 10 seconds. Experts analyze that these fan pages cover different topics but post in the same sequence. Especially when dozens of accounts post simultaneously in the same minute with a fixed order, it no longer resembles natural content dissemination. It is more akin to using the same backend, scheduling posts according to the same account list. Cybersecurity experts point out that posts like 'National-Level Alert' and 'Kaohsiung City Emergency Announcement' were primarily initiated by Taiwanese news websites, with farm pages subsequently spreading the same content. As for 'Emergency Suspension of Work and Classes,' it was directly initiated by self-media, with multiple accounts following suit within 10 seconds. This model of amplifying existing material from news media through farm accounts is consistent with past foreign manipulation tactics. That is, coordinated accounts use original media posts as material for flooding, attempting to attract followers through coordinated posting, thereby increasing the number of followers and expanding the influence of the fan pages. Furthermore, after comparing the original post data, it was found that 98.4% of the total 383 posts across the three waves had at least one comment with a link. Posts without comments embedded links, which would direct clicking users to content farms, allowing them to monetize through traffic. Operators Mostly Overseas, Nearly Half of Fan Pages Have Changed Names to 'Wash' Their History After cross-referencing Facebook's Page Transparency information, cybersecurity experts found that among the administrators of these 163 fan pages, as many as 154, or about 94.5%, were managed by individuals overseas. Of these, Hong Kong accounted for 106, Malaysia for 82, and even 17 fan pages had administrators clearly located in China. Only 9 were managed purely by Taiwanese individuals. Additionally, the location for 22 fan pages could not be obtained, and 11 had their locations hidden by administrators – a common practice among overseas farm accounts. Cybersecurity experts revealed that nearly half of these 163 fan pages, a total of 80, had changed their names, some up to 6 times. Many were repurposed from old pages containing pornography and adult content. One page, currently named 'Revelations Entertainment Community' (爆料娛樂公社), was originally named '18 Adult Pornography, Erotic Text, Erotic Pictures' (18成人色情、色文、色圖) when created in 2015. Another page, now called 'Taiwan Fresh News' (台灣新鮮事), was previously 'Sexual Happiness Classroom' (性福課堂). Sources analyze that by renaming old accounts with high follower counts, they can bypass the trust threshold for new accounts and quickly gain reach. Comparing the dates of the last name changes for these 80 fan pages, it was found that pages changing names around the same time often shared the same management location and had similar patterns in their original names. For example, in October 2015, a batch of pages originally named 'I am Melaka,' 'I am Kedah,' and 'I am Terengganu' all changed their names in the same month, with Melaka, Kedah, and Terengganu being Malaysian states. In early 2021, a batch of accounts originally with Malay or English names were uniformly renamed to Chinese movie and drama commentary fan pages within one to two months. Cybersecurity experts infer that many of these accounts were originally local or miscellaneous Malaysian fan pages, acquired in batches by the same operator, renamed on an assembly line to Chinese farm fan pages. This is the specific process of 'acquiring overseas accounts, nurturing them, and then deploying them.' Suspected Origin from PLA System 'Boundless Group' Cybersecurity experts who have long studied foreign information manipulation, based on posting patterns, overseas management, and traffic-driving farm characteristics, believe this wave of operations is highly suspected to originate from the 'Boundless Group.' This group belongs to the PLA's cognitive warfare system. It originated in Qinhuangdao, Hebei, China, in 2014, formerly known as Wuwei Technology. It previously operated the well-known content farm 'Huanxiang Net' (歡享網). In 2020, it signed a cooperation agreement with Qinhuangdao Radio and Television Station, gaining official endorsement. In 2023, the group's legal representative established a company in New Taipei City under the guise of daily necessities wholesale, which is believed to be a preliminary step in establishing a physical presence in Taiwan. Scholars have previously exposed this group's modus operandi of controlling Taiwanese fan pages through Hong Kong accounts. Cybersecurity experts also point out that Wang Hongen, a scholar from the University of Nevada, Las Vegas, discovered in 2024 that several employees of this Qinhuangdao company controlled fan pages and groups and promoted content farms. During the preliminary elections for the 2024 presidential election, they supported specific candidates and attacked the ruling party. The Tech, Democracy, and Society Research Center has also revealed that several active 'Complain About' (靠北) series fan pages are actually controlled by the Boundless Group. This time, fan pages like 'Complain About Girlfriend' (靠北女友) participated in this operation. Nurturing Fans Normally, Deploying During Critical Times, Experts: Preparing for Election Interference The operations of the Boundless Group have recently shown signs of AI upgrading. During the US-Iran conflict in March 2026, Wang Hongen also noted in an article that the group used its non-political fan pages (e.g., parenting education, film and television, health and wellness) to publish pro-Iran and anti-US commentary articles. These articles originated from blogs on China's Sina.com, were originally in simplified Chinese, and the Boundless Group used ChatGPT to translate them into traditional Chinese. Furthermore, because they forgot to delete AI prompts in their editing records, it directly confirmed that the group uses AI to rewrite posts tailored for Taiwanese audiences to attract them. Cybersecurity experts warn that this type of operation typically uses soft content like gossip, lifestyle, and health to 'attract fans' in large numbers, nurturing accounts into fan pages with a certain reach and directing traffic to content farms for profit. Once it enters sensitive periods like elections, these accounts, which have already accumulated a large number of followers, can quickly shift from health and gossip to political message dissemination. A study by the Taiwan Democracy Lab in April of this year found that the proportion of political content from accounts operated by the Boundless Group is usually low but significantly increases during election periods, warning that similar situations may recur in the 2026 local elections. Cybersecurity experts remind the public that if they see such sensational breaking news, they should pay attention to the location of the administrators of the posting fan pages and their name change history. They should also be vigilant about unknown links embedded in comments. After all, today they see breaking news about work and class suspensions; tomorrow, it might be a rewritten and packaged political message designed to guide the public to support a specific candidate, thereby interfering with Taiwan's democratic elections.