BANNER: Screenshots of posts from both campaigns. Overlay added.

Two coordinated influence campaigns operating independently of each other, one domestic and one foreign, descended on the same Facebook pages run by Filipino activists, but with opposite aims. A domestic, state-aligned operation treated the pages as targets: it accused the activists of links to the communist insurgency in order to discredit them. A Chinese Spamouflage operation treated the same pages as platforms, flooding their comment sections with anti-government content aimed not at the activists but at the incumbent president, Ferdinand ‘Bongbong’ Marcos Jr., and in support of the opposition leader, Vice President Sara Duterte.

Both operations used inauthentic Facebook profiles, leaving formulaic comments and AI-generated images under the posts of the League of Filipino Students, a prominent leftist student group, Kilusang Mayo Uno, the largest left-wing national labor federation, Jerome Adonis, the national chairperson of Kilusang Mayo Uno, and Arlene Brosas, an activist and former representative from the Gabriela Women’s Party.

The Filipino state-aligned operation relied on infographics and AI-generated images in its targeted messaging against the three arms of the communist insurgency: the Communist Party of the Philippines (CPP), the New People’s Army (NPA), and the National Democratic Front (NDF). Its messaging primarily focused on youth recruitment into the insurgency, disparaging youth activists, and opposing political parties. This is in contrast with the Chinese operation, which directed its attacks against the Filipino national government.

The DFRLab assesses with moderate confidence that the Filipino state-aligned operation could be connected to or supported by personnel from the Armed Forces of the Philippines’ 2nd Civil-Military Operations Battalion (2CMOBn).

The following four screenshots show comments from both operations appearing on the same posts. Filipino state-aligned comments are boxed in green, and Chinese comments in red.

This situation presents a rare convergence where two distinct influence operations—one domestic and one foreign—share the same targets. While Chinese and Filipino operations are not new to the Philippines, they previously targeted different parts of the information landscape. In 2020, Graphika and Meta identified Chinese Facebook assets supporting then-President Rodrigo Duterte and amplifying pro-China messaging, while Meta, Rappler, and the DFRLab separately uncovered a network linked to the Philippine military and police that targeted the CPP-NPA-NDF. The current overlap highlights sustained state interest in manipulating the Philippine information ecosystem and persistent vulnerabilities in Facebook’s CIB enforcement.

The Philippines is home to one of the world’s longest-running Maoist insurgencies, active since 1969. Its numbers have dwindled below 900 after defeats, infighting, and defections, and the armed movement can no longer threaten state power. The conflict now registers less as a contest for control of the state than as a localized security and economic problem as the New People’s Army sustains itself through “revolutionary taxation” levied on rural businesses, candidates, and projects. The government nonetheless continues to address the conflict on two tracks: the National Task Force to End Local Communist Armed Conflict (NTF-ELCAC), which coordinates the political and civilian campaign, and the  Armed Forces of the Philippines (AFP), which handles armed operations in the jungle.

The ideological war extends well beyond the jungle. The Philippine government frequently identifies legal activist groups, ranging from student unions to farmer associations, as front organizations for the communist movement. This has led to the widespread practice of “red-tagging,” where the state publicly accuses activists, journalists, politicians, and ordinary citizens of supporting or belonging to the communist insurgency, a designation that often precedes harassment or physical violence.

Red-tagging has varied in intensity across administrations. President Rodrigo Duterte, for instance, appointed figures from this activist group to his 2016 cabinet to advance peace talks, before the alliance collapsed, after which the targeting of these groups intensified. Human Rights Watch, writing in 2024, noted that the practice surged under Duterte and has continued under Marcos with no evident efforts to end it. In the same year, Amnesty International found consistent failures by Meta to remove red-tagging content that incited hatred and violence.

The DFRLab identified twenty-seven Facebook pages belonging to individuals and organizations across the Philippine left that were targeted by the state-aligned operation. These cover labor rights (League of Filipino Students, Kilusang Mayo Uno, and Jerome Adonis), youth activism (UPLB Perspective, SAKBAYAN | Samahan ng Kabataan para sa Bayan | UPLB, PUP Sentral na Konseho ng Mag-aaral, UP Fair, Panday Sining, CvSU KILOS NA, Anakbayan Cavite State University, Anakbayan, Anakbayan-USA, and Anakbayan Cavite), women (GABRIELA Southern Tagalog, GABRIELA Youth Cavite, Gabriela Youth Rizal, Gabriela Women’s Party, and Arlene Brosas), progressive party lists (Kabataan Partylist Quezon, Kabataan Partylist Laguna, Kabataan Partylist Rizal, and Anakpawis Party-list), and others (Kasama – TK,  Kasama LR, Artists For Just Peace, Bagong Alyansang Makabayan Laguna, and PAMALAKAYA-Philipinas).

Tension between activist groups and the state increased on April 19, 2026, when two university students were killed, among others, by the military in a clash with NPA rebels. The circumstances of their deaths were met with speculation: the army maintains that everyone killed was an NPA combatant, while student groups describe them as civilians who were student leaders and researchers. The killings prompted protests, and posts made during this period have been heavily targeted by the state-aligned accounts.

The domestic operation’s core messaging frames the communist insurgents as terrorists who harm ordinary citizens, recruit and exploit youth, and use front organizations to disguise their agenda. Several images focus on specific arrests to argue that activists associated with left-wing organizations are actually NPA members or recruiters. They label progressive party-lists (legally registered political parties under a system reserving House seats for marginalized sectors), like Kabataan and Gabriela, as communist fronts.

Many of the profiles that engaged in the state-aligned amplification had few posts, strong privacy settings, or locked accounts, making it difficult to scrutinize their behavior. In some cases, public Facebook likes revealed a common set of pages liked by the accounts in the operation, for example: Kasama LR true colors, Kasama LR True Colors, UPLB Perspective Exposed, Pamalakaya Cavite true colors, Cvsu Kilos Na Busted, and Communism Unmasked PH.

The DFRLab is confident these six pages are connected. They were all created in early 2026 (the earliest February 26 and the latest April 24), share naming schemes and content, and have roughly the same amplifier profiles, liking, sharing, and commenting with images or copypastas. Shared likes alone would be a weak signal, but taken together with the creation dates, naming conventions, and coordinated amplification, the pattern points toward a single operation. One of the pages, “Kasama LR true colors,” was deactivated or deleted during the writing of this piece, possibly to consolidate duplicate pages.

This network specializes in red-tagging and counter-messaging against the CPP-NPA-NDF and perceived sympathizers, each branded to a target community. CvSU KILOS NA Exposed and UPLB Perspective Exposed supposedly expose the student council and student publication they are named after, warning not to associate with these groups. Pamalakaya Cavite true colors and Kasama LR True Colors are dedicated to targeting prominent fishing and farming collectives, respectively, yet their content still focuses on youth and student groups. An outlier, Communism Unmasked PH, is simply an anti-communist page that elevates the narrative to the international level, citing the Khmer Rouge and the Soviet Union as historical failures of communism.

The activism pages they target were already being targeted by the state-aligned CIB profiles, and there is a high degree of overlap between profiles commenting on the activism pages and those engaging with these six pages’ posts.

The DFRLab believes these six pages are connected to a wider network of pages. The amplifier accounts are active in promoting other similar pages: Ilahad, Naih Marquez, and Bagong Caviteño. Ilahad is notable because it has been active since November 2024, far longer than the other pages. It also previously ran an ad targeting a student group that was taken down for not being labeled as political. Had it run the ad with the correct label, it would have publicly disclosed the operator’s identity through Facebook’s ad transparency mechanisms.

The network graph below visualizes the reposting relationships between the six pages, the wider information environment, and adjacent military pages. Each arrow indicates a page reposted from another at least once, a low threshold leading to some noise. Notable pages frequently reposted include Ilahad, Kontra Kwento, Robert Apolinario, Bangon Mindoreno, and The TRUTH, all of which are pages performing counter-messaging against the CPP-NPA-NDF.

Network graph of reposting behavior by pages connected to the amplification network and the wider information environment. (Source: DFRLab via Facebook)

Profiles engaging with this information space also heavily overlap. The network graph below maps links between the pages and profiles that engaged with at least three of the pages’ last fifty posts. Nodes are colored by category: state-aligned pages are blue, anti-insurgent narrative pages are green, military pages are orange, and CIB-targeted activism pages are magenta. Because some activism pages have only a few posts that have been targeted, an edge forms if a profile engages with an activism page at least once rather than three times. This means edges involving magenta nodes indicate contact rather than the sustained pattern of engagement that edges between other node types represent.

The DFRLab assesses with moderate confidence that the 2nd Civil-Military Operations Battalion (2CMOBn) of the AFP’s 2nd Infantry “Jungle Fighter” Division, or individuals affiliated with that unit, which is responsible for combating the NPA in the Southern Tagalog region, may be connected to or supporting the six state-aligned pages and their amplification network. This assessment concerns a specific unit and the accounts and people associated with it. The open-source evidence available to the DFRLab does not establish that the operation was directed, authorized, or sanctioned by the AFP as an institution, nor does it exclude the possibility that a private contractor or communications firm produced the content on the unit’s behalf

The unit itself is a matter of public record. The CMOR’s official website lists the 2CMOBn among its battalions; the government’s Philippine Information Agency has reported on the 2CMOBn’s change of command under the 2nd Infantry “Jungle Fighter” Division; and the Philippine News Agency reported on the battalion’s emergency preparedness efforts.

To map relationships among the pages, the amplification accounts, and the military-affiliated accounts, the DFRLab relied on open-source signals such as likes, follows, and reposts. Because the pages have little organic engagement and small follower counts, accounts that engage with them repeatedly are more likely to be affiliated than incidental. These signals indicate association and alignment, not that one account operates or directs another. Many relevant accounts also used strict privacy settings, limiting what could be observed. For these reasons, the DFRLab cannot make a definitive attribution to the 2CMOBn based on open-source information alone.

What follows are five strands of circumstantial evidence. No single strand is conclusive, but the cumulative pattern is the basis for the DFRLab’s moderate-confidence attribution.

The first piece of circumstantial evidence is that the page for the 3^rd Company of the 2CMOBn follows “Kasama LR true colors” and “Naih Marquez.” These two pages have fewer than 200 followers and feature heavy boosting by inauthentic amplifiers, which makes it notable that a page identifying as a military company would follow two newly created, low-reach pages.

Second, accounts in the amplification network engaged with posts by a page presenting itself as a 2nd CMO company. The 2^nd CMO “Bagwis” Company is one of several subordinate units of the 2CMOBn. A page named Bravo Bagwis reposted a post from a state-aligned page one day after that page began posting consistently. While it is unclear whether Bravo Bagwis is an “official” account, other military pages interact with it.  As with all engagement signals, these interactions indicate contact or alignment, not control.

Additionally, amplification profiles Don Pobre, Sam Ocampo, and Pay Badong, all accounts in the state-aligned operation, engaged with posts on another 2^nd CMO company page.

The third piece of evidence is a coordinated messaging campaign launched on October 31, 2025, that lasted only one day. The DFRLab found it by cross-referencing entities the CIB network follows, leading to the page “kula max.” The kula max page has one notable post accusing China of spreading fake news, paying online trolls, and bribing politicians in what is known domestically as the “West Philippine Sea” dispute. Its follow list reveals other assets that posted the same text on the same day, forming another network. Most posted once and went dormant.

Scrutinizing these assets’ follows revealed further 2CMOBn links: the 1^st Company of the 2CMOBn follows one of the operation’s accounts, making it one of only thirty-five followers. Another network account follows two 2CMOBn pages, the 2nd Infantry Division page, and other military pages.

Finally, several accounts that engaged with the network display military imagery or self-reported military affiliations. One profile that follows five of the state-aligned pages as well as “kula max,” an unusual combination given how niche those pages are, lists the AFP as its employer and appears in a photograph wearing a military uniform bearing a Civil-Military Operations (CMO) patch. Another page, part of the October 31 messaging effort, uses a profile picture of a woman in a military uniform that also bears a CMO patch, and one of three accounts that engaged with the page’s post lists the 2CMOBn as its employer.

Employer fields and profile photographs on Facebook are self-reported and cannot be independently verified; they may be inaccurate, outdated, or fabricated, and the DFRLab treats them as supporting rather than determinative. Separately, the CMO patch visible in these photographs is the insignia of the Civil-Military Operations branch and is common across CMO battalions. The 11th CMOBn’s insignia is shown for reference because the patch is closely similar, so it indicates CMO-branch or AFP affiliation in general rather than membership in the 2CMOBn specifically.

Taken together, these strands lead the DFRLab to assess, with moderate confidence, that the network and its state-aligned coordinated inauthentic behavior are likely affiliated with the 2CMOBn or with individuals connected to it. It is possible that the people behind these accounts are supporters of the unit rather than members acting on its behalf, and the DFRLab cannot rule this out based on open-source data. But the number of independent overlaps is difficult to attribute to coincidence, and the network’s messaging aligns closely with the 2CMOBn’s stated counterinsurgency mission. The DFRLab is not asserting that the AFP as an institution ordered or sanctioned this activity; a definitive attribution would require information beyond what open sources provide.

A further possibility the DFRLab cannot rule out is that a private contractor or communications firm managed this activity on the unit’s behalf. This operational model in the Philippines has been documented by researchers Jonathan Corpus Ong and Jason Cabañes, who found that the chief architects of disinformation campaigns frequently come from the advertising and PR industry.

The Philippines has previously been a target of Chinese information operations. The aforementioned research by Graphika and Meta in 2020 into Operation Naval Gazing led to the removal of Chinese Facebook assets. In 2024, the Australian Strategic Policy Institute found the Spamouflage network posting a deepfake video on X and YouTube of President Marcos taking illicit drugs, a narrative that originated with domestic actors and that the campaign amplified. An influence operation in 2025 linked to the Filipino firm InfinitUs Marketing Solutions was, as reported by Reuters and Rappler, paid by China to amplify pro-China messaging, with heavy promotion of Facebook posts from the Chinese embassy.

Spamouflage is a long-running multi-platform pro-China influence network first identified by Graphika in 2019 and attributed to Chinese law enforcement by Meta. In the Philippines, the network shifted from earlier pro-Duterte, pro-China messaging to a campaign attacking President Marcos and elevating his Vice President and political rival, Sara Duterte. Philstar.com in August 2025 identified a network of bot accounts on X that shared anti-Vietnam, pro-Duterte, and anti-Marcos content, which OpenAI said bore some resemblance to “Spamouflage” and used OpenAI’s models to generate the posts. In February 2026, the Foundation for Defense of Democracies (FDD) identified a broader Spamouflage campaign of more than 330 inauthentic accounts across X and other platforms active between December 2025 and February 2026, one cluster of which amplified anti-Marcos protest hashtags in the Philippines, a finding consistent with the Facebook activity documented here.

Spamouflage profiles pushed their narratives in the comment sections of posts by the League of Filipino Students, Kilusang Mayo Uno, and others. In April 2026, many activist posts concerned the killing of the two students, but Spamouflage’s high-frequency posts sought to talk over the local conversation with more distant topics like corruption and national leaders. One exception that stayed on topic commented “Justice for Alyssa Allano [sic], may she live forever!“

Two Spamouflage profiles uploaded an image of a company logo with a Telegram username, leading to a Telegram channel that sells Facebook profiles. This vendor is likely one of the sources from which Spamouflage procures Facebook profiles. This relates to previous research by the FDD on blackhat marketing operations on Facebook and research from the DFRLab on X accounts for sale on Telegram that were used for transnational repression.

In total, the DFRLab identified fifty Spamouflage Facebook profiles that commented on these posts. These fifty profiles are only one segment of the Spamouflage Facebook operation and are connected to the wider Facebook network primarily through shared hashtags. The broader Facebook network is further connected to Spamouflage activity on X through both hashtags and shared AI-generated images, previously identified by the FDD. Narratives include government corruption, Marcos’s unproven drug use, and the Marcos–Duterte rivalry. The corruption narratives are notable, as Spamouflage names specific people, showing a knowledge of domestic politics.

Some accounts previously posted narratives unrelated to the Philippines, echoing mainstays of Chinese state-aligned messaging abroad. For example, they posted about drug use in the United States, one even posting in Chinese. Other accounts promoted Chinese visa-free travel before switching to amplifying messages about protests in the Philippines.

Non-Spamouflage posts were also amplified by Chinese profiles in coordination, including one about Marcos’s rumored illness. In one extreme case, a profile wrote “Little Marcos, die quickly, Support Sara to become president.”

The network champions Marcos’s rival, Vice President Sara Duterte, as the legitimate alternative leader, and amplifies posts by less internationally known opposition figures: Elmer “Ka Bong” Labog, Jerome Adonis, and Bam Aquino. Spamouflage appeared to use their pages as platforms to spam its generic anti-government messaging rather than promoting tailored content to help the opposition.

Both the state-aligned network and Spamouflage share posts within groups as an amplification tactic, but some Spamouflage profiles also ran Facebook groups, seemingly to build community. The network appears to have taken over a profile, Stick Figures, which had admin rights to a group created in 2020, renaming it “Philippines fact sharing” in November 2025. After that, through Stick Figures, the network shared a protest video and used bots to like it, but no active community grew, and the video gained no organic engagement.

The network also ran a second group, “Philippines, stand united! Go Philippines!,” created in November 2025, where it posted the same protest video, along with other videos. All members joined around the same time as the admin, and many are themselves Spamouflage accounts. The videos appeared a few days before the scheduled protest dates, as indicated in the videos (October 21 and November 30, 2025).

In another case of extremism, a Spamouflage profile posted content in September 2025 calling for more Molotov cocktails, apparently hoping to ignite political violence.

A domestic state-aligned operation and a Chinese operation descended on the same Philippine activist pages from opposite directions, one seeking to attack the activists, the other to use them as unwitting infrastructure for anti-government narratives. That two operations could exploit the same pages, years after Meta’s major Philippine takedown in 2020, points to a persistent enforcement gap that works against the targets of red-tagging and the integrity of domestic political discourse. An activist told Amnesty International that reporting red-tagging pages doesn’t stop harassment. Activism pages that restrict comments to long-term followers are defeated by CIB profiles that simply like the page first. Both operations marshaled hundreds to thousands of profiles to coordinate reactions, a pattern that should be trivial to flag at the platform level. Meanwhile, Meta’s recent decision to hide the transparency of post shares has made it harder for researchers to track where malicious content travels.

DFRLab, “Two coordinated networks, one domestic, one foreign, target the same Philippine Facebook pages” Digital Forensic Research Lab (DFRLab), June 30, 2026, https://dfrlab.org/2026/06/30/two-coordinated-networks-one-domestic-one-foreign-target-the-same-philippine-facebook-pages/.