Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
,
Social Engineering
Report Uncovered Malicious Fake Job Network Operated by a Chinese Company
Recently laid off officials from the U.S. federal government are being targeted by Chinese intelligence through a network of front companies purporting to offer consulting work.
See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It
A chaotic wave of federal workforce culls during the first months of the Trump administration has thrown hundreds of thousands of jobs into question – leading China to step up efforts to recruit individuals with knowledge about the inner workings of Washington, D.C. Reports that foreign adversaries also including Russia intended to recruit laid off officials began almost as soon as the administrations’ intentions became apparent. U.S. counterintelligence agencies in April warned current and former officials about an uptick of job offers hiding foreign intelligence agency involvement that “have become more sophisticated in targeting unwitting individuals with USG backgrounds seeking new employment.”
Washington-based think tank Foundation for Defense of Democracies in a Friday report said it spotted a network of Chinese recruitment in February. A group of five putative consulting and headhunting firms based in the United States, Singapore and Japan can be linked by their common use between December and March 14 of a single IP address tied to a server owned by Chinese firm Tencent. The IP address “hosts only domains associated with the five firms in the network, suggesting it is a dedicated hosting environment.”
The websites of four of the five of the companies – Dustrategy, RiverMerge Strategies, Tsubasa Insight and Wavemax Innov additionally shared a single SSL certificate and the same Chinese email service provider, cengmail.cn. The email provider isn’t widely used, even in China. Two of the front companies switched email providers in during the second half of 2024, “perhaps to mask their connections to China.”
One of the companies, Smiao Intelligence, appears to be an actual business offering professional services including web development and digital marketing. Its website went offline in March as Reuters prepared a
report
into the Chinese network.
Websites of the other putative companies “are little more than digital facades, a conclusion apparent from their use of cloned websites, fake customers, AI-generated text and other signs of artificiality,” FDD wrote.
This cluster of activity is not the first initiative by Chinese intelligence to recruit former Americans. The campaign “closely resembles previous Chinese intelligence operations targeting U.S. government officials.”
These include the 2020 recruitment of Singaporean national Jun Wei Yeo for running a fake consultancy firm that obtained 400 resumes of mainly that U.S. military and government officials, which he then transmitted to Beijing.
The think tank recommends that the U.S. government monitor foreign intelligence recruitment campaigns through its network of fake job seekers on social media sites. “Posted on a range of social media sites, these sock puppets can help U.S. counterintelligence bait foreign intelligence operatives into coming out of the shadows to make contact.”
It should also be harder on sites such as LinkedIn and ZipRecruiter to create company pages, the think tank said, advising the sites to implement know your customer practices.