An alleged network of companies operated by a secret Chinese technology firm is reportedly attempting to hire recently laid-off US government employees. This situation came to light through published job listings and disclosures from a researcher who uncovered this campaign.

Senior analyst at the Washington-based think tank Foundation for Defense of Democracies Max Lesser revealed that job listings from some companies are part of a broader network of fake consultancy and recruitment firms targeting former government employees and artificial intelligence researchers. According to Reuters and Lesser’s research, very little public information is available about the four consulting and recruitment companies issuing these listings. Some of these firms have overlapping websites, are hosted on the same server, or appear to be digitally linked. The websites of these four companies are hosted on the same IP address as an internet services company named Smiao Intelligence. However, during Reuters’ investigation, the website of Smiao Intelligence was inaccessible. In the midst of their investigations, Reuters encountered unanswered phone calls, non-working phone numbers, fake addresses, addresses leading to empty lots, unanswered emails, and job listings removed from LinkedIn.

Lesser, who uncovered the network, noted that this campaign follows well-known techniques used by China in its past intelligence operations and stated that “what makes these activities significant is the attempt by this network to exploit the financial vulnerabilities of former federal employees affected by recent layoffs.” Reuters could not confirm whether these companies have direct connections to the Chinese government or if any former federal employees have been hired. Three intelligence analysts who spoke to Reuters indicated that this network of companies could be an example of foreign-affiliated elements conducting operations to gather information on federal employees who were dismissed or forced into retirement by elements such as the Trump administration and Elon Musk’s Government Efficiency Department. According to analysts, hired former federal employees could be directed to share increasingly sensitive information about government operations or inadvertently aid in the identification of other targets.

DENIAL FROM THE CHINESE EMBASSY

A spokesperson from the Chinese Embassy in Washington stated in an email to Reuters that China has no knowledge of these alleged companies and that Beijing “respects data privacy and security.” A White House spokesperson emphasized that China continually attempts to exploit the U.S.’s “free and open system” through espionage and coercion and highlighted the need for both active and former government employees to understand the threat posed by these countries and the importance of protecting government information.

OPERATIONAL PROCEDURES

In a news report dated February 28, CNN claimed that U.S. intelligence believed that Russia and China were targeting disgruntled former U.S. government employees. Lesser suggested that the presence of these companies issuing job listings could serve as concrete evidence that such operations are currently ongoing. Reuters previously reported that some U.S. government employees did not receive standard exit briefings regarding classified information, leaving them without guidance on what to do if targeted by foreign intelligence.

“GEO-POLITICAL RISK CONSULTANCY”

One of the companies within the alleged network, RiverMerge Strategies, presents itself on its website as a “professional geopolitical risk consultancy firm.” Two job listings the company posted on LinkedIn in mid-February were promptly removed. One of the listings sought a “geopolitical consultant,” which received applications from over 200 individuals according to a screenshot of the listing. The second listing was for a human resources specialist. Qualifications sought included having a deep understanding of the talent pool in Washington, experience in policy or consultancy, and evaluating connections with local professional networks, think tanks, and academic institutions. The U.S. phone number listed on RiverMerge Strategies’ website is no longer in service. The Chinese phone number previously displayed on the website matches that of a software company based in Shenzhen called Si Xun Software Co., Ltd. Reuters could not verify the connection between RiverMerge Strategies, Smiao Intelligence, and Shenzhen Si Xun Software Co., Ltd. Calls made to the phone number displayed on Si Xun’s website were unsuccessful.

FAKE ADDRESSES, UNANSWERED EMAILS

RiverMerge Strategies listed two addresses on its website in Singapore and Colorado. The Singapore address led to a hostel building within the Management Development Institute of Singapore campus. Reuters found no evidence of the company’s presence during a visit to the area. The Colorado address was registered to a business services firm called Northwest Registered Agent. An individual listed as an employee of RiverMerge Strategies on LinkedIn, speaking anonymously to Reuters, claimed that he was asked by an acquaintance named “Eric” he met at a networking event in China to share job listings for the company. This individual mentioned that he received payment every two to three months of between $1,000 to $2,000 from “Eric” and another contact named “Will” for sharing job listings.

WARNING FROM THE FBI AND EXPERTS

An FBI spokesperson remarked to Reuters that Chinese intelligence could disguise themselves as institutions like think tanks, academic institutions, and recruitment companies to target current, former, and prospective U.S. government employees. Former U.S. Justice Department prosecutor David Aaron stated that Chinese intelligence services would increase such efforts as they observe government employees having to seek employment, emphasizing that while many former public servants are patriotic, some may be vulnerable to deceptive tactics.