Secretive Chinese network tries to lure fired federal workers: research

A network of companies operated by a secretive Chinese tech firm has been trying to recruit recently laid-off US government workers, according to job ads and a researcher who uncovered the campaign.

Max Lesser, a senior analyst on emerging threats with the Washington-based think tank Foundation for Defense of Democracies, said some companies placing recruitment ads were "part of a broader network of fake consulting and headhunting firms targeting former government employees and AI researchers."

Little information is publicly available on the four consultancies and recruitment companies allegedly involved in the network, which in some cases shared overlapping websites, were hosted on the same server, or had other digital links, according to Reuters' reporting and Lesser's research.

The four companies' websites are hosted at the same IP address alongside Smiao Intelligence, an internet services company whose website became unavailable during Reuters' reporting. Reuters could not determine the nature of the relationship between Smiao Intelligence and the four companies.

The news agency's attempts to track down the four companies and Smiao Intelligence ran into numerous dead-ends including unanswered phone calls, phone numbers that no longer work, fake addresses, addresses that lead to empty fields, unanswered emails and deleted job listings from LinkedIn.

Lesser, who uncovered the network and shared his research with Reuters ahead of publication, said the campaign follows "well-established" techniques used by previous Chinese intelligence operations.

"What makes this activity significant," he said, "is that the network seeks to exploit the financial vulnerabilities of former federal workers affected by recent mass layoffs."

Reuters could not determine if the companies are linked to the Chinese government or whether any former federal workers were recruited.

Asked about the research, three intelligence analysts told Reuters the network appeared to be a prime example of how foreign-linked entities are trying to gather intelligence from staff fired or forced into retirement by President Donald Trump and billionaire tech tycoon Elon Musk's Department of Government Efficiency.

Once employed by the network, federal employees could then be asked to share increasingly sensitive information about government operations, or recommend additional people who might be targeted for willing or unwitting participation, the analysts said.

A spokesperson for the Chinese Embassy in Washington told Reuters in an email that China was unaware of any of the entities allegedly involved in the campaign and Beijing respects data privacy and security.

A White House spokesperson said China was constantly trying to exploit the United States' "free and open system" through espionage and coercion. "Both active and former government employees must recognize the danger these governments pose and the importance of safeguarding government information," the spokesperson said.

CNN reported February 28 that US intelligence believes Russia and China are targeting disgruntled US government employees, something both countries have done for years. The companies in the network - which posted job ads to Craigslist, LinkedIn and other job sites - could be concrete evidence such operations are underway, Lesser said.

Reuters reported earlier this month that some US government workers with top security clearances were not given standard exit briefings which, in part, cover what to do if approached by foreign adversaries.

"GEOPOLITICAL RISK CONSULTING"

One of the companies in the network, RiverMerge Strategies, bills itself on its website as a "professional geopolitical risk consulting company" and posted two since-deleted job listings on its since-removed LinkedIn page in mid-February.

One ad that sought a "Geopolitical Consulting Advisor" with experience with government agencies, international organizations, or multinational corporations, displayed that it had more than 200 applications, according to a screenshot of the LinkedIn post.

The other sought a human resources specialist who could "utilize a deep understanding of the Washington talent pool to identify candidates with policy or consulting experience," and "leverage connections to local professional networks, think tanks, and academic institutions."

The US number for RiverMerge Strategies listed on the company's home page is no longer in service. A separate Chinese phone number, until recently listed on the website's contact page, is the same number listed by Shenzhen Si Xun Software Co., Ltd, an information technology company focused on online retail, commercial automation and catering, according to a Google translation of the company's website.

Reuters could not determine the nature of the connection between the network of companies, Smiao Intelligence, and Shenzhen Si Xun Software Co., Ltd. Calls to a phone number listed on the company's website did not go through.

RiverMerge Strategies until recently listed two addresses on its website, one in Singapore and the other in Colorado. The Singapore address led to a hostel building within the campus of the Management Development Institute of Singapore, but the company could not be located during a Reuters visit. Its other address led to an address in Boulder, Colorado, tied to Northwest Registered Agent, a business services firm.

A person listed on LinkedIn as an employee of RiverMerge, who spoke on condition of anonymity, told Reuters an acquaintance he met at a networking event in China reached out and asked him to help promote job listings for RiverMerge Strategies.

The acquaintance, who he knows as "Eric," as well as another contact, "Will," pays the employee $1,000 or $2,000 every two or three months to post the job listings, he said.

A person identifying themselves as William Wells and RiverMerge's "strategies project manager" responded to an initial Reuters email and asked about Reuters' request for information.

Even though the Reuters email identified the sender as a reporter, Wells also inquired whether Reuters was seeking a job, and said they would review a resume and set up a short call.

Another company in the network, Wavemax Innovation, placed an ad February 6 on Craigslist offering "Job Opportunities for Recently Laid-Off US Government Employees." The ad, which has since expired, sought workers with backgrounds in project management, research, technology, communications, policy analysis and more.

Reuters could not establish who saw the ad or whether anyone applied to Wavemax as a result.

An email to the address posted in the ad was not returned. When Reuters visited the Singapore address posted to the company's website there was no sign of the company, just a vacant field. A search of Singapore's corporate registry for the company was equally barren.

Asked how it verifies job listings, LinkedIn said it uses automated technologies and a team of reviewers to find and remove inauthentic activity and profiles. The spokesperson said on Tuesday RiverMerge Strategies' profile had been restricted.

In response to questions about Reuters' findings, an FBI spokesperson warned that Chinese intelligence officers can represent themselves as think tanks, academic institutions and recruiting firms to target "current, former, and prospective" US government employees.

Agents for the Chinese government have used similar tactics in the past.

In 2020 a Singaporean national named Jun Wei Yeo pleaded guilty in a US federal court to acting as an agent of a foreign power, starting in 2015. Prosecutors alleged he worked to spot and assess Americans with access to non-public sensitive information and paid them to write reports for unnamed Asian clients, without disclosing the work was actually for the Chinese government.

That operation relied on a fake consulting company and job advertisements, according to court records.

Chinese intelligence operatives told Yeo how to recruit targets, including by asking them if they were "dissatisfied with work, were having financial troubles [or] had children to support," according to court records.

China's foreign ministry denied any knowledge of Yeo's case and accused the US of repeatedly accusing Beijing of espionage, saying "it has reached a state of extreme suspicion," the South China Morning Post reported at the time.

Foreign intelligence services often use job recruitment scams to recruit sources without them even knowing they are working for a foreign government, David Aaron, a former Department of Justice prosecutor now in private practice, told Reuters.

"I would expect China's intelligence services to dial those efforts up as they see a wave of government employees suddenly having to look for new jobs," Aaron said, adding that while many former government employees are motivated by patriotism, some may be vulnerable to deceptive tactics.