A network of companies operated by a secretive Chinese tech firm has been attempting to recruit recently laid-off U.S. government workers, based on job advertisements and findings from a researcher who uncovered the campaign.
Max Lesser, a senior analyst on emerging threats with the Foundation for Defense of Democracies, stated that some companies posting recruitment ads are part of a broader network of fake consulting and headhunting firms targeting former government employees and AI researchers.
Public information regarding the four consultancies and recruitment firms allegedly involved in this network is limited. In some instances, they shared overlapping websites, were hosted on the same server, or exhibited other digital connections.
The websites of the four companies are hosted at the same IP address as Smiao Intelligence, an internet services firm whose website became unavailable during the reporting process. The nature of the relationship between Smiao Intelligence and the four companies remains unclear.
Attempts to investigate the four companies and Smiao Intelligence encountered numerous obstacles, such as unanswered phone calls, disconnected numbers, falsified addresses, locations leading to empty fields, unanswered emails, and deleted job postings on LinkedIn.
Lesser, who brought the network to light and shared his findings, emphasized that this campaign employs "well-established" techniques utilized in previous Chinese intelligence operations. He noted, "What makes this activity significant is that the network seeks to exploit the financial vulnerabilities of former federal workers affected by recent mass layoffs."
There is no evidence confirming whether these companies are connected to the Chinese government or if any former federal workers have been successfully recruited.
Three intelligence analysts indicated that the network exemplifies how foreign-linked entities attempt to gather intelligence from individuals dismissed or forced into retirement by former President Donald Trump and Elon Musk's Department of Government Efficiency. Once employed by the network, these former federal employees could be asked to share sensitive information about government operations or to recommend others who may also be targeted.
A spokesperson for the Chinese Embassy in Washington stated that China is unaware of the entities allegedly involved in this campaign, assuring that Beijing respects data privacy and security.
A White House spokesperson claimed that China continually seeks to exploit the United States' "free and open system" through espionage and coercion, urging both active and former government employees to remain vigilant about the threats these governments pose and the importance of safeguarding government information.
U.S. intelligence has expressed concerns that Russia and China are targeting disgruntled U.S. government employees—an approach both countries have pursued for years. The companies in this network, which have posted job ads on Craigslist, LinkedIn, and other job sites, could provide evidence of ongoing operations.
Recent reports indicated that some U.S. government workers with top security clearances did not receive standard exit briefings, which typically advise on how to respond if approached by foreign adversaries.
One company in the network, RiverMerge Strategies, positions itself as a "professional geopolitical risk consulting company" and had posted two job listings on its now-removed LinkedIn page in mid-February.
One advertisement sought a "Geopolitical Consulting Advisor" with experience in government agencies, international organizations, or multinational corporations, and reportedly received over 200 applications, according to a screenshot. The other ad requested a human resources specialist to leverage connections within the Washington talent pool to identify candidates with policy or consulting backgrounds.
The U.S. contact number for RiverMerge Strategies listed on their website is no longer operational. A separate Chinese contact number, previously listed on the site, corresponds to Shenzhen Si Xun Software Co., Ltd., an information technology company focused on online retail and commercial automation.
Attempts to investigate the connection between the network of companies, Smiao Intelligence, and Shenzhen Si Xun Software Co., Ltd. were unsuccessful. Calls to a number on the latter's website went unanswered.
RiverMerge Strategies had listed addresses in Singapore and Colorado on its website. The Singapore address led to a hostel on the campus of the Management Development Institute of Singapore but could not be located. The Colorado address was found to be associated with Northwest Registered Agent, a business services provider.
An anonymous informant, claiming to be an employee of RiverMerge, revealed that a contact met at a networking event in China asked him to promote job listings for RiverMerge Strategies, compensating him with $1,000 to $2,000 every few months.
A representative identifying as William Wells, described as RiverMerge’s strategies project manager, responded to an initial inquiry and asked if the sender was seeking employment, suggesting a resume review and a brief call.
Another company in the network, Wavemax Innovation, advertised on Craigslist on February 6 for "Job Opportunities for Recently Laid-Off U.S. Government Employees," targeting candidates with backgrounds in project management, research, technology, and policy analysis.
Attempts to ascertain the visibility of that job ad or responses to it were inconclusive. An email inquiry regarding the ad received no response, and a visit to the Singapore address listed on the company’s website revealed no sign of the firm.
LinkedIn stated that it employs automated technologies and a review team to detect and remove inauthentic activity and profiles. As of the latest reports, RiverMerge Strategies' profile had been restricted.
Following inquiries about the findings, an FBI spokesperson cautioned that Chinese intelligence officers may pose as think tanks, academic institutions, and recruiting firms to target current, former, and potential U.S. government employees. The agency highlighted that similar tactics had been previously employed by agents of the Chinese government.
In 2020, a Singaporean national, Jun Wei Yeo, pleaded guilty in a U.S. federal court for acting as a foreign agent, beginning in 2015, and was alleged to have identified Americans with access to sensitive information to write reports for undisclosed Asian clients, without revealing they were actually working for the Chinese government. This operation relied on a fake consulting company and job advertisements.
Chinese intelligence operatives instructed Yeo on target recruitment strategies, which included probing for dissatisfaction at work or financial troubles.
China's foreign ministry denied knowledge of Yeo’s case, arguing that the U.S. has repeatedly accused Beijing of espionage, fostering an environment of extreme suspicion.
Foreign intelligence agencies frequently employ job recruitment scams to engage sources without their knowledge of working for a foreign government. David Aaron, a former Department of Justice prosecutor now in private practice, observed that China's intelligence services might intensify such efforts, especially as many government employees suddenly face job searches. He noted that while many former government employees are driven by patriotism, some may be susceptible to deceptive recruitment tactics.