Fake Consulting Firms Targeting Ex-U.S. Officials in Suspected Chinese Espionage Scheme: Reuters Investigation:

Max Lesser, a senior analyst on emerging threats with the Washington-based think tank Foundation for Defense of Democracies, stated that certain businesses that placed recruitment advertisements “were part of a wider network of fake consulting and headhunting companies that seek former government workers and AI specialists.” Lesser added that this is a broader “catfish scheme” that has been constructed towards headhunting.

According to Lesser's research and reporting by Reuters, there is very scant information regarding the four consulting and recruitment firms that, at least some, had overlapping websites and were digitally interconnected through sharing servers. Furthermore, Lesser's data indicates that these were “dummy firms” posing for data from former government employees who were on the market.

The four companies' websites are hosted at the same IP address as the Siaosome Intelligence, an internet services firm, that has projected a blackout of its site while it provided services. Smiao Intelligence is known for dealing with the four companies but the Suspicious IP Intelligence website claims that Siaosome is a satellite company and attorney for the aforementioned companies.

The news agency attempts to find these companies alongside Smiao Intelligence failed due to lack of response after making phone calls, and using non-functioning phone numbers and irrelevant addresses that lead to nothing except empty fields and unresponsive emails and even blanking out on working LinkedIn job postings.

Lesser, after discovering the network by himself and presenting his findings to Reuters prior to the publication, told their reporters this operation is run using Chinese intelligence methodology - an aged-old intelligence trick.

“What is important in this activity,” he stated, “is that the network is trying to take advantage of the economic hardships of ex federal employees in the wake of recent mass furloughs." Reuters was unable to ascertain whether the companies are linked to the Chinese government or if any ex federal employees were hired.

With regards to the investigation, three intelligence analysts confided to Reuters that the network in question was a textbook case of how foreign associated organizations seek to procure intelligence from personnel who have been laid off or retired due to the Trump and Musk Department of Government Efficiency's policies.

Once working with the network, federal employees would be expected to divulge more and more sensitive information about the government and, in turn, identify other potential participants who could be either complicit or non-complicit, the analysts opined.

A spokesperson for the Chinese Embassy in Washington told Reuters through an email that the Chinese authorities have no knowledge of such entities purporting to carry out the said campaign and that Beijing does not interfere with data privacy and security.

U.S. Intelligence labeled China a threat due to the nation attempting to leverage the “free and open system” of the United States to engage in espionage and blackmail. “The danger governments harbor for active and ex-employees of the government is compelling enough for such individuals to better pay attention to protecting governmental information,” stated a spokesperson.

CNN disclosed on February 28 that the U.S. intelligence services divert resources toward monitoring disgruntled U.S. government employees for China and Russia, which they have done for quite some time. Lesser argued that the companies in the network, who advertised on Craigslist and LinkedIn, are likely evidence that these activities are targeted.

Earlier in the month, Reuters stated that some U.S. government officials who possess high-level clearances were not offered routine exit debriefings that include instructions on dealing with hostile foreign powers.

“GEOPOLITICAL RISK CONSULTING”
RiverMerge Strategies, one of the offending companies, boasts on its site as a “professional consulting company on geopolitics risk,” and deleted two job posts from its LinkedIn page that were put up in mid February.

One of the forms intended for a “Geopolitical Consulting Advisor” position specified that the candidate must have work experience with government bodies, international organizations, or multinational companies. This ad was reported to have well over two hundred responses, as stated in an image of the post that circulated on Linkedin.

The second required was someone in human resources who was skillful enough to “draw from local professional networks, think tanks, and even local academic institutions” and “use policy or consulting connections” for candidate searches. The US number listed under RiverMerge Strategies on the company’s homepage has been disconnected. A different Chinese number, which was recently removed from the site’s contact page, happens to be the same as the one registered by Shenzhen Si Xun Software Co., Ltd, an information technology firm specializing in online business retail, commercial automation, and catering. According to Google’s translation of the company’s website. Reuters was unable to discern the nature of the relation between the network of companies, Smiao Intelligence, and Shenzhen Si Xun Software Co., Ltd. Attempts to call the phone number on the company’s site but receiving no answer.

Merger Strategies had listed two addresses on its website until recently – one in Singapore and the other in Colorado. Upon first guess, the Singapore address appeared to lead to a hostel located on the campus of the Management Development Institute of Singapore, but the company was not present during a Reuters visit. The other address came up with a Boulder, Colorado address associated with Northwest Registered Agent, Inc – a Colorado registered agent business.

An anonymous individual, who willingly spoke to Reuters, described attending a networking event in China where a person approached him asking him to help him advertise job openings for RiverMerge Strategies. This individual goes by the name ‘Eric’ and has a fellow associate known as Will. Subsequently, he pays the employee $1,000-2,000 bi-monthly to deploy the advertisements on job openings at RiverMerge Strategies.

William Wells identifies himself as the “strategy project manager” at RiverMerge and also happens to be the individual who replied to the first Reuters email. He expressed having some of the required answers to the questions posed by Reuters and kept asking what the need for this information was.

Despite the fact that the Reuters email claimed to come from a reporter, his Wells alias proceeded to ask what the purpose of the resume and accompanying document were and suggested doing a brief video meeting.

Other company in the network, Wavemax Innovation, posted an ad on Craiglist on February 6 looking for an employee for the position “Job Opportunities for Recently Laid-Off U.S. Government Employees”. They were entertaining people with diverse skills in project management, research, information technology, communication, policy analysis and many others. The ad expired later on. Reuters was unable to ascertain who from Wavemax’s vicinity had access to the ad and whether it was attended to.

No one responded to the email sent to the ad. There were no leads for the company in Singapore’s corporate registry either. Upon checking their website, Reuters was only greeted with an empty lot instead of the expected company and the field where it was located. The email address from the ad was not responded to. In the case of LinkedIn, checking one of the job posts is done using advanced automated technology combined with employee check ups. According to the spokesperson, the profile for RiverMerge Strategies had limited access on Tuesday when asked for comment by reporters.

Invoking the report, an FBI representative reminded that employees of the Chinese intelligence can disguise as think tanks or recruiters and use them as cover to pursue former, current, or future employees of the us government. They went on to explain how they’ve gone after people in the USA before.

In 2020, a Singaporean citizen, Jun Wei Yeo, pled guilty to being a foreign agent at a federal court in America. He had been working for an unnamed foreign power since the year 2015. According to public prosecutors, he neglected to inform his clients in Asia that he was writing reports for them on alleged Americans who possessed non-public sensitive data, which could be forwarded to the Chinese government for other uses other than hurting American interests. Those unsophisticated foreigners would pay big bucks to engage Chinese domestic spies residing in America.

In order to accomplish that, a sham consulting firm and fake sponsering employment offers were used, as provided in the court documents.

The court records went further to suggest that Yeo was given directions from Chinese intelligence on how to approach marks such as “are you unhappy with your job, are you dealing with financial problems or do you have children to support?”

According to the South China Morning Post, the Chinese foreign ministry refuted accusations knowing anything about Yeo, while they charged the United States for blaming China of spying too much, declaring it “has attained a degree of undue skepticism.” `Forier`, a private practice of an America former Department of Justice prosecutor, claimed that undercover sources often disguise themselves as job offers in order to lure in unsuspecting victims who do not know that they are working for a foreign power.

As Aaron put it, ‘I expect China’s intelligence services to increase efforts in those areas because they anticipate a large number of civil servants suddenly needing to find new work.’ He went on to explain that some employees may be more susceptible to unscrupulous strategies while deeply patriotic.