FBI seizes 13 websites linked to Chinese espionage operation
Federal authorities have seized more than a dozen websites that officials say were used by suspected Chinese agents to recruit current and former American officials with security clearances, the Justice Department announced Wednesday. The operation targeted 13 websites that posed as legitimate consulting companies advertising job openings, but were entirely fabricated fronts designed to extract sensitive and potentially classified information from unsuspecting recruits.
According to an FBI affidavit supporting the seizures, the fake companies advertised positions including international affairs analyst roles, defense analyst positions and jobs marketed specifically to former military personnel. The postings were designed to appear credible and professional, making them difficult to distinguish from legitimate consulting opportunities.
The 13 fake websites the FBI shut down
According to the official Justice Department press release and unsealed FBI court affidavits, the following fraudulent domains were seized as part of the operation:
Centrik Global Consulting at centrikglobalconsulting.com, Pulse Wave Global at pulsewaveglobal.com, Gulf Peace Foundation at gulfpeace.org, Rightinfo Consulting at rightinfoconsult.com, GeoIndopacific at geoindopacific.com, TruthInfo at thetruthinfo.com, Finnacle Vesper Consulting at finnaclevesperconsulting.com, Catalyst Global Solutions at catalystglobalsolutions.com, CYDF Consulting at cydfconsulting.com, The Horizzen at thehorizzen.com, SafeSec Group at safesec-group.com, Vandercons at vandercons.com and Gulf Peace Foundation INA at gpf-ina.org.
Each site was designed to appear as a functioning professional consulting firm, complete with job listings, company profiles and in some cases fabricated testimonials to add credibility.
How the scheme worked
Recruiters connected with targets through job search platforms including LinkedIn, Upwork and similar sites. The FBI affidavit identifies seven unnamed individuals who were recruited through the websites and describes how those recruiters then pressed them for research papers and insider analysis on subjects of significant interest to the Chinese government, including US-China relations, Iran and the Israel-Palestine conflict. The recruiters specifically pushed for exclusive or insider information rather than publicly available material.
Payments to recruits were routed through accounts in the United States but originated from overseas accounts, according to the affidavit. The entire operation was funded through cryptocurrency and foreign banks, adding layers of concealment to the financial trail.
To make the fake companies appear legitimate, the conspirators allegedly copied information and photographs from real overseas companies and repurposed them on the fraudulent websites. They also deployed identity theft, AI-generated photos and videos and offered relatively large payments for research reports as recruitment incentives.
The level of fabrication extended to absurd lengths in at least one case. One of the seized websites allegedly included testimonials from fictional characters lifted from the comedy film Anchorman, including Will Ferrell’s Ron Burgundy and Steve Carell’s Brick Tamland.
Who was behind it and what the FBI believes
The FBI believes the individuals running the alleged scheme were all located overseas and were acting on behalf of the Chinese government, either with full awareness of that connection or without knowing the ultimate beneficiary of their work. The people operating the websites denied any involvement by a foreign government, according to a Justice Department press release.
It remains unclear whether any classified material was ever actually shared through the scheme.
A broader pattern of foreign recruitment
The operation fits into a documented pattern of foreign intelligence targeting of American government workers. Last year, a report from the Naval Criminal Investigative Service found that foreign actors were attempting to recruit federal employees and exploit the Trump administration’s plans for mass layoffs across various agencies. At least one foreign intelligence officer directed an asset to create a company profile on LinkedIn and post job advertisements specifically targeting federal workers who had indicated they were open to new employment.
The latest FBI action suggests the threat has not diminished and that foreign actors continue to refine their tactics, using the tools of the modern job market to identify and approach people with access to sensitive government information.