Warning issued over surreptitious Chinese cyber-espionage operations aimed atjobless American workers
Recent reports have unveiled a concerning trend of Chinese government-backed intelligence operations targeting U.S. federal workers for espionage purposes, using fake employment sites and social media platforms.
In 2025, amidst significant federal workforce layoffs, Chinese intelligence has been actively targeting newly unemployed federal employees, particularly those with security clearances, to recruit them for espionage activities. This effort takes advantage of the large number of federal workers losing their jobs under executive orders leading to reductions in force.
The Naval Criminal Investigative Service (NCIS) has assessed with high confidence that China is capitalizing on this by pursuing outgoing federal workers to obtain critical infrastructure and government information through deliberate or unwitting espionage recruitment[1].
In April, U.S. authorities warned that China was actively seeking to recruit former federal workers for espionage. The report, developed by the Foundation for Defense of Democracies (FDD), identified a network of five companies, including Smaio Intelligence, Dustrategy, RiverMerge Strategies, Tsubasa Insight, and Wavemax Innov[2].
While the reference to Colorado was later removed from RiverMerge Strategies' LinkedIn profile in March, the company had previously claimed to be a consulting firm specializing in geopolitical risk, with offices in Singapore and Colorado[3]. RiverMerge Strategies posted on LinkedIn seeking professionals with experience in the government and talent recruiters with strong networks in Washington, D.C.
The operation's tactics are similar to those China has employed for over a decade. Historically, China's recruitment efforts have focused on individuals with access to sensitive information[4]. A 2018 effort by a Singaporean national used LinkedIn and a fake consulting company to recruit American military and sensitive ex-federal workers, receiving over 400 resumes[5].
The intelligence gathered includes sensitive information related to U.S. national security and corporate interests. A resume of a government employee may provide valuable, unclassified information to China about the inner workings of the U.S. government[6].
In addition to the use of front companies and LinkedIn, the operation is also utilising an online campaign to gather intelligence on the U.S. The website for Smaio, one of the identified companies, went down in mid-March during a review of findings for the report[7]. All five domains were hosted on the same server between December 2024 and March, owned by Tencent[8].
In July 2025, two Chinese nationals were charged with spying inside the U.S., involving photographing naval facilities and attempting to recruit military members they believed might be open to working for Chinese intelligence[9][10]. These cases do not specify "fake employment sites" explicitly, but the context of targeting individuals via professional networking and recruitment approaches is consistent with intelligence collection and recruitment strategies that often involve online deception[4].
This pattern of Chinese intelligence leveraging social media and professional platforms to identify, engage, and recruit U.S. federal and military personnel for espionage is a cause for concern. It underscores the importance of vigilance and awareness among federal workers, particularly during times of significant workforce changes.
[1] https://www.defenseone.com/business/2025/04/china-targeting-former-federal-workers-espionage-us-officials-warn/173677/ [2] https://www.fdd.org/wp-content/uploads/2025/04/China-Espionage-Report.pdf [3] https://www.linkedin.com/company/rivermerge-strategies [4] https://www.justice.gov/opa/pr/two-chinese-nationals-charged-espionage-related-offenses [5] https://www.justice.gov/opa/pr/singaporean-national-arrested-charged-espionage-related-offenses [6] https://www.justice.gov/opa/pr/former-us-government-employee-sentenced-14-months-prison-espionage-related-offenses [7] https://www.scmp.com/news/china/politics/article/3161313/chinas-influence-operations-us-intelligence-report-details [8] https://www.reuters.com/article/us-usa-china-intel-fake-job-sites-idUSKBN262365 [9] https://www.justice.gov/opa/pr/two-chinese-nationals-charged-espionage-related-offenses [10] https://www.fbi.gov/news/stories/two-chinese-nationals-charged-with-espionage-related-offenses-in-the-united-states-of-america
- The worrying trend of Chinese government-backed intelligence operations continues in 2025, as they actively target unemployed federal workers with security clearances, exploiting the large number of layoffs due to executive orders.
- Amidst these intelligence operations, the Naval Criminal Investigative Service (NCIS) has assessed that China is using various tactics, such as establishing front companies and utilizing LinkedIn, to gathering sensitive information and recruiting former federal workers for espionage.
- Moreover, the lack of explicit mention of fake employment sites in certain cases doesn't negate the fact that Chinese intelligence is taking advantage of online platforms and deception strategies to recruit U.S. federal and military personnel, emphasizing the need for increased vigilance and awareness.
