The seizure of 13 fake consulting domains exposes an industrial-scale Chinese effort to recruit American security clearance holders through ordinary job platforms.
Intelligence Lead
The Justice Department and FBI have disabled 13 websites operated by suspected Chinese intelligence agents, fronts built to recruit current and former US government and military personnel holding security clearances. The takedown, announced 10 June, confirms what the Five Eyes alliance warned of a week earlier: Beijing has industrialised human-source recruitment through commercial employment platforms. The counterintelligence battleground has moved from embassy cocktail circuits to the gig economy.
Situation Report
Federal authorities confirmed the seizure of 13 domains tied to fictitious consulting firms, among them Centrik Global Consulting, Rightinfo Consulting, Pulse Wave Global, SafeSec Group, and the Gulf Peace Foundation. According to the Justice Department, the operation traced back to November 2023 and systematically targeted cleared personnel through job listings for consulting and analyst roles.
The network identified targets through established employment and freelance marketplaces, including Upwork, Expertia AI, Hubstaff Talent, Wellfound, and Post Job. Once contact was made, recruiters pressed applicants for exclusive or insider information, offering payments well above market rates for written research reports.
Tradecraft documented by investigators includes aliases and fictitious personas, stolen identities of real individuals, AI-generated profile photographs, communication shifted to Telegram and other encrypted applications, and payments routed through overseas accounts. Two of the seized domains posed as peace foundations, a reported attempt to borrow the credibility of the NGO sector.
The action follows a rare joint advisory issued 3 June by the United States and its Five Eyes partners, warning that Chinese military intelligence services were exploiting LinkedIn and other professional networking platforms to target security personnel across allied nations.
Background & Context
Chinese intelligence services have run platform-based recruitment for the better part of a decade. The cases of Kevin Mallory and Ron Rockwell Hansen, both former US intelligence officers recruited through LinkedIn approaches and convicted of espionage, established the model. What has changed is scale and automation. AI-generated personas remove the bottleneck of building credible cover identities by hand, and freelance marketplaces supply a continuous stream of self-identifying candidates whose profiles advertise their clearances and agency histories.
The consulting-firm cover is well chosen. The boundary between legitimate expert-network work and elicitation is deliberately blurred. Thousands of former officials lawfully sell their expertise to consultancies, and a cleared professional fielding a paid research request from an unfamiliar firm has few reliable signals separating a genuine client from a Ministry of State Security cutout. The seized network exploited precisely that ambiguity, beginning with anodyne taskings before escalating pressure toward non-public information.
Analysis & Assessment
The takedown is assessed as disruptive rather than decisive. Domain seizure imposes minimal cost on the sponsoring service; replacement infrastructure can be registered within days, and the underlying targeting data already harvested from applicants remains in Chinese hands. The more consequential effect is exposure: publishing the tradecraft, the platform names, and the full list of front companies raises the baseline awareness of the cleared workforce and complicates future approaches.
The coordination sequence, a Five Eyes advisory on 3 June followed by a US enforcement action on 10 June, indicates a deliberate alliance-wide campaign of exposure rather than an isolated prosecution. Parallel actions by allied services are assessed as likely in the coming months.
The structural vulnerability remains unaddressed. Job platforms have no clearance-aware vetting layer, and financial pressure on former government personnel ensures a receptive recruitment pool. It is assessed as probable that Chinese services will migrate toward smaller platforms, direct outreach, and third-country intermediaries, accepting higher friction in exchange for lower visibility. The recruitment model survives the takedown; only its current infrastructure did not.