DOJ, FBI Disable 13 Websites Backed by Suspected Chinese Agents That Sought Sensitive U.S. Information from Security Clearance Holders

<div class="media entity-type-media entity-bundle-document media--document--embedded entity-document-1445291"> <div> <div class="field-formatter--media-entity-download-download-link field_media_file"><a href="/usao-dc/media/1445291/dl?inline" type="application/pdf; length=25494108" title="domain_names_x_warrant_and_affidavit_redacted.pdf" class="file file--mime-application-pdf file--application-pdf">domain_names_x_warrant_and_affidavit_redacted.pdf</a></div> </div> </div> <p>WASHINGTON&nbsp;–&nbsp;Thirteen internet&nbsp;domains&nbsp;used to target&nbsp;U.S. persons,&nbsp;including current and former security clearance holders with access to classified and sensitive U.S. government information,&nbsp;were seized&nbsp;today&nbsp;by federal authorities, announced U.S. Attorney Jeanine Ferris Pirro.&nbsp;&nbsp;</p><blockquote><p>“Today’s seizures send a clear message that any attempts to exploit Americans trusted with access to our nation’s most sensitive information will be exposed and dismantled,” said U.S. Attorney Pirro. “These sham consulting sites were crafted to deceive, but thanks to the persistent work of our prosecutors and law enforcement partners, this scheme, like so many others, has been stopped in its tracks. We will always protect the integrity of our workforce and safeguard the trusted information that underpins our national security.”&nbsp;</p></blockquote><p>Joining U.S. Attorney Pirro in the announcement were Assistant Attorney General&nbsp;John A. Eisenberg&nbsp;of the Department of Justice,&nbsp;FBI&nbsp;Special Agent in Charge Daniel Wierzbicki&nbsp;of the FBI’s&nbsp;Washington Field Office Counterintelligence and Cyber Division&nbsp;and Special Agent in Charge&nbsp;Dominique Evans&nbsp;of the FBI’s&nbsp;Norfolk&nbsp;Field&nbsp;Office.&nbsp;</p><p>“These domain seizures offer a glimpse at&nbsp;how foreign actors can use promises of easy money to lure Americans into revealing sensitive or classified information that they are duty‑bound to protect,” said Assistant Attorney General for National Security John A. Eisenberg.&nbsp;“Anyone approached online with offers of easy income for vague ‘consulting’ work should treat those overtures with extreme caution and remain vigilant for warning signs of malicious targeting.”&nbsp;</p><p>“For too long, the Chinese government has tried to exploit U.S. government employees behind the cover of fake companies and phony job postings,”&nbsp;said&nbsp;FBI&nbsp;Special&nbsp;Agent in Charge&nbsp;Daniel Wierzbicki&nbsp;of the FBI’s&nbsp;Washington Field Office Counterintelligence and Cyber Division. “Today, we shut them down. These seizures will prevent these fraudulent sites from being used to target Americans with access to sensitive information. The FBI will continue to use every tool available to protect Americans and our national security from this threat.”&nbsp;</p><p>“The Chinese government continues to pursue U.S. innovation, research, and sensitive information through a variety of deceptive techniques, including fraudulent job postings and online recruitment efforts,” said&nbsp;FBI&nbsp;Special Agent in Charge&nbsp;Dominique Evans&nbsp;of the FBI’s&nbsp;Norfolk&nbsp;Field&nbsp;Office. “By seizing these domains and exposing these tactics, we are working to protect national security, safeguard American ingenuity, and help the public recognize and defend against these threats. We urge anyone approached with suspicious job opportunities or recruitment efforts to remain vigilant, recognize the warning signs, and report suspicious activity to the FBI.”&nbsp;</p><p>&nbsp;<br>According to the&nbsp;affidavit&nbsp;filed in support of the seizure warrants,&nbsp;beginning in&nbsp;November 2023, the conspirators created at least 13 fake consulting&nbsp;company websites. The websites and their associated job postings advertised&nbsp;generic “consulting” jobs and included&nbsp;statements&nbsp;indicating&nbsp;their purpose&nbsp;was&nbsp;to recruit current or former U.S. government and U.S. military employees to provide&nbsp;expertise&nbsp;to unspecified clients.&nbsp;</p><p>The&nbsp;websites&nbsp;were typically&nbsp;linked or referenced within the entities’ job postings&nbsp;on&nbsp;hiring platforms.&nbsp;The methods and means used by the conspirators include (1) the use of aliases, fictitious personas, and the stolen identities of actual persons; (2) the use of Artificial Intelligence (AI)-generated photographs; (3) relatively large payments for research reports; (4) the use of Telegram and other encrypted applications; (5) pressure to provide “exclusive” or “insider” information; and (6) the transfer of money from places and accounts located overseas to places and accounts located in the United States.&nbsp;</p><p>According to&nbsp;court documents, the conspirators recruited applicants through job postings, on&nbsp;social media and other&nbsp;platforms&nbsp;including Upwork,&nbsp;Expertia&nbsp;AI,&nbsp;Hubstaff&nbsp;Talent,&nbsp;Wellfound, and Post Job Free. The postings&nbsp;related&nbsp;to topics of interest to the&nbsp;government of the&nbsp;People’s Republic of China.&nbsp;&nbsp;</p><p>The conspirators targeted current and former security clearance holders&nbsp;and other Americans who have&nbsp;access to classified and sensitive U.S. government information.&nbsp;The&nbsp;fake&nbsp;positions&nbsp;included “Senior Analyst”&nbsp;and&nbsp;“International Affairs Consultant” jobs. The recruiters&nbsp;pressured&nbsp;candidates&nbsp;to share confidential information and reports from “insider” sources&nbsp;in violation of their official duties.&nbsp;The&nbsp;scheme used&nbsp;contracts and confidentiality agreements to give their&nbsp;bogus&nbsp;consulting companies an air of legitimacy.&nbsp;</p><p>The conspirators&nbsp;have denied any involvement by any foreign government.&nbsp;</p><p>The&nbsp;affidavit&nbsp;alleges that the&nbsp;conspirators offered money to applicants and recruits in exchange for&nbsp;sensitive&nbsp;information,&nbsp;paid for reports using&nbsp;online payment&nbsp;accounts in the names of fictitious individuals,&nbsp;and&nbsp;used&nbsp;cryptocurrency to conceal the conspirators’ identities and the true source of the payments. These payments allowed for the flow of money from places outside the United States to places inside the United States in furtherance of the conspiracy.&nbsp;</p><p>According to the affidavit, the&nbsp;conspirators used&nbsp;the following domains&nbsp;in their conspiracy to commit bribery of current and former public officials, identity theft, and international money laundering:&nbsp;Centrik&nbsp;Global Consulting, centrikglobalconsulting.com; Rightinfo Consulting, rightinfoconsult.com;&nbsp;Finnacle-Vesper Consulting, finnaclevesperconsulting.com; CYDF Consulting, cydfconsulting.com; Pulse Wave Global, pulsewaveglobal.com; Catalyst Global Solutions, catalystglobalsolutions.com (CGS);&nbsp;Horizzen, thehorizzen.com;&nbsp;GeoIndopacific, geoindopacific.com; Global Peace Foundation – Indonesia, gpf-ina.org;&nbsp;SafeSec&nbsp;Group, safesec-group.com; The&nbsp;TruthInfo, thetruthinfo.com; Vandercons.com; and Gulf Peace Foundation, gulfpeace.org.&nbsp;&nbsp;</p><p>The&nbsp;domains seized today include&nbsp;centrikglobalconsulting.com; rightinfoconsult.com; finnaclevesperconsulting.com; cydfconsulting.com; pulsewaveglobal.com; catalystglobalsolutions.com; thehorizzen.com; geoindopacific.com; gpf-ina.org; safesec-group.com; thetruthinfo.com; Vandercons.com; and gulfpeace.org.&nbsp;&nbsp;</p><p>Following the seizures,&nbsp;the FBI&nbsp;has&nbsp;placed&nbsp;or will place&nbsp;takeover pages&nbsp;on the&nbsp;seized&nbsp;websites&nbsp;to&nbsp;warn&nbsp;site visitors&nbsp;that&nbsp;the sites&nbsp;were&nbsp;rendered&nbsp;inoperable&nbsp;in order to&nbsp;disrupt the intended&nbsp;illegal&nbsp;activity and money laundering tied to the domains.&nbsp;&nbsp;</p><p>Today’s seizure was handled by Assistant U.S. Attorney Jolie&nbsp;F.&nbsp;Zimmerman, along with the FBI’s&nbsp;Washington&nbsp;Field Office&nbsp;and Norfolk Field Office, with substantial&nbsp;assistance&nbsp;from&nbsp;Trial Attorney Maria Fedor of the Counterintelligence and Export Control Section and&nbsp;Paralegal&nbsp;Kate Abrey&nbsp;of the U.S. Attorney’s Office.&nbsp;&nbsp;</p><p><em>If you have information concerning the&nbsp;websites, please contact the FBI at 1-800-Call-</em> <em>FBI or online at tips@fbi.gov.</em>&nbsp;</p><p>Follow us on <a href="https://twitter.com/USAO_DC">Twitter</a>, <a href="https://www.instagram.com/usao_dc/">Instagram</a>, and <a href="https://www.youtube.com/@usao_dc">YouTube</a></p><p>Or at <a href="https://www.justice.gov/usao-dc">https://www.justice.gov/usao-dc</a></p>