A network of fake consulting and headhunting firms operated by a secretive 
tech firm has been trying to recruit recently laid-off US government workers and AI researchers through recruitment ads. The campaign follows "well-established" techniques used by previous intel operations.
What makes this activity significant is that the network seeks to exploit the financial vulnerabilities of former federal workers affected by recent mass layoffs.
Once employed by the network, federal employees could then be asked to share increasingly sensitive information about government operations, or recommend additional people who might be targeted for willing or unwitting participation.
Little info is publicly available on the 4 consultancies and recruitment companies involved in the network, which in some cases shared overlapping websites, were hosted on the same server, or had other digital links.
The 4 companies' websites are hosted at the same IP address alongside Smiao Intelligence, an internet services company whose website is now unavailable.
Attempts to track down the four companies and Smiao Intelligence ran into numerous dead-ends including unanswered phone calls, phone numbers that no longer work, fake addresses, addresses that lead to empty fields, unanswered emails and deleted job listings from LinkedIn.
One of the companies in the network, RiverMerge Strategies, bills itself on its website as a "professional geopolitical risk consulting company" and posted two since-deleted job listings on its since-removed LinkedIn page in mid-Feb.
One ad that sought a "Geopolitical Consulting Advisor" with experience with government agencies, international organizations, or multinational corporations, displayed that it had more than 200 applications.
The other sought a HR specialist who could utilize a deep understanding of the Washington talent pool to identify candidates with policy or consulting experience, and leverage connections to local professional networks, think tanks, and academic institutions.
The US number for RiverMerge Strategies is no longer in service. A separate Chinese phone number is the same number listed by Shenzhen Si Xun Software Co Ltd.
RiverMerge Strategies until recently listed two addresses on its website, one in Singapore and the other in Colorado. The Singapore address led to a hostel building within the campus of the Management Development Institute of Singapore, but the company could not be located. Its other address was one in Boulder, Colorado, tied to Northwest Registered Agent, a business services firm.
A person listed on LinkedIn as an employee of RiverMerge said an acquaintance he met at a networking event in China reached out and asked him to help promote job listings for RiverMerge Strategies. The acquaintance pays the employee $1,000 or $2,000 every 2 or 3 months to post the job listings.
Another company in the network, Wavemax Innovation, placed an ad Feb 6 on Craigslist offering "Job Opportunities for Recently Laid-Off US Government Employees." The ad sought workers with backgrounds in project management, research, technology, communications, policy analysis and more.
The Singapore address posted to the company’s website leads to a vacant field. A search of Singapore's corporate registry for the company is equally barren.
intelligence officers can represent themselves as think tanks, academic institutions and recruiting firms to target current, former, and prospective US government employees.
Foreign intel services often use job recruitment scams to recruit sources without them even knowing they are working for a foreign government.
intel services would certainly dial those efforts up as they see a wave of government employees suddenly having to look for new jobs. while many former government employees are motivated by patriotism, some may be vulnerable to deceptive tactics.
reuters.com/world/china/se
tech firm has been trying to recruit recently laid-off US government workers and AI researchers through recruitment ads. The campaign follows "well-established" techniques used by previous intel operations.
What makes this activity significant is that the network seeks to exploit the financial vulnerabilities of former federal workers affected by recent mass layoffs.
Once employed by the network, federal employees could then be asked to share increasingly sensitive information about government operations, or recommend additional people who might be targeted for willing or unwitting participation.
Little info is publicly available on the 4 consultancies and recruitment companies involved in the network, which in some cases shared overlapping websites, were hosted on the same server, or had other digital links.
The 4 companies' websites are hosted at the same IP address alongside Smiao Intelligence, an internet services company whose website is now unavailable.
Attempts to track down the four companies and Smiao Intelligence ran into numerous dead-ends including unanswered phone calls, phone numbers that no longer work, fake addresses, addresses that lead to empty fields, unanswered emails and deleted job listings from LinkedIn.
One of the companies in the network, RiverMerge Strategies, bills itself on its website as a "professional geopolitical risk consulting company" and posted two since-deleted job listings on its since-removed LinkedIn page in mid-Feb.
One ad that sought a "Geopolitical Consulting Advisor" with experience with government agencies, international organizations, or multinational corporations, displayed that it had more than 200 applications.
The other sought a HR specialist who could utilize a deep understanding of the Washington talent pool to identify candidates with policy or consulting experience, and leverage connections to local professional networks, think tanks, and academic institutions.
The US number for RiverMerge Strategies is no longer in service. A separate Chinese phone number is the same number listed by Shenzhen Si Xun Software Co Ltd.
RiverMerge Strategies until recently listed two addresses on its website, one in Singapore and the other in Colorado. The Singapore address led to a hostel building within the campus of the Management Development Institute of Singapore, but the company could not be located. Its other address was one in Boulder, Colorado, tied to Northwest Registered Agent, a business services firm.
A person listed on LinkedIn as an employee of RiverMerge said an acquaintance he met at a networking event in China reached out and asked him to help promote job listings for RiverMerge Strategies. The acquaintance pays the employee $1,000 or $2,000 every 2 or 3 months to post the job listings.
Another company in the network, Wavemax Innovation, placed an ad Feb 6 on Craigslist offering "Job Opportunities for Recently Laid-Off US Government Employees." The ad sought workers with backgrounds in project management, research, technology, communications, policy analysis and more.
The Singapore address posted to the company’s website leads to a vacant field. A search of Singapore's corporate registry for the company is equally barren.
intelligence officers can represent themselves as think tanks, academic institutions and recruiting firms to target current, former, and prospective US government employees.
Foreign intel services often use job recruitment scams to recruit sources without them even knowing they are working for a foreign government.
intel services would certainly dial those efforts up as they see a wave of government employees suddenly having to look for new jobs. while many former government employees are motivated by patriotism, some may be vulnerable to deceptive tactics.
reuters.com/world/china/se