This campaign involves a China-linked espionage operation that employed fake consulting websites and social engineering tactics to recruit US clearance holders and government personnel. The adversaries created fake companies and job offers to pressure targets into disclosing confidential insider information. The operation used sophisticated methods including AI-generated profiles, stolen identities, encrypted communications, and cryptocurrency payments to appear legitimate and evade detection. The campaign was active since November 2023 and leveraged popular job platforms to reach potential victims. US authorities have seized 13 domains associated with this operation.

The campaign targeted individuals with access to classified US government information, potentially leading to unauthorized disclosure of sensitive or classified data. The use of social engineering and fake consulting roles could result in insider threats and compromise of national security information. The operation's sophisticated tactics increased the likelihood of successful recruitment and information exfiltration.

US Federal authorities have seized the domains used in this operation, disrupting the campaign infrastructure. Organizations and individuals with security clearances should remain vigilant against unsolicited job offers or consulting opportunities, especially those that pressure for confidential information. Verify the legitimacy of consulting firms and job postings, particularly on freelance platforms. No official patch or fix applies as this is a social engineering campaign. Continued awareness and reporting of suspicious recruitment attempts are recommended.