China Recruits Insiders Via Professional Networking Sites, Five Eyes Warn

Five Eyes intelligence agencies have issued a rare joint bulletin detailing a concerning trend: Chinese military intelligence is actively using professional networking sites to recruit insiders within foreign governments and military organizations. Platforms such as LinkedIn, Indeed, and Upwork are reportedly being exploited as part of a multi-stage operation designed to gain access to sensitive information.

The operation specifically targets individuals who possess security clearances, are active military personnel, work in academia, or are journalists. These individuals are seen as valuable assets for intelligence gathering due to their access to classified or proprietary information. The recruitment process is described as a methodical, five-step scheme, indicating a well-planned and persistent effort by Chinese intelligence services.

While the bulletin does not name specific individuals or government agencies targeted, the broad categories of individuals sought suggest a wide-ranging intelligence collection effort. The use of legitimate job recruitment platforms provides a veneer of normalcy, making it more difficult for targets to recognize the malicious intent behind the overtures.

The intelligence agencies have not disclosed the exact technical methods used to identify or approach potential recruits beyond the use of these platforms. However, the emphasis on professional networking sites suggests a focus on social engineering tactics, where recruiters build rapport and trust before making their true intentions known.

This coordinated warning from the Five Eyes alliance—comprising Australia, Canada, New Zealand, the United Kingdom, and the United States—underscores the perceived severity and scale of this intelligence-gathering operation. Such joint advisories are typically reserved for threats that pose a significant and widespread risk to national security.

The bulletin aims to raise awareness among government employees and individuals in sensitive positions about the tactics being employed. It serves as a crucial reminder for professionals to exercise extreme caution when interacting with unsolicited job offers or recruitment attempts, especially those originating from unknown or suspicious sources on professional networking platforms.

While the article does not detail specific countermeasures or immediate remediation steps, the issuance of the warning itself is a form of defense, equipping potential targets with knowledge to better identify and resist such recruitment efforts. The agencies likely hope that increased vigilance will disrupt the operation and deter future attempts by Chinese intelligence to exploit these platforms for espionage purposes.

This updated advisory from MI5 and Five Eyes allies reveals that China's recruitment campaign is expanding to include more platforms like Indeed and Upwork, in addition to LinkedIn. The campaign now explicitly targets individuals with security clearance holders across defense, foreign affairs, and academia, and details a five-step recruitment process that includes trial reports and shifting communications to encrypted platforms for payment. The advisory also highlights the increasing sophistication of the payment methods, ranging from legitimate services like PayPal to cryptocurrency.

This new report from The Record details the Five Eyes' joint bulletin, 'Safeguarding Our Secrets,' which elaborates on the recruitment tactics. It highlights that Chinese intelligence officers are posing as recruiters for front companies based outside China, targeting individuals with security clearances, military personnel, and even academics and journalists. The bulletin also notes a shift from direct LinkedIn outreach to advertising roles on job platforms, allowing potential targets to initiate contact, and describes a multi-stage filtering process including virtual interviews and trial reports before sensitive material is requested via encrypted messaging.