The FBI and Justice Department have dismantled 13 websites allegedly used by Chinese intelligence operatives to recruit current and former U.S. government employees, marking one of the most extensive public crackdowns in recent years on foreign efforts to exploit America's security-cleared workforce.
Federal authorities announced the domain seizures on June 10, saying the websites masqueraded as legitimate consulting and recruiting firms while targeting individuals with government, military and national-security backgrounds. Investigators allege the operation sought to obtain sensitive information from Americans by offering consulting assignments, research contracts and lucrative employment opportunities.
The takedown comes as U.S. counterintelligence agencies warn that large-scale federal workforce reductions have created an attractive pool of experienced former government personnel actively searching for new jobs. According to court filings supporting the seizures, the alleged recruitment effort dates back to late 2023 but expanded as more federal employees entered the private job market.
Authorities said the websites operated under names including Centrik Global Consulting, Catalyst Global Solutions, GeoIndopacific, SafeSec Group and Gulf Peace Foundation. Investigators allege the organizations were fictitious and designed to appear credible through professional-looking websites, fabricated executive profiles, stolen identities and AI-generated photographs.
According to Justice Department filings, recruiters advertised positions on platforms such as LinkedIn, Upwork, Expertia AI and Wellfound. Job titles reportedly included roles such as "Senior Analyst," "International Affairs Consultant" and opportunities specifically marketed toward former military personnel.
Once candidates expressed interest, investigators allege they were encouraged to provide insider analysis and confidential information related to subjects including U.S.-China relations, Iran, and the Israel-Palestine conflict. Authorities contend that contracts, confidentiality agreements and consulting arrangements were used to create the appearance of legitimate professional work.
The FBI said payments were routed through overseas financial channels and cryptocurrency accounts. Court documents allege the operators "used online payment accounts in the names of fictitious individuals" to obscure the source of funds and conceal links to foreign actors.
The investigation also highlighted increasingly sophisticated deception tactics. One of the alleged recruitment websites reportedly featured testimonials attributed to fictional characters from the comedy film Anchorman, including Ron Burgundy and Brick Tamland, an indication investigators say of how rapidly such sites were assembled while still attempting to project legitimacy.
Federal officials tied the case to broader concerns about foreign intelligence services targeting unemployed government workers. A Naval Criminal Investigative Service assessment previously reviewed by CNN warned that foreign operatives were actively monitoring social media and professional networking platforms for federal employees signaling they were "open to work."
The National Counterintelligence and Security Center issued a similar warning in 2025, cautioning that Chinese intelligence services were increasingly posing as "consulting firms, corporate headhunters, think tanks, and other entities on social and professional networking sites." The agency said the recruitment tactics had become increasingly sophisticated and difficult to identify.
Senior law-enforcement officials used the announcement to deliver a broader warning to former government personnel.
"For too long, the Chinese government has tried to exploit US government employees behind the cover of fake companies and phony job postings," FBI Washington Field Office Counterintelligence and Cyber Division Special Agent in Charge Daniel Wierzbicki said. "Today, we shut them down."
Assistant Attorney General for National Security John A. Eisenberg emphasized the financial incentives allegedly used in the operation. "These domain seizures offer a glimpse at how foreign actors can use promises of easy money to lure Americans into revealing sensitive or classified information that they are duty-bound to protect," he said. "Anyone approached online with offers of easy income for vague 'consulting' work should treat those overtures with extreme caution."
FBI Counterintelligence and Espionage Division Assistant Director Roman Rozhavsky pointed to the growing use of artificial intelligence in espionage tradecraft. "The fake consulting company domains seized by the FBI illustrate the lengths the Chinese government's intelligence services will go to as they try to use AI-generated content to trick, recruit, or coerce current and former US security clearance holders," he said.
Investigators said several leads came directly from individuals who became suspicious after being contacted by the alleged recruiters. As Wierzbicki told the Associated Press: "A lot of this information came from doing interviews, interviews with people who came forward that something didn't seem right."
