Loading story…
NASA's Office of Inspector General disclosed that Chinese national Song Wu allegedly conducted a years-long spear-phishing and impersonation campaign to obtain sensitive aerospace and defense-related software, source code, and other controlled technical information from NASA personnel, other U.S. government agencies, universities, and private companies. U.S. authorities said the operation ran from 2017 through 2021 and relied on fraudulent emails and false identities, with Wu posing as U.S. engineers, friends, and colleagues to persuade victims to share restricted data in violation of export control laws.
The U.S. Department of Justice charged Wu in September 2024 with wire fraud and aggravated identity theft, and the FBI has since placed him on its Most Wanted list. Investigators identified him as an engineer at the Aviation Industry Corporation of China (AVIC) and assessed the stolen software as having both industrial and military applications, including advanced tactical missile development and aerodynamic weapons design, underscoring the campaign's significance for U.S. national security and the defense industrial base.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
NASA's Office of Inspector General disclosed details of the alleged Chinese phishing operation, including its targeting of NASA personnel and the FBI's assessment that the stolen software had industrial and military applications.
Following the charges, Song Wu remained at large and was added to the FBI's Most Wanted list in connection with the alleged theft of sensitive aerospace and defense-related technical information.
In September 2024, the U.S. Department of Justice charged Song Wu, an engineer identified as working for AVIC, with wire fraud and aggravated identity theft for the alleged phishing and impersonation scheme.
From January 2017 through December 2021, Song Wu allegedly conducted a multi-year spear-phishing and impersonation campaign targeting NASA employees, other U.S. government agencies, universities, and private companies to obtain export-controlled aerospace and defense software and source code.
The Manhattan U.S. Attorney and FBI announced charges against seven individuals for allegedly engineering a sophisticated internet fraud scheme that infected millions of computers worldwide and manipulated the internet advertising business.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemalwarebytes.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcefbi.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026
China-aligned espionage actor **TA419** targeted U.S. artificial-intelligence policy experts at think tanks, universities, and law firms with credential-phishing campaigns focused on AI governance, export controls, supply chains, and military AI. Beginning July 8, the operators impersonated former White House technology official Lynne Edwards Parker and former State Department chief economist Heidi Crebo-Rediker, using fabricated policy invitations to establish contact. A related February operation impersonated a senior Anthropic employee and sought feedback on military integration of Claude. After recipients responded, TA419 directed them through URL shorteners and actor-controlled infrastructure to fraudulent OneDrive pages using a customized **Frameless BitB** adversary-in-the-middle kit. The phishing flow relayed genuine Microsoft 365/Entra ID authentication, including MFA and conditional-access prompts, and aimed to steal authenticated session cookies as well as credentials. Proofpoint assessed the activity as Chinese intelligence collection against U.S. AI-policy and national-security deliberations; it did not determine how many people were targeted, whether accounts were compromised, or whether data was taken. The campaign coincides with intensifying U.S.-China competition over frontier AI, semiconductor controls, open-source models, and military and industrial AI capabilities.
Oct 2, 2026
A U.S. federal jury convicted former Google engineer **Linwei Ding** (aka **Leon Ding**) on **14 counts** spanning **economic espionage** and **theft of trade secrets** after prosecutors said he stole thousands of confidential Google documents tied to the company’s artificial intelligence technology for the benefit of a China-based startup. The U.S. Department of Justice framed the case as protection of U.S. intellectual property and national security, alleging the theft was intended to advantage the **People’s Republic of China (PRC)**. Reporting indicates Ding began exfiltrating internal materials as early as **May 2022**, including by copying content into the **Apple Notes** app, converting it to PDFs, and uploading it to a personal cloud account. The stolen information reportedly covered sensitive AI infrastructure and chip-related technology, including details associated with Google’s AI supercomputing environment (e.g., data center/cluster management components) and hardware/software used to run AI workloads (including **TPU/GPU systems** and related networking components). Ding was initially indicted in **March 2024**, with subsequent superseding indictments expanding the alleged timeframe and charges; the case is cited as *USA v. Ding*, N.D. Cal., No. `3:24-cr-00141`.
Jun 29, 2026