A newly exposed intelligence operation, dubbed the “Smiao Network,” is leveraging deceptive online recruiting tactics to target both United States and Taiwan government employees, according to findings by the Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5.
Building upon previous FDD research that linked the Chinese technology company Smiao Intelligence to online schemes targeting laid-off U.S. federal workers, investigators have now uncovered evidence of a parallel campaign directed at high-value professionals in Taiwan.
Sophisticated Online Recruiting Scheme
FDD’s earlier research revealed that the Smiao Network employed fictitious consulting firms as a cover to approach and recruit individuals with access to sensitive information via job offers posted on online work platforms.
Although there is no direct evidence that these Taiwan-focused operations have yet succeeded, similar tactics were cited by the U.S. Department of Justice in April 2025 when an Army intelligence analyst was recruited online and subsequently provided over 92 classified military documents to China.
A significant development in the investigation was the identification of Pine Intelligence, a company presenting itself as a “premier geopolitical consulting firm based in Taiwan.”
Closer examination revealed several anomalies: the company’s listed address is non-existent, and it previously used a phone number with a “400” prefix, a semi-toll-free code specific to mainland China.
This same number was also found on the website of RiverMerge Strategies, another fictitious firm connected to the Smiao Network, suggesting a coordinated infrastructure.
Linguistic analysis of Pine Intelligence’s website further exposed technical inconsistencies.
While the content is largely in traditional Chinese the script commonly used in Taiwan at least eight simplified Chinese characters, which are standard in mainland China, were identified within its text.
Moreover, an automated translation misstep led to the misrepresentation of the character for “position” as “noodles,” a known pitfall when converting from simplified to traditional Chinese via automated tools, indicating the likely origin and automation of the content.
Cyber Forensics Link Fake Consulting Firms
Digital forensics tied the Pine Intelligence website to the broader Smiao Network. For instance, the site previously included a “Copyright©2019-2020 Seametis[.]com” notice.
Records indicate that seametis[.]com historically shared dedicated web-hosting infrastructure with Smiao Intelligence subdomains as well as with siss.org[.]cn, a domain linked to Smiao Intelligence’s parent corporation.
Additional evidence of operational overlap was found in Pine Intelligence’s use of Chengmail, a Chinese enterprise email solution also used by other Smiao Network entities, as shown in MX records obtained by cyber threat intelligence firm Silent Push.
Further technical scrutiny revealed that approximately 80 percent of Pine Intelligence’s website code was cloned from taiwanrisk[.]com, the legitimate site of an Australian firm specializing in geopolitical risk.
This extensive duplication included assets such as website favicons, underscoring the copy-paste approach that is an established behavioral pattern within the Smiao Network.
These findings highlight the expanding scope and adaptability of online espionage operations emanating from China, underscoring persistent risks to government and private sector professionals in both the U.S. and Taiwan.
FDD and TeamT5 recommend an intensification of intelligence-sharing frameworks between Washington and Taipei, emphasizing the necessity of public-private partnerships to proactively detect and disrupt such campaigns.
Drawing lessons from international collaborative efforts, such as those supporting Ukraine since the onset of Russia’s invasion in 2022, researchers stress that enhanced real-time threat intelligence sharing will provide critical resilience as tensions in the Taiwan Strait continue to escalate.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates
