Researchers Warn of ‘Smiao Network’ Cyber Threat Against Taiwan’s Federal Staff
The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 have identified a Chinese intelligence operation, named the 'Smiao Network', that targets federal workers in both the United States and Taiwan.
The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 have identified a Chinese intelligence operation, named the 'Smiao Network', that targets federal workers in both the United States and Taiwan.
This network, associated with the Chinese company Smiao Intelligence, uses deceptive online recruitment strategies to gather sensitive information from high-value professionals.
Initially discovered earlier this year, the operation involved fake consulting firms aiming at laid-off U.S. federal employees.
Further investigation has uncovered a similar approach targeting Taiwan, using online work platforms and geopolitical consulting as a cover.
While there is no confirmed success in Taiwan, a related case in the U.S. involved an Army intelligence analyst, resulting in the leak of over 92 sensitive military documents, as stated in an April 2025 Department of Justice press release.
TeamT5 has identified an extension of the Smiao Network called Pine Intelligence. This entity shares a phone number with RiverMerge Strategies, another fictitious consulting firm within the network.
Pine Intelligence falsely claims to be a Taiwan-based consulting firm but lists a nonexistent address and previously shared a mainland China-specific phone number with RiverMerge.
Initially discovered earlier this year, the operation involved fake consulting firms aiming at laid-off U.S.
Linguistic analysis of its website, which uses traditional Chinese characters, suggests origins from mainland creators due to a mix of simplified characters and translation errors.
Historical web-hosting records link Pine Intelligence to Smiao Intelligence’s parent company domains. Its website mirrors a significant portion of its source code from an Australian firm, taiwanrisk[.]com.
The use of Chengmail, a Chinese email service, further connects Pine Intelligence to other entities in the network, as confirmed by cyber threat intelligence firm Silent Push.
The cyber threats faced by the United States and Taiwan highlight the need for comprehensive intelligence sharing to counter espionage efforts.
These operations go beyond infrastructure attacks to involve sophisticated social engineering aimed at insider recruitment.
The U.S. government has initiated intelligence collaboration with Taipei, a move suggested to be expanded further.
Incorporating private sector and non-profit expertise could enhance these efforts, similar to threat-sharing initiatives aiding Ukraine since 2022.
With ongoing tensions between Beijing and Taipei, proactive measures to protect sensitive data and personnel are critical.
The Smiao Network’s tactics underscore the urgency of strategies to protect national security assets from covert cyber operations, addressing potential vulnerabilities before they can be exploited.
Based on reporting by GBHackers.