Researchers Warns of ‘Smiao Network’ Targeting Taiwan Federal Workers

Cybersecurity researchers have uncovered an expansion of a sophisticated Chinese intelligence recruitment operation known as the “Smiao Network,” which has now extended its targeting to include Taiwanese federal workers.

The operation, previously identified targeting U.S. government employees, creates elaborate fake consulting companies as fronts for intelligence recruitment efforts.

Technical analysis of the network reveals a complex web of digital infrastructure designed to appear legitimate while concealing connections to Chinese intelligence services.

The Smiao Network operates by establishing seemingly professional geopolitical consulting firms that specifically target individuals with access to sensitive government information.

The operation uses sophisticated social engineering techniques rather than traditional malware, focusing on human exploitation through fake job opportunities.

Investigation revealed that while no successful recruitments have been confirmed in Taiwan, similar tactics recently led to the compromise of an Army intelligence analyst who provided over 92 sensitive military documents to Chinese operatives.

FDD researchers identified this expanding threat through technical analysis of digital fingerprints left across multiple fake company websites.

The investigation uncovered Pine Intelligence, a purported “premier geopolitical consulting firm based in Taiwan” that shares technical infrastructure with previously identified Smiao Network operations.

The company presents itself as a legitimate Taiwanese business but contains numerous technical indicators betraying its mainland Chinese origins.

Technical analysis of Pine Intelligence’s web presence revealed multiple operational security failures that exposed the connection to Chinese intelligence activities.

Most notably, the company listed a non-existent Taiwanese address while simultaneously using a phone number with a 400 prefix – distinctively used for semi-toll-free numbers in mainland China, matching numbers used by other Smiao Network entities.

Further forensic website examination uncovered that Pine Intelligence had copied approximately 80% of its source code from a legitimate Australian business focused on geopolitical risk assessment.

This code-cloning behavior represents a common tactic across the Smiao Network’s fake company ecosystem.

Website analysis also revealed linguistic errors typical of simplified-to-traditional Chinese character conversion, including the mistranslation of “面” (position) to “麵” (noodles) – indicating content creation in mainland China.

The infrastructure analysis proved particularly revealing, as researchers discovered Pine Intelligence utilizing Chengmail, a niche Chinese enterprise email service also employed by four other companies in the network.

Additionally, website hosting investigation showed shared servers with subdomains of Smiao Intelligence’s main site and associated corporate entities.

The discovery highlights the growing need for enhanced intelligence sharing between Washington and Taipei concerning Chinese operations targeting both nations’ security infrastructure.

Equip your SOC team with deep threat analysis for faster response -> Get Extra 𝗦𝗮𝗻𝗱𝗯𝗼𝘅 𝗹𝗶𝗰𝗲𝗻𝘀𝗲𝘀 for Free