KnowBe4 Security Awareness Training Blog

LinkedIn Deception: How a Chinese Spy Tricked Thousands of UK Officials

Written by Stu Sjouwerman | Aug 23, 2023 2:35:27 PM

In last few years, cyber espionage has taken a new form. A recent investigation by The Times has unveiled a Chinese intelligence officer's extensive use of LinkedIn to target UK officials. Operating under the alias "Robin Zhang," this spy has been luring thousands of officials, scientists, and academics to hand over state secrets and sensitive technology information.

The Industrial Scale Operation

For at least five years, Zhang has been operating on an industrial scale, creating fake companies and profiles on LinkedIn. His targets include military personnel, politicians, and those working in sensitive areas. He's even offered recruitment consultants £8,000 for details of candidates from the intelligence services.

The Art of Deception

Zhang's methods were crude but effective. He used stock images and photographs of innocent people for his online profiles. He flattered targets, offered cash, and promised all-expenses-paid trips to China. His ultimate goal? To get targets to travel to China, where they could be coerced into revealing more information.

The Think Before You Link Campaign

In response to this growing threat, MI5 has launched an app as part of the "Think Before You Link" campaign. This app helps users identify fake profiles and foreign spies, allowing them to check whether profile pictures are stock images used widely across the internet.

A Wake-Up Call

This case serves as a wake-up call for all professionals. It's not just government employees who need to exercise caution; businesses with commercially sensitive information, researchers, and academics must also be vigilant. The new National Security Act has put espionage laws back on the front foot, and MI5 is helping people understand the hallmarks of fake profiles.

Protecting Yourself

How can you protect yourself in the UK? Be cautious of companies not listed with Companies House, or those with no information beyond their website's homepage. Look out for profiles that lack details you can confirm elsewhere. Step through frequent security awareness training. And remember, if something looks too good to be true, it probably is.