China's shadow war: targeting journalists, exposing a global network
The International Consortium of Investigative Journalists (ICIJ) has become the target of a sophisticated, state-sponsored cyber campaign aimed at pilfering sensitive information from journalists and activists focused on China’s activities worldwide. The operation, detailed in a report released today, reveals a disturbing pattern of digital repression extending far beyond China’s borders, implicating financial institutions and governmental entities in a complex web of complicity.
Deceptive emails and fabricated whistleblowers
The attacks began in May 2025 with what appeared to be routine interview requests. Kuochun Hung, chief operating officer of the Taiwanese media outlet Watchout, received an email from someone claiming to be Yi-Shan Chen, a respected local reporter working for the ICIJ. The email sought an interview on sensitive topics, including Taiwan’s political landscape and Watchout’s engagement with civil society groups. Hung, whose organization specializes in tracking disinformation, immediately recognized anomalies – the email’s tone was oddly simplistic for a senior journalist, the name was misspelled, and the domain was incorrect.
Further interaction via the messaging app LINE, using Chen’s name and photo, led to a fabricated ICIJ webpage and a suspicious link promising access to interview questions. The fake “Chen” even cautioned Hung about information security—a redundant warning that underscored the deceptive nature of the attempt. “I played stupid,” Hung recounted, “And then she gave up.”
But the effort didn’t stop there. Just weeks later, another potential source, identifying himself as Bai Bin—a former Beijing judicial assistant—reached out to the ICIJ with claims of a $10 million embezzlement scheme within China’s anti-graft agency. Bai’s email, penned in English, contained suspiciously formal phrasing and employed an unusual em dash—a stylistic quirk common in AI-generated text. Crucially, the email account belonged to a former U.S. diplomat specializing in Chinese and Taiwanese affairs—a fact that immediately raised red flags.
A wider campaign of repression
The ICIJ’s findings are part of a broader trend of digital transnational repression, a tactic increasingly employed by authoritarian regimes like China and Russia to intimidate, threaten, and surveil dissidents and journalists abroad. According to a recent European Parliament study, this involves the use of online technologies to target individuals and groups critical of those regimes. The scale of Beijing’s operations is staggering: last year, the ICIJ and its partners interviewed over 100 targets of Chinese repression, finding that nearly half had experienced online smear campaigns, hacking attempts, or phishing scams.
The attacks against the ICIJ network are not isolated incidents; they represent a “wide-ranging campaign” to steal private information from entities of interest to the Chinese government, including Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora activists. The implications are far-reaching, highlighting the interconnectedness of financial institutions, government agencies, and authoritarian control.
The shadow economy of cyber espionage
China’s approach is particularly insidious, relying on “hackers-for-hire” who actively compete to fulfill the government’s cyber operations needs. These mercenaries offer a range of services, from monitoring social media to selling spyware and phishing kits—effectively commodifying the tools of digital repression. The sheer volume and sophistication of these attacks demonstrate the resources Beijing is willing to invest in silencing dissent and protecting its interests.
The ICIJ’s investigation serves as a stark reminder of the escalating threat posed by state-sponsored cyber activity and the urgent need for greater vigilance in safeguarding sensitive information. The world is witnessing a calculated effort to stifle free expression and suppress critical voices, and the consequences for democracy and human rights are profound.