Job adverts were posted on university websites for translators without further explanation of the nature of the work. Photo / 123RF
A Financial Times investigation reveals student translators were targeted by front company for Beijing-backed hacking group APT40.
Chinese university students have been lured to work at a secretive technology company that masked the true nature of their jobs: researching western targets for spying and translating hacked documents as part of Beijing's industrial-scale intelligence regime.
The Financial Times has identified and contacted 140 potential translators, mostly recent graduates who have studied English at public universities in Hainan, Sichuan and Xi'an. They had responded to job adverts at Hainan Xiandun, a company that was located in the tropical southern island of Hainan.
The application process included translation tests on sensitive documents obtained from US government agencies and instructions to research individuals at Johns Hopkins University, a key intelligence target.
Hainan Xiandun is alleged by a 2021 US federal indictment to have been a cover for the Chinese hacking group APT40. Western intelligence agencies have accused APT40 of infiltrating government agencies, companies and universities across the US, Canada, Europe and the Middle East, under the orders of China's Ministry of State Security.
The FBI sought to disrupt the activities of Hainan Xiandun last July by indicting three state security officials in Hainan province — Ding Xiaoyang, Cheng Qingmin and Zhu Yunmin — for their alleged role in establishing the company as a front for state-backed espionage. Another man mentioned in the indictment, Wu Shurong, is believed to be a hacker who helped supervise employees at Hainan Xiandun.
Western intelligence services also seek out prospective spies from universities, with applicants undergoing rigorous vetting and training before joining the likes of the CIA in the US or the UK's GCHQ signals intelligence agency.
But Chinese graduates targeted by Hainan Xiandun appear to have been unwittingly drawn into a life of espionage. Job adverts from the company were posted on university websites for translators without further explanation of the nature of the work.
This could have life-long consequences, as individuals identified as having co-operated with the MSS through their work for Hainan Xiandun are likely to face difficulty in living and working in western countries, a key motivation for many students who study foreign languages.
The FT contacted all 140 individuals on a leaked list of candidates compiled by security officials in the region to corroborate the authenticity of the applications. Several of those contacted initially confirmed their identities, but ended phone calls after being asked about their links to Hainan Xiandun. A few discussed their experience of the hiring process.
Their applications provide insight into the tactics of APT40, known for targeting biomedical, robotics and maritime research institutions as part of wider efforts to gain knowledge of western industrial strategy and steal sensitive data.
Hacking on that scale requires a huge workforce of English speakers who can help identify hacking targets, cyber technicians who can access adversaries' systems and intelligence officers to analyse the stolen material.
Zhang, an English language graduate who applied to Hainan Xiandun, told the FT that a recruiter had asked him to go beyond conventional translation duties by researching the Johns Hopkins Applied Physics Laboratory, with instructions to find out information on the institution, including the CVs of the directors on its board, the building's architecture and details of research contracts it had struck with clients.
The APL, a big recipient of US Department of Defense research funds, is likely to be of significant intelligence interest to Beijing and the individuals who work there prime hacking targets.
The instruction document asked the job candidates to download "software to get behind the Great Firewall". It warns that the research will involve consulting websites such as Facebook, which is banned in China and so requires a VPN, software that masks the location of the user in order to gain access.
"It was very clear that this was not a translation company," said Zhang, who decided against continuing with his application.
Dakota Cary, an expert in Chinese cyber espionage and former security analyst at Georgetown University, said the student translators were likely to be helping with researching organisations or individuals who might prove to be fruitful sources of sensitive information.
"The fact that you're going to have to use a VPN, that you will need to be doing your own research and you need good language skills, all says to me that these students will be identifying hacking targets," he said.
Cary, who testified earlier this year to the US-China economic and security review commission on Beijing's cyber capabilities, said the instruction to investigate Johns Hopkins was an indicator of the level of initiative and ability to acquire specialist knowledge that the translators were expected to demonstrate.
One security official in the region said the revelations were evidence that the MSS was using university students as a "recruitment pipeline" for its spying activities.
Antony Blinken, US secretary of state, has previously condemned the MSS for building an "ecosystem of criminal contract hackers" who engage in both state-sponsored activities and financially motivated cyber crime. Blinken added that these hackers cost governments and businesses "billions of dollars" in stolen intellectual property, ransom payments and cyber defences.
Hainan Xiandun asked the applicants to translate a document from the US Office of Infrastructure Research and Development containing technical explanations on preventing corrosion on transport networks and infrastructure. This appeared to test prospective employees' abilities to interpret complex scientific concepts and terminology.
"It was a very weird process," said Cindy, an English language student from a respected Chinese university. "I applied online and then the HR person sent me a highly technical test translation." She decided against continuing with the application.
Adam Kozy, a former FBI official who worked most recently at cyber security company CrowdStrike, said he had not heard of western intelligence enlisting university students without them being given security clearance to collect intelligence.
"The MSS do everything very informally and they like the grey areas," he said. "It's interesting to see that they're relying on a young student workforce to do a lot of the dirty work that may have those knock-on consequences later in life and most likely are not fully explaining those potential risks."
The MSS did not respond to requests for comment.
Hainan Xiandun solicited applications on university recruitment sites and appears to have a close relationship with Hainan University. The company was registered on the first floor of the university library, home to the student computer room.
One job advert posted on the university's foreign languages department website called for applications from English-speaking female students and Communist party members. The advert has been deleted since the FT's queries regarding this story.
Several student applicants to Hainan Xiandun had won school prizes for their language skills and others held the added distinction of holding party membership.
According to the FBI's indictment, MSS officers "co-ordinated with staff and professors at universities in Hainan and elsewhere in China" to further their intelligence goals.
Personnel at one Hainan-based university also helped support and manage Hainan Xiandun as a front company, "including through payroll, benefits and a mailing address", the indictment reads.
While the FBI accused the university of assisting the MSS in identifying and recruiting hackers and linguists to "penetrate and steal" from computer networks, it does not mention the university's role in commandeering students to help the cause.
In response to the FT's findings, Michael Misumi, chief information officer at Johns Hopkins APL, said that "like many technical organisations" the APL "must respond to many cyber threats and takes appropriate measures to continuously defend itself and its systems".
Hainan University did not respond to requests for comment.
Applicants' names have been changed to protect their identities
Written by: Eleanor Olcott and Helen Warrell
© Financial Times
Westpac's conduct affected a total of 24,621 customers.