Facebook pages posing as Western military consultancy firms but may be linked to China, appear to be targeting Filipino defense industry researchers and analysts, a study by Newsbytes.PH showed.
The impostor consultancy firms recently posted job openings for researchers, particularly from the government and military sector, asking for curriculum vitae of the applicants.
The applicants are then asked to submit research work as part of the application process, for which they are paid a few thousand pesos.
The curriculum vitae are used to create digital personas of the applicants, which are then used to recruit more applicants and to lend credibility to the impostor firms.
The research work, on the other hand, is at first easy but increasingly asks for more confidential information that only defense industry insiders would have access to.
Janes Information Services
In early 2023, recruitment posts seemingly from Janes Information Services, a 120-year old global open-source intelligence company specializing in military, national security, aerospace, and transport topics, started appearing on military-related Facebook groups, targeting Filipinos in the defense industry for part-time work.
An individual going by the name “Stephanie Emma” whose Facebook account appeared to be inauthentic and connected to Chinese language groups made multiple posts targeting Filipinos (evidenced by usage +63 contact numbers for WhatsApp and Viber) with impostor Janes Information Services part time & work from home recruitment posts.
These posts were published from around April to May of 2023 with pay ranging from $1,000 to $4,000, making it attractive for Filipinos in government and military looking to augment their income.
While the postings used the URL of the real Janes website, the contact e-mail addresses utilized in the postings, hrteam@janesgroup.work and hrteamrobin@janesgroup.work, used an inauthentic domain name that was registered in China via Alibaba Cloud Computing Ltd. d/b/a HiChina.
According to Internet WHOIS records, the domain name used in the e-mail address was less than two months old at the time of the recruitment ad postings.
A source who declined to be named revealed how they were targeted at work in their branch of the Armed Forces of the Philippines roughly June 2023 with phone calls from the same group offering part-time work. The recruiter asked for them by name and mentioned the names of their colleagues to gain their trust.
Unsuspecting personnel also explored the consultancy offers with what they thought was a prestigious and established international company and engaged the recruiter. During the screening process, applicants were made to submit sample reports as part of the tests.
One applicant recounted how the “Janes” recruiter actually paid for a test report during the process. However, when the recruiter asked for a report containing sensitive information, the applicant aborted the application process.
Military Express
Another member applied to the same group on the online job board onlinejobs.ph, as well as to a similar group named “Military Express” on the same site.
Military Express got back to them months later in October 2023, with a similar screening process as the inauthentic “Janes” consultancy. The member aborted the application process after they were asked to provide confidential information.
In January 2024, Military Express maliciously posed as the applicant, using their name as the contact person in more recruitment posts on a freshly created Facebook page (December 2023). These posts garnered many comments from inquiring applicants, some of whom appeared to have Philippine military, reserve, police, and government backgrounds.
Awkward English, bad grammar, and misspellings in the recruitment posts raise red flags about Military Express, indicating non-native English speakers.
Internet searches suggest that Military Express may be the same as or related to the Chinese outfit 军事快播 (Google translate: military quick broadcast), and is mentioned on two English language articles:
- China’s Navy Begins Fielding Newly Manufactured J-15 Carrier-Capable Fighters
- Ukraine war lessons spur China military shipbuilding surge: experts
Military Media
According to its website, Military Media Inc. was the first military advertising agency in the US and has been in business since 1974. Much like the previous examples, the Facebook page (created December 20, 2023) is an impostor page targeting Filipino military and government personnel looking for part-time work to create reports.
The contact e-mail addresses emilyverahrteam@militarymedia.group and globalmilitary@militarymedia.group utliized in the postings use an inauthentic domain name. The discrepancy between the e-mail domain names and the official website URL domain name is noteworthy.
Militarymedia.group was registered in China via Alibaba Cloud Computing Ltd. d/b/a HiChina, according to Internet WHOIS records. It was created only on November 29, 2023.
There are additional Facebook pages posting similar messaging, and some of these run Facebook ads targeting Filipino audiences.
Yeo Jun Wei Dickson
The modus operandi of the actors engaging in these operations is highly reminiscent of Singaporean national Yeo Jun Wei Dickson who was convicted in 2020 on charges of espionage on behalf of the People’s Republic of China.
Yeo operated from 2015 to 2019. In 2018, he had set up a fake consultancy company that used the same name as a prominent US consulting firm and through social media sites such as LinkedIn, sought out and solicited American military and government employees and paid them to write non-public information reports on sensitive US topics without informing them that their reports were being received by the Chinese government.
Yeo leveraged vulnerabilities on his targets such as dissatisfaction with work or financial difficulties. He received more than 400 resumes with 90% of them coming from US military and government personnel with security clearances through his social engineering.
More in-depth information about Yeo and his activities can be read here.
Based on the comments on the different Facebook pages run by these groups, a good number of former or currently enlisted uniformed personnel and government workers are falling prey to these impostor pages.
The operators behind a number of these Facebook pages are still active as of March 2024. Authorities have been notified of these activities.
The public, especially people who are and were in government and the military need to be extra vigilant, according to experts. They need to avoid engaging with these kinds of job openings and groups, no matter how tempting, as they may unwittingly aid in potential foreign espionage operations, the experts added.
