NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software
The NASA Office of Inspector General revealed that Chinese national Song Wu posed as a U.S. researcher in a multi-year spear-phishing campaign targeting NASA, government entities, universities, and private companies. The campaign ran from January 2017 to December 2021, with victims including employees at NASA, the Air Force, the Navy, the Army, and the Federal Aviation Administration.
Song, an engineer at Chinese state-owned aerospace and defence conglomerate AVIC, and co-conspirators masqueraded as friends and colleagues to obtain proprietary modelling software used for aerospace design and weapons development. Victims shared sensitive information without realising they were violating U.S. export control laws. The scheme was successful in a handful of cases where victims shared sensitive defence technology with imposter accounts.
Song was indicted in September 2024 on wire fraud and 14 counts of aggravated identity theft, facing up to 20 years per wire fraud count plus a consecutive two-year sentence for identity theft. The 40-year-old remains at large and has been added to the FBI’s Most Wanted List. The specialised software could be used for industrial and military applications, including the development of advanced tactical missiles and aerodynamic design and assessment of weapons.
This case illustrates how sophisticated social engineering can bypass even organisations with robust technical controls. The campaign’s success over multiple years shows that human factors remain the weakest link in national security. It also highlights the ongoing threat posed by state-affiliated actors targeting defence technology through seemingly benign academic and professional collaboration.
Click here for the original article.