Taiwan charges two businessmen over alleged role in Chinese espionage campaign

Taiwanese authorities have charged two local businessmen with helping Chinese government-linked hackers carry out a sprawling espionage campaign targeting politicians, academics, journalists and civil society groups.

Taiwan's Ministry of Justice Investigation Bureau said Tuesday that the suspects ran a company that collected and leased accounts for the popular messaging app LINE to operators linked to China's cyber forces. Authorities allege the accounts were used to impersonate international journalists, including reporters affiliated with the International Consortium of Investigative Journalists (ICIJ). The goal was to build trust with targets and ultimately deploy malware designed to compromise their computers.

Prosecutors searched the company's offices and other locations during two investigative operations this year before issuing deferred prosecution orders this week against the two executives. They were charged with violations of Taiwan's Personal Data Protection Act and other offenses.

According to the bureau, the company's director collected LINE accounts registered with Taiwanese mobile numbers and rented them to Xiamen Empress Information Technology, a Chinese firm Taiwan alleges is linked to the Chinese Communist Party's cyber forces, for about 1,100 yuan ($162) per account.

Authorities said the accounts allowed Chinese operators to contact Taiwanese politicians, academics and other prominent figures while posing as reporters requesting interviews or inviting targets to contribute articles, 

The operation also relied on malware disguised as encrypted communications software. Investigators said the attackers noted that journalists routinely use secure messaging tools to protect confidential sources and encouraged victims to download the fake software.

The case provides new official backing for findings published earlier this year by the ICIJ and researchers at The Citizen Lab, which documented a broad Beijing-linked phishing campaign targeting journalists, democracy activists and members of Uyghur, Tibetan, Hong Kong and Taiwanese communities abroad.

The Citizen Lab said the campaign relied on more than 100 malicious internet domains over a nine-month period and appeared designed to steal credentials and facilitate further espionage operations. Researchers also said mistakes in some phishing emails suggested the attackers may have used artificial intelligence to help automate message generation and target selection.

China has repeatedly denied conducting cyber-espionage against foreign governments and civil society organizations.