Cyber security company Proofpoint announced that China-linked hackers impersonated a former government official in order to obtain the e-mails of artificial intelligence experts working at think tanks, universities and institutions in the USA.
According to the Reuters agency, Proofpoint stated in its report that it has been regularly monitoring the attempts of the hacker group it named "TA419" to obtain the passwords of personnel working in US and Japan-based think tanks, defense industry contractors, universities and law firms since 2025.
The company noted that the actions belonged to the China-based group, since the types of malware used in the attacks, internet infrastructure and the selected targets coincide with the priorities of Chinese intelligence.
According to the report, hackers sent emails impersonating the identities of artificial intelligence and diplomacy experts, including Lynne Parker, the former first deputy director of the White House Office of Science and Technology Policy.
It was stated that in the fake messages, artificial intelligence-focused collaborations or joint projects were suggested to the recipients, and then the targets were directed to websites prepared for password stealing.
While Proofpoint did not share the names of the targeted people, it explained that these experts worked in the fields of "artificial intelligence regulations, export controls and national artificial intelligence strategy".
It was learned that one of these targets was former White House official and Director of the Penn Center for Media, Technology and Democracy, Alex Engler.
Speaking to Reuters, Engler said he received a suspicious email sent on behalf of Parker inviting him to participate in a new artificial intelligence policy project.
Engler stated that after noticing the strangeness in the message, he contacted other experts in the field and realized that the other person was a fraud.
While Engler declined to comment on the purpose of the attack, Proofpoint reported that this attempt, which involved fewer than 10 people from a small number of institutions, points to intelligence interest in US policy-making processes rather than direct technology theft.
Lynne Parker said that a fake message was sent to two people, including Engler, using her name in early July.
Stating that he found the assessment that China was involved in the incident reasonable, Parker said, "The USA and China are in competition in the field of artificial intelligence. Trying to learn the plans of people working on artificial intelligence policies is not surprising if this is the main goal."
On the other hand, the US Department of Justice and the Federal Bureau of Investigation (FBI) announced in August this year that they had seized the domain names used by the Chinese state-backed hacker group "QTFY" and the "QScan" and "QTRouter" platforms belonging to this group.
According to the AFP agency, officials announced that the American Aeronautics and Space Administration (NASA), the US Central Bank (Fed), the US Senate and the ministries of Energy, Justice, Health and Human Services were among the institutions that the QTFY group carried out a cyber attack.
Private sector targets included hospitals, universities, telecommunications companies, energy companies, financial institutions and defense industry contractors.
US Attorney General Todd Blanche stated that federal law enforcement forces neutralized malware belonging to the People's Republic of China and that the operation was the latest in a series of stopping indiscriminate attacks supported by Beijing.
FBI Director Kash Patel noted that the operation destroyed a global botnet network targeting the critical infrastructure of the United States.
According to court documents, QTFY offers hacking services to paying clients including China's Ministry of State Security and the People's Liberation Army.
