China-aligned TA419 lured AI policy experts with fake advisory invitations in officials' names

On July 9, two people who had received email in Lynne Parker's name got in touch with her through separate channels to ask whether she had sent it ^[13]. She told them the messages were fraudulent and warned other colleagues ^[13]. The campaign under her name had started the day before, so the first alarm reached her within one day ^[18]. One of the two, according to Parker as reported by TNW, was Alex Engler, a former White House official who now runs the Penn Center on Media, Technology, and Democracy ^[15].

These recipients checked with Parker directly. In this campaign there was no link to inspect at first, because the attackers sent credential links only after a recipient had responded ^[2]. The attackers also borrowed the name of a former White House AI official. Parker's White House roles included assistant director for AI and founding director of the National AI Initiative Office ^[5].

The offer of a seat on a panel or a contribution to a Senate committee report was a lure for a sign-in on a fake OneDrive page, reached through follow-up correspondence once the target was talking ^[6]. Proofpoint's report says the group has long gone after defense and foreign policy targets tied to the US and Japan, and treats the AI policy work as more of the same: "The targeting of AI policy experts represents an extension of that remit rather than a departure from it" ^[12].

The two published accounts of Proofpoint's findings differ on details a defender needs. Nextgov reported that the report does not say how many people were targeted or whether any account was compromised ^[11]. TNW put the targets at fewer than ten individuals across several groups and said later messages carried malware-laced files as well as password lures ^{[19] [10]}. Nextgov describes only the Microsoft credential page ^[2].

By TNW's account the target list is short, and Proofpoint said that narrowness showed a concern with how the US develops policy ^[19]. "The challenge is that, without knowing who the bad actors are targeting, it's difficult to reach everyone who might be at risk," Parker said ^[14].

For a team whose people field outside advisory requests, I'd sort inbound mail on two axes. The first is whether the contact was solicited. The second is whether the next step asks for a sign-in or a file. Unsolicited mail that leads to a sign-in gets confirmed with the sender through a channel you already had, before anyone clicks, the way Parker's two contacts did it ^[13]. Unsolicited mail that asks only for a reply can get one, but in this campaign the reply is what brought the link ^[2], so the message after it is the one to distrust. Solicited contact that leads to a sign-in is ordinary work, and solicited contact with no sign-in is ordinary mail. The cost of the first cell is friction. Genuine invitations slow down, and the people whose names are worth borrowing end up fielding "did you send this?" messages, as Parker did ^[13].