Taiwanese authorities have charged two local company executives they say supplied LINE messaging accounts to Chinese government-linked hackers, giving the operators a Taiwanese-looking front for approaching politicians, academics, journalists and civil society figures.
Taiwan’s Ministry of Justice Investigation Bureau said Tuesday the two suspects ran a company that gathered LINE accounts registered with Taiwanese mobile numbers and leased them to Xiamen Empress Information Technology. The bureau alleges that the Chinese company is connected to the Chinese Communist Party’s cyber forces.
According to the bureau, the company’s director rented the accounts for about 1,100 yuan, or $162, each. That detail is the grubby little mechanism in the case: a legitimate-looking local phone number can make a hostile approach look less suspicious inside a messaging app people already use.
Investigators said Chinese operators then used the accounts to pose as international journalists, including reporters affiliated with the International Consortium of Investigative Journalists. The bureau said the impersonators contacted Taiwanese political figures, academics and other prominent people with interview requests or invitations to write articles.
The alleged endgame was malware. Taiwan’s investigators said the operators pushed targets toward software dressed up as encrypted communications tools. The pitch leaned on a real habit among journalists: using secure messaging systems to protect confidential sources. In this case, according to investigators, the download was meant to compromise a victim’s computer.
Searches and charges
Prosecutors carried out searches at the company’s offices and other locations during two investigative operations this year, the bureau said. Authorities issued deferred prosecution orders this week against the two executives and charged them with violations of Taiwan’s Personal Data Protection Act and other offenses.
The case gives official Taiwanese backing to earlier findings from the ICIJ and The Citizen Lab, which reported on a Beijing-linked phishing campaign aimed at journalists, democracy activists and members of Uyghur, Tibetan, Hong Kong and Taiwanese communities outside China.
The Citizen Lab said that campaign used more than 100 malicious internet domains over nine months. Researchers assessed that the operation was built to steal credentials and support additional espionage. They also said errors in some phishing messages suggested the operators may have used artificial intelligence to help generate messages and choose targets.
Taiwan’s allegation against Xiamen Empress Information Technology puts a commercial account-rental pipeline inside that broader operation. The bureau’s claim is not that LINE itself was compromised. It is that accounts on the service, registered with Taiwanese numbers, were collected and hired out to people running the espionage approaches.
China has repeatedly denied carrying out cyber-espionage against foreign governments and civil society organizations.
This story draws on original reporting from The Record.
