Counterintelligence & Tradecraft — 2026-04-29

NASA Employees Targeted in Chinese Phishing Scheme Against U.S. Defense Software

NASA's Office of Inspector General disclosed that Chinese national Song Wu, an engineer at state-owned Aviation Industry Corporation of China, conducted a years-long spear-phishing campaign impersonating U.S. researchers to obtain export-controlled aerospace and weapons-development software from NASA employees. The scheme targeted dozens of engineers and professors across NASA, the Air Force, the Navy, the Army, and the Federal Aviation Administration between 2017 and 2021. Song was indicted in September 2024 on 14 counts each of wire fraud and aggravated identity theft and remains at large on the FBI's Most Wanted list.

Analysis
The campaign's focus on source code and system documentation, rather than personnel records, signals technical collection consistent with PRC priorities in propulsion, hypersonics, and satellite systems, per NASA OIG and FBI records corroborated by The Hacker News. At least one additional U.S. agency or major defense contractor will likely publicly disclose being targeted within 90 days. Prior disclosure cascades, including SolarWinds, Volt Typhoon, and Salt Typhoon, show federal notification requirements surface additional victims faster than single-victim reports suggest. The PRC attribution rests on technical indicators sophisticated actors routinely spoof, leaving open the possibility a third party fabricated those signatures to redirect U.S. attention toward Beijing.

2 sources

NASA Employees Duped in Chinese Phishing Scheme Targeting U.S. Defense Software - The Hacker News
Chinese engineer stole US military and NASA software for years - Malwarebytes