DOJ Seizes 13 Sham Consulting Domains Used by Chinese Intelligence to Target US Clearance Holders

Analysis
Criminal charges against a named individual by year-end 2026 are unlikely. The operators are assessed overseas and DOJ structured this action around domain seizure rather than indictment, a judgment held at moderate confidence given the affidavit's operational specificity against a complete absence of named defendants. The seized domains are specific nodes, not the TTP, and Chinese intelligence services will reconstitute on new platforms while the fake-consulting-firm approach to targeting clearance holders on freelance job boards persists. Mass federal layoffs have enlarged the security-cleared job-seeker pool, sustaining collection opportunity across whatever replacement infrastructure follows. The affidavit's own "wittingly or unwittingly" framing leaves open that portions of the network were independent commercial espionage actors rather than directed assets. Absent prosecution, sustained operator impunity should accelerate counterintelligence awareness campaigns ahead of the next network iteration.