LinkedIn continues to be the digital venue of choice for foreign powers such as China and Russia, who are using the platform to trick company employees into becoming corporate spies, a former CIA agent claims.
Peter Warmka, who served as a senior intelligence officer at the agency from 2004 to 2010 and now works as a cybersecurity consultant, provocatively chose the work-focused social media platform to air his concerns.
“During every one of my presentations, I bring up and explain how the LinkedIn platform is leveraged by criminals and intelligence services to target and manipulate people into committing espionage, facilitating data breaches within the organizations they work for,” he said in a recent post on the platform.
Such operations eventually wind up costing victims millions of dollars, he claimed, adding that unsuspecting employees can also be targeted over LinkedIn with romance and investment scams.
Having analyzed the social media platform, which boasts some 930 million accounts, Warmka estimates that approximately one in ten are fake. Moreover, he claims, it takes half an hour tops to set up a bogus LinkedIn profile.
“The profile can be built with certain commonalities of the target, such as the same alma mater, same profession, similar volunteer service, which will serve to create rapport,” he added. “Many times a fake profile will claim to have gone to prestigious universities or hold impressive titles in large US corporations. These are not validated by LinkedIn.”
The usual suspects
Warmka told Cybernews that he believes certain countries have been using the career-focused platform, which he described as a “treasure trove” for digital spies, to further their espionage campaigns.
Somewhat predictably, the countries he names are commonly regarded as rivals to or enemies of the US-led West.
“Over the past few years there have been several cases of Chinese, Russian, Iranian, and North Korean intelligence services using the LinkedIn platform for the targeting and potential recruitment of sources,” he said. “LinkedIn, as well as other social media platforms, provide a treasure trove of targeting data utilized for assessment purposes.”
This assertion echos previous comments given by Warmka to Cybernews, in which he implied that China in particular is playing the ‘long game’ when it comes to keeping tabs on the West in the digital sphere.
Citing high-profile cyberattacks on the platform in recent years, including the Russian-generated AI fake profile Katie Jones and the North Korea-backed Operation Sharpshooter, which targeted military installations, Warmka urged LinkedIn to be more proactive in weeding out potential spies and other threat actors.
“These cases of attempted espionage only came to our attention after an approach was reported or the target became compromised during the relationship,” he told Cybernews. “They were not discovered by the LinkedIn platform.”
He added: “As a result, intelligence experts believe that this is only the tip of the iceberg regarding the number of profiles created and utilized on the platform for espionage purposes.”
LinkedIn: we’ve got this
Cybernews reached out to LinkedIn for comment, but it merely reiterated a statement it released in August after a report by the Times in the UK suggested it was used in a Chinese espionage mission that allegedly targeted British government officials.
“Creating a fake account is a clear violation of our terms of service,” the statement previously shared with the Times said. “Our Threat Prevention & Defense team actively seeks out signs of state-sponsored activity and removes fake accounts using information we uncover and intelligence from a variety of sources.”
It would appear that Warmka, at least, is far from convinced, and he evidently considers LinkedIn users to be far too trusting of the platform: more than half receiving an invitation to connect from an unknown person will accept regardless.
“By accepting to connect with a fraudulent profile, you provide it with legitimacy and become an unwitting accomplice in their end game,” he said. “This is an ethical, not a legal, issue.”
Warmka urges LinkedIn users to never connect with someone who they do not know previously, or at the very least to research them on Google before accepting an invitation to do so.
