DEEP DIVE — Federal prosecutors in Texas, in December, unsealed charges and related details exposing a sprawling scheme that quietly siphoned some of America’s most powerful artificial intelligence chips into China.

According to court filings, a Houston businessman and his company orchestrated a $160 million smuggling operation that moved thousands of NVIDIA’s top-tier processors overseas, evading U.S. export controls through falsified shipping records and shell transactions.

Hao Global and its founder, Alan Hao Hsu, pleaded guilty on October 10, 2025, to participating in smuggling and unlawful export activities, including knowingly exporting and attempting to export at least $160 million in Nvidia H100 and H200 GPUs between October 2024 and May 2025. Investigators say the operation was funded by more than $50 million in wire transfers originating from China, and the U.S. has seized over $50 million in Nvidia hardware and cash as part of the broader investigation, with the seizures tied to the overall network, not solely this defendant’s operation.

The operation reveals a broader strategy: if you can’t build it, take it. With a blend of state-run espionage and corporate infiltration, China has turned technology acquisition into an art form. Their ‘all-of-the-above’ approach has allowed their AI sector to grow even as export bans tighten. By sourcing the hardware from elsewhere, Beijing has made the lack of domestic chip manufacture moot.

The Corporate Insider Pipeline

The same month that prosecutors announced the NVIDIA chip smuggling charges, the Department of Justice filed a superseding indictment against Linwei Ding, a former Google software engineer accused of stealing over 1,000 confidential files containing trade secrets related to Google’s AI infrastructure. According to the indictment, Ding uploaded the files to his personal cloud account between May 2022 and May 2023 while secretly working for two China-based technology companies.

It is believed that the stolen materials included detailed specifications of Google’s Tensor Processing Unit chips and Graphics Processing Unit systems, as well as the software platform that orchestrates thousands of chips into supercomputers used to train cutting-edge AI models.

Ding allegedly circulated presentations to employees of his Chinese startup, citing national policies encouraging domestic AI development, and applied to a Shanghai-based talent program, stating that his company’s product “will help China to have computing power infrastructure capabilities that are on par with the international level.”

Within weeks of beginning the theft, Ding was offered a chief technology officer position at Beijing Rongshu Lianzhi Technology with a monthly salary of approximately $14,800 plus bonuses and stock. He traveled to China to raise capital and was publicly announced as CTO. A year later, he founded his own AI startup, Zhisuan, focused on training large AI models. Ding never disclosed either affiliation to Google.

After Google detected unauthorized uploads in December 2023, Ding vowed to save the files as evidence of his work. Nonetheless, he resigned a week later after booking a one-way ticket to Beijing. Security footage revealed that another employee had been scanning Ding’s access badge to give the appearance that he was working there during extended trips to China. Ding faces up to 175 years in prison on 14 counts: economic espionage and theft of trade secrets.

Ding has pleaded not guilty to the charges on multiple occasions. He entered a not guilty plea in March 2024 to the original four counts of trade secret theft, and again pleaded not guilty through his attorney, Grant Fondo, in September 2025 to the expanded superseding charges — including seven counts each of economic espionage and trade secret theft. Fondo has actively represented Ding in court proceedings, including a successful June 2025 motion to suppress certain post-arrest statements due to alleged Miranda violations, though no extensive public explanatory statements from the attorney or Ding appear beyond these court actions and pleas.

The federal trial in San Francisco began in early January 2026, with jury selection reported around January 8, and Ding remains presumed innocent until proven guilty.

Sign up for the Cyber Initiatives Group Sunday newsletter, delivering expert-level insights on the cyber and tech stories of the day – directly to your inbox. Sign up for the CIG newsletter today.

AI-Powered Cyber Espionage at Scale.

The threat escalated dramatically in September 2025 when Anthropic detected what it describes as the first fully automated cyberattack using artificial intelligence to breach corporate networks. Chinese state-sponsored hackers conducted the campaign, which Anthropic assessed with high confidence, targeted approximately 30 organizations, including technology firms, financial institutions, chemical manufacturers, and government agencies.

The attackers manipulated Anthropic’s Claude Code tool into executing 80 to 90 percent of the operation autonomously. Claude’s safety guardrails were bypassed by jailbreaking the system, disguising malicious tasks as routine cybersecurity tests, and breaking attacks into small, seemingly innocent steps that conceal their broader objectives. Once compromised, the AI system independently conducted reconnaissance, identified valuable databases, wrote custom exploit code, harvested credentials, created backdoors, and exfiltrated data with minimal human supervision.

“The AI made thousands of requests per second—an attack speed that would have been, for human hackers, simply impossible to match,” Anthropic stated in its analysis.

“This case is a huge concern for other companies that have almost fully adopted AI in their business operations,” JP Castellanos, Director of Threat Intelligence at Binary Defense, tells The Cipher Brief. “Instead of just using AI to draft phishing emails or assist human hackers, the perpetrators gave Claude direct instructions to carry out multi-stage operations on its own.”

The implications extend far beyond technical sophistication.

“An AI operator doesn’t have to sleep or take breaks moving at machine speed; the agent can do the work of dozens or more hackers, tirelessly and even without error, launching constant attacks that even human defenders would struggle to monitor, let alone counter,” Castellanos explained.

Chief Geopolitical Officer at Insight Forward, Treston Wheat, also noted the operational tempo represents a fundamental shift.

“AI-enabled operations can run reconnaissance, exploitation attempts, credential harvesting, lateral movement playbooks, and exfiltration workflows in parallel, iterating rapidly across targets,” he tells The Cipher Brief.

This shift not only changes how operations are conducted but also reveals the hidden supply chains that enable them.

DeepSeek’s Smuggled Silicon

In early 2025, it became impossible to ignore the connection between black-market chips and stolen IP. It was then that DeepSeek dropped the R1 model, claiming it could compete with OpenAI’s o1, but for significantly less. This, however, immediately set off alarm bells: How does a company hamstrung by U.S. sanctions move that fast without some serious ‘outside’ help?

Reports from The Information in December 2025 revealed that DeepSeek is training its next-generation model using thousands of NVIDIA’s advanced Blackwell chips — processors specifically banned from export to China. The smuggling operation reportedly involves purchasing servers for phantom data centers in Southeast Asia, where Blackwell sales remain legal. After inspection and certification, smugglers allegedly dismantle entire data centers rack by rack, shipping GPU servers in suitcases across borders into mainland China, where the chips are reassembled.

NVIDIA disputed the reports, stating it had seen “no substantiation or received tips of ‘phantom data centers’ constructed to deceive us and our OEM partners” while acknowledging the company pursues any tip it receives. The chipmaker is developing digital tracking features to verify chip locations, a tacit acknowledgement that there are enough smuggling concerns to warrant technological solutions.

Castellanos described China’s strategy as deliberately dual-track.

“China has been very open to being the lead in AI and semiconductors and the need for self-reliance in core technologies,” he said. “But also, externally, China relies on partnering with overseas institutions, building on top of Western open-source technologies, and acquiring advanced technologies through illegal means, such as through theft, smuggling, and forced transfers.”

Subscriber+Members get exclusive access to expert-driven briefings on the top national security issues we face today. Gain access to save your virtual seat now.

The FBI’s Losing Battle

Christopher Wray, the former FBI director, testified that the bureau oversees approximately 2,000 active investigations into Chinese espionage operations.

“Chinese hackers outnumber FBI cyber personnel by at least 50 to 1,” Wray testified before the House Appropriations Committee in 2023. “They’ve got a bigger hacking program than every other major nation combined and have stolen more of our personal and corporate data than all other nations—big or small—combined.”

That scale reflects a long-running strategy rather than a sudden surge.

“U.S. officials say China has long relied on a multi-pronged strategy to lie, to cheat and to steal their way to surpassing us as the global superpower in cyber,” he said. “It’s not just cyber intrusions, we are concerned about, but also human insiders stealing intellectual property. In the realm of AI, this can include insiders siphoning source code, research papers, or semiconductor designs for China.”

The Chinese approach exploits multiple vectors simultaneously, according to experts. The Ministry of State Security operates human intelligence networks. The People’s Liberation Army’s Strategic Support Force conducts offensive cyber operations.

The Thousand Talents Plan, for example, then offers Chinese researchers financial incentives to transfer proprietary information to American institutions. By investing in and partnering with ostensibly private companies, state-owned enterprises gain access to sensitive technologies.

Export Controls Lag Behind Reality

The export control regime designed to prevent China from accessing advanced chips has proven inadequate in the face of Beijing’s evasion tactics. The Commerce Department’s Bureau of Industry and Security has repeatedly updated restrictions, most recently imposing sweeping controls in October 2023 on AI chips and semiconductor manufacturing equipment.

The recent Texas case shed light on how these smugglers operate. There was more to it than simply shipping; they used crypto payments and paper-only shell companies to conceal the money trail. To pass customs, they even removed the Nvidia labels from the chips. By the time those processors reached China, they had been bounced through so many different countries that the original paper trail was basically gone.

“Export controls are not a complete solution to IP theft or technology diffusion. They are best understood as a time-buying and friction-imposing tool,” Wheat observed. “If the objective is to prevent all leakage, that is unrealistic; if the objective is to slow adversary capability development, shape supply chains, and increase acquisition cost and risk, they can be effective when paired with enforcement and complementary measures.”

The chip industry, analysts caution, is facing a structural nightmare. We’re restricting technology that’s already been stolen and studied. The $160 million operation out of Texas proved just how easy it is to game the system — they lied on customs forms hundreds of times over several months, and it still took nearly a year for authorities to notice anything was wrong.

Defending at Machine Speed

Security experts are calling this the most significant tech transfer in history, and it isn’t happening by accident. By stacking insider theft, cyberattacks, recruitment programs, and smuggling on top of each other, China has found a way to leapfrog ahead in AI. They don’t have the domestic factories to build high-end chips yet, so they’ve bypassed the need for ‘original’ innovation by taking what they need. It’s a massive operation that’s making traditional defense strategies look obsolete.

“The realistic U.S. approach is not to match China operator-for-operator. It is to win by asymmetry, such as scaling defense through automation, hardening the most valuable targets, and using public-private coordination to reduce attacker dwell time and increase attacker cost,” Wray said in his testimony.

Castellanos emphasized that defending against AI-enabled attacks requires matching the adversary’s capabilities.

“To have any hope to defend against this, we have to multiply effectiveness through automation and AI, so basically fight fire with fire,” he underscored. “Doing this requires significant investment, new skills, and perhaps most challenging, trust in autonomous defensive AI at a time when many organizations are still learning basic cyber hygiene.”

To prevent adversaries from acquiring sensitive technologies, the U.S. Government has, in recent years, implemented targeted responses, such as the Disruptive Technology Strike Force in 2023. Yet, even as FBI investigations increase and new indictments are filed, the fundamental challenge persists. Chinese intelligence services use unlimited resources, legal compulsion over Chinese nationals, and long-term strategic patience to operate in an open society with porous institutional boundaries.

“It’s a challenge for policy makers; a multi-layered response and defense in depth is needed to protect the US AI technology base better,” Castellanos added. “Harden insider threat programs, accelerate public and private intelligence sharing, modernize export controls and enforcement, increase the costs or impose costs for the offenders of these attacks and lastly innovate faster to ensure even if China steals today’s tech, the breakthrough is already in the pipeline for tomorrow.”

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business

Welcome back, aspiring DFIR investigators!

Linux machines are everywhere these days, running quietly in the background while powering the most important parts of modern companies. They host databases, file shares, internal tools, email services, and countless other systems that businesses depend on every single day. But the same flexibility that makes Linux so powerful also makes it attractive for attackers. A simple bash shell provides everything someone needs to move files around, connect to remote machines, or hide traces of activity. That is why learning how to investigate Linux systems is so important for any digital forensic analyst.

In an earlier article we walked through the basics of Linux forensics. Today, we will go a step further and look at a scenario, where a personal Linux machine was used to exfiltrate private company data. The employee worked for the organization that suffered the breach. Investigators first examined his company-issued Windows workstation and discovered several indicators tying him to the attack. However, the employee denied everything and insisted he was set up, claiming the workstation wasn’t actually used by him. To uncover the truth and remove any doubts, the investigation moved toward his personal machine, a Linux workstation suspected of being a key tool in the data theft.

Analysis

It is a simple investigation designed for those that are just getting started.

Evidence

Before looking at anything inside the disk, a proper forensic workflow always begins with hashing the evidence and documenting the chain of custody. After that, you create a hashed forensic copy to work on so the original evidence remains untouched. This is standard practice in digital forensics, and it protects the integrity of your findings.

Once we open the disk image, we can see the entire root directory. To keep the focus on the main points, we will skip the simple checks covered in Basic Linux Forensics (OS-release, groups, passwd, etc.) and move straight into the artifacts that matter most for a case involving exfiltration.

Last Login

The first thing we want to know is when the user last logged in. Normally you can run last with no arguments on a live system, but here we must point it to the wtmp file manually:

bash# > last -f /var/log/wtmp

This shows the latest login from the GNOME login screen, which occurred on February 28 at 15:59 (UTC).

To confirm the exact timestamp, we can check authentication events stored in auth.log, filtering only session openings from GNOME Display Manager:

bash# > cat /var/log/auth.log | grep -ai "session opened" | grep -ai gdm | grep -ai liam

From here we learn that the last GUI login occurred at 2025-02-28 10:59:07 (local time).

Timezone

Next, we check the timezone to ensure we interpret all logs correctly:

bash# > cat /etc/timezone

This helps ensure that timestamps across different logs line up properly.

USB

Data exfiltration often involves external USB drives. Some attackers simply delete their shell history, thinking that alone is enough to hide their actions. But they often forget that Linux logs almost everything, and those logs tell the truth even when the attacker tries to erase evidence.

To check for USB activity:

bash# > grep -i usb /var/log/*

Many entries appear, and buried inside them is a serial number from an external USB device.

Syslog also records the exact moment this device was connected. Using the timestamp (2025-02-28 at 10:59:25) we can filter the logs further and collect more detail about the device.

We also want to know when it was disconnected:

bash# > grep -i usb /var/log/* | grep -ai disconnect

The last disconnect occurred on 2025-02-28 at 11:44:00. This gives us a clear time window: the USB device was connected for about 45 minutes. Long enough to move large files.

Command History

Attackers use different tricks to hide their activity. Some delete .bash_history. Others only remove certain commands. Some forget to clear it entirely, especially when working quickly.

Here is the user’s history file:

bash# > cat /home/liam/.bash_history

Here we see several suspicious entries. One of them is transferfiles. This is not a real Linux command, which immediately suggests it might be an alias. We also see a curl -X POST command, which hints that data was uploaded to an HTTP server. That’s a classic exfiltration method. There is also a hidden directory and a mysterious mth file, which we will explore later.

Malicious Aliases

Hackers love aliases, because aliases allow them to hide malicious commands behind innocent-looking names. For example, instead of typing out a long scp or rsync command that would look suspicious in a history file, they can simply create an alias like backup, sync, or transferfiles. To anyone reviewing the history later, it looks harmless. Aliases also help them blend into the environment. A single custom alias is easy to overlook during a quick review, and some investigators forget to check dotfiles for custom shell behavior.

To see what transferfiles really does, we search for it:

bash# > grep "transferfiles" . -r

This reveals the real command: it copied the entire folder “Critical Data TECH*” from a USB device labeled 46E8E28DE8E27A97 into /home/liam/Documents/Data.

This aligns perfectly with our earlier USB evidence. Files such as Financial Data, Revenue History, Stakeholder Agreement, and Tax Records were all transferred. Network logs suggest more files were stolen, but these appear to be the ones the suspect personally inspected.

Hosts

The /etc/hosts file is normally used to map hostnames to IP addresses manually. Users sometimes add entries to simplify access to internal services or testing environments. However, attackers also use this file to redirect traffic or hide the true destination of a connection.

Let’s inspect it:

bash# > cat /etc/hosts

In this case, there is an entry pointing to a host involved in the exfiltration. This tells us the suspect had deliberately configured the system to reach a specific external machine.

Crontabs

Crontabs are used to automate tasks. Many attackers abuse cron to maintain persistence, collect information, or quietly run malicious scripts.

There are three main places cron jobs can exist:

1. /etc/crontab –  system-wide

2. /etc/cron.d/ – service-style cron jobs

3. /var/spool/cron/crontabs/ – user-specific entries

Let’s check the user’s crontab:

bash# > cat /var/spool/cron/crontabs/liam

We can see a long string set to run every 30 minutes. This cronjob secretly sends the last five commands typed in the terminal to an attacker-controlled machine. This includes passwords typed in plain text, sudo commands, sensitive paths, and anything else the user entered recently.

This was unexpected. It suggests the system was accessed by someone else, meaning the main suspect may have been working with a third party, or possibly being monitored and guided by them.

To confirm this possibility, let’s check for remote login activity:

bash# > cat /var/log/auth.log | grep -ai accepted

Here we find a successful SSH login from an external IP address. This could be that unidentified person entering the machine to retrieve the stolen data or to set up additional tools. At this stage it’s difficult to make a definitive claim, and we would need more information and further interrogation to connect all the pieces.

Commands and Logins in auth.log

The auth.log file stores not only authentication attempts but also certain command-related records. This is extremely useful when attackers use hidden directories or unusual locations to store files.

To list all logged commands:

bash# > cat /var/log/auth.log | grep -ai command

To search for one specific artifact:

bash# > cat /var/log/auth.log | grep -ai mth

This tells us that the file mth was created in /home/liam using nano by user liam. Although this file had nothing valuable, its creation shows the user was active and writing files manually, not through automated tools.

Timestomping

As a bonus step, we will introduce timestamps, which are essential in forensic work. They help investigators understand the sequence of events and uncover attempts at manipulation that might otherwise go unnoticed. Timestomping is the process of deliberately altering file timestamps to confuse investigators. Hackers use it to hide when a file was created or modified. However, Linux keeps several different timestamps for each file, and they don’t always match when something is tampered with.

The stat command helps reveal inconsistencies:

bash# > stat api

The output shows:

Birth: Feb 28 2025

Change: Nov 17 2025

Modify: Jan 16 2001

This does not make sense. A file cannot be created in 2025, modified in 2001, and changed again in 2025. That means the timestamps were manually altered. A normal file would have timestamps that follow a logical order, usually showing similar creation and modification dates. By comparing these values across many files, investigators can often uncover when an attacker attempted to clean up their traces or disguise their activity.

Timeline

The investigation still requires more evidence, deeper log correlation, and proper interrogation of everyone involved before a final conclusion can be made. However, based on the artifacts recovered from the Linux machine, we can outline a reasonable assumption of how the events might have taken place.

In the days before the breach, Liam was approached by a third-party group interested in acquiring his company’s confidential data. They gained remote access to his computer via SSH, possibly through a proxy, appearing to log in from a public IP address that does not belong to the company network. Once inside, they installed a cronjob designed to collect Liam’s recent commands that acted as a simple keylogger. This allowed them to gather passwords and other sensitive information that Liam typed in the terminal.

With Liam’s cooperation, or possibly after promising him payment, the attackers guided him through the steps needed to steal the corporate files. On February 28, Liam logged in, connected a USB drive, and executed the hidden alias transferfiles, which copied sensitive folders onto his machine. Moments later, he uploaded parts of the data using a curl POST request to a remote server. When the transfer was done, the accomplices disconnected from the machine, leaving Liam with remnants of stolen data still sitting inside his Documents directory.

The combination of the installed cronjob, the remote SSH connection, and the structured method of transferring company files strongly suggests an insider operation supported by outside actors. Liam was not acting alone, he was assisting a third party, either willingly or under pressure.

Summary

The hardest part of digital forensics is interpreting what the evidence actually means and understanding the story it tells. Individual logs rarely show the full picture by themselves. But when you combine login times, USB events, alias behavior, cronjobs, remote connections and other artifacts a clear narrative begins to form. In this case, the Linux machine revealed far more than the suspect intended to hide. It showed how the data was copied, when the USB device was attached, how remote actors accessed the system, and even how attempts were made to hide the tracks through timestomping and aliases. Each artifact strengthened the overall story and connected the actions together into one coherent timeline. This is the true power of digital forensics that turns fragments of technical evidence into a readable account of what really happened. And with every investigation, your ability to find and interpret these traces grows stronger.

If you want skills that actually matter when systems are burning and evidence is disappearing, this is your next step. Our training takes you into real investigations, real attacks, and real analyst workflows. Built for people who already know the basics and want to level up fast, it’s on-demand, deep, and constantly evolving with the threat landscape.

Learn more

The post Digital Forensics: Basic Linux Analysis After Data Exfiltration first appeared on Hackers Arise.

Can you trust your cybersecurity team? A recent federal case reveals how two US-based cybersecurity experts turned into affiliates for the BlackCat ransomware group, extorting over $1.2M in Bitcoin. Read the full story on their 2023 crime spree.

A new report from Check Point Research reveals a growing trend of cyber criminals recruiting employees at banks, telecoms, and tech giants. Learn how hackers use the darknet and Telegram to offer payouts up to $15,000 for internal access to companies like Apple, Coinbase, and the Federal Reserve.