How a Chinese Engineer Tricked NASA Staff Into Handing Over Defense Software

For years, NASA employees and their research partners believed they were simply sharing software with trusted colleagues. In reality, they were emailing sensitive defense technology to a Chinese national who had been impersonating U.S. engineers, according to a new report from the agency’s Office of Inspector General.

The scheme, which ran from January 2017 through December 2021, targeted dozens of professors, researchers, and engineers at NASA, the Air Force, Navy, Army, Federal Aviation Administration, major universities, and private companies. The individual behind it, Song Wu, was charged by the U.S. Department of Justice in September 2024.

Song worked as an engineer at the Aviation Industry Corporation of China, a state-owned aerospace and defense conglomerate. He and his co-conspirators allegedly conducted detailed research on their targets, posing as friends and colleagues to gain access to proprietary modeling software used for aerospace design and weapons development. In several cases, the ruse worked: victims shared the software and source code without realizing they were violating U.S. export control laws.

Song now faces 14 counts of aggravated identity theft and multiple wire fraud charges, each carrying up to 20 years in prison. He remains at large and has been added to the FBI’s Most Wanted List.

The OIG noted that the scheme had telltale signs: Song repeatedly requested the same software without explaining why, suggested unusual payment methods, and used unconventional transfer methods to mask his identity. As phishing campaigns grow more sophisticated, these patterns remain red flags for organizations handling sensitive technology.

Source: The Hackers News