Espionage in 2025 was not abstract. It was exploitation in motion. Clearance holders, defense insiders, and corporate innovators all found themselves in the crosshairs. The year’s cases split neatly into two categories: nation states exploiting insiders and corporate actors siphoning intellectual property. Together, they show how adversaries are evolving and what professionals must do to guard against them.
Nation State Espionage
Nation‑state espionage in 2025 was defined by insider betrayals and unconventional recruitment tactics. China remained the most aggressive, blending cyber campaigns with human targeting, from LinkedIn grooming of clearance holders to direct MSS approaches against U.S. Navy personnel. Russia continued to probe for military vulnerabilities, with a Fort Bliss soldier attempting to pass Abrams tank data. North Korea exploited remote work, infiltrating U.S. companies with disguised IT workers to generate revenue and access proprietary systems.
What stands out this year is the breadth of targeting: economic policy at the Federal Reserve, biotech research through pathogen smuggling, and diaspora repression through the closure of China’s clandestine NYC police station. The mechanics varied: cyber intrusions, illicit imports, social engineering, but the theme was consistent: adversaries are willing to exploit any vector that grants them access to U.S. knowledge, systems, or people.
China: LinkedIn recruitment of clearance holders
- Mechanics: PRC intelligence officers pose as recruiters and consultants on LinkedIn, targeting clearance holders with tailored roles and paid “briefs.”
- Impact: Grooming relationships under the cover of professional networking.
- Remedies: Treat unsolicited outreach as potential tasking; report suspicious contacts; tighten contact hygiene.
- Reference: “Clearance Holders Beware: You’re China’s Target and LinkedIn is the Weapon”
China: MSS plot targeting U.S. Navy personnel
- Mechanics: MSS sought to recruit sailors with access to sensitive operations.
- Impact: Direct risk to operational security and readiness.
- Remedies: Reinforce reporting obligations; monitor for unexplained income; command‑level CI briefings.
- Reference: “DOJ Charges Two in Chinese Espionage Plot Targeting U.S. Navy Personnel in MSS Recruitment Scheme”
China: Federal Reserve adviser indictment
- Mechanics: Adviser allegedly shared internal monetary strategy with PRC contacts.
- Impact: Economic intelligence extraction with global market consequences.
- Remedies: Extend insider risk programs to economic agencies; pre‑clear foreign exchanges.
- Reference: “China’s Inside Man: DOJ Arrests Ex-Fed Official for Leaking U.S. Economic Secrets”
Russia: Fort Bliss Abrams data attempt
- Mechanics: Soldier attempted to pass Abrams tank data to Russian contacts.
- Impact: Tactical consequences for battlefield countermeasures.
- Remedies: Tighten monitoring of weapons‑system repositories; peer reporting for stress markers.
- Reference: “Texas Soldier With Top Secret Clearance Charged in Attempt to Leak Abrams Tank Data to Russia”
North Korea: Remote IT worker infiltration
- Mechanics: DPRK operatives posed as remote IT workers at U.S. firms, using stolen identities.
- Impact: Blends sanctions evasion, regime financial support and corporate infiltration.
- Remedies: Strengthen identity proofing for remote hires; enforce geo‑location controls; audit staffing vendors.
- Reference: FBI Warning – North Korean IT Worker Threats to U.S. Businesses
Other Nation State Activity: WARP PANDA cyber espionage against U.S. legal/manufacturing; pathogen smuggling conviction; quantum computing theft in academia; NYC police station case closure.
Corporate / Industrial Espionage
Corporate espionage in 2025 shifted decisively toward strategic industries: AI and biotech. Artificial intelligence was the most contested domain, with Google’s insider theft of 1,000+ confidential files, Musk’s xAI suing OpenAI over alleged code exfiltration, and DOJ’s Operation Gatekeeper seizing $50 million in smuggled Nvidia GPUs. These cases show how both insiders and criminal networks are leveraged to accelerate foreign AI development.
Biotech emerged as the second front. A Chinese national smuggled a pathogen into the U.S. to exploit American labs’ proprietary methods. This case serves to highlight how intellectual property in life sciences have national security implications.
Other incidents: Tesla battery chemistry leaks, semiconductor design theft, aerospace composites compromises, reinforced the message: corporate espionage is no longer confined to defense contractors. It now spans every sector where U.S. innovation defines global competitiveness.
AI: xAI vs. OpenAI trade secret suit
- Mechanics: Former engineerfrom xAI allegedly exfiltrated proprietary code and joined OpenAI. xAI accuses OpenAI of using the allegedly purloined source code that powers Grok, while OpenAI claims the individual acted on their own, without benefit to OpenAI.
- Impact: Corporate‑on‑corporate espionage in the AI arms race.
- Remedies: Monitor code exfiltration; mandatory departure audits; cooling‑off policies.
- Reference: Court documents – CV-08133 and response from OpenAI.
AI: Google AI theft – Leon Ding indictment
- Mechanics: Insider removed 1,000+ confidential AI files.
- Impact: Direct erosion of U.S. AI leadership.
- Remedies: Segregate model artifacts; watermark datasets; behavioral analytics for anomalous downloads.
- Reference: DOJ indictment of Leon Ding
AI: Operation Gatekeeper – Nvidia GPUs
- Mechanics: Restricted GPUs smuggled to China despite export controls.
- Impact: Hardware advantage fuels adversary AI scale.
- Remedies: End‑use verification; red‑flag heuristics; voluntary disclosure pipelines.
- Reference: DOJ briefing on “Operation Gatekeeper”
Biotech: Pathogen smuggling to harvest U.S. proprietary methods
- Mechanics: Chinese national smuggled pathogen into U.S. labs to exploit proprietary assays and workflows. What makes this case of extreme interest it was the smuggling into the United States of a Chinese pathogen with the intent of reverse engineering the methodologies of U.S. laboratories.
- Impact: Transfers U.S. biotech know how without direct theft; accelerates adversary R&D.
- Remedies: Chain‑of‑custody rigor; compartmentalize proprietary methods; CI reviews in biosafety approvals.
- Reference: DOJ charge two Chinese nationals – DOJ announcement.
Other Corporate Cases: Tesla battery chemistry leak; missile detection IP theft; semiconductor design theft; aerospace composites compromise; cloud security startup litigation.
Espionage in 2025
Espionage in 2025 wasn’t a list of headlines. It was exploitation, pure and simple. China’s continued weaponization of LinkedIn to turn professional identity into a recruitment vector, and its MSS plot against Navy personnel showed how adversaries still go straight at the human core of military readiness. Russia’s reach into Abrams data proved battlefield advantage can hinge on a single insider. North Korea’s disguised IT workers reminded us that even remote hires can be infiltration points.
On the corporate side, the fight was over crown jewels. Google’s insider theft and Musk’s xAI lawsuit signaled that AI IP now carries the weight of classified material. Operation Gatekeeper exposed how hardware smuggling feeds adversary model training. The biotech case shows us how labs are espionage targets every bit as much as defense contractors.
Adversaries exploit people, processes, and platforms wherever they find weakness. The remedy is vigilance, Vigilance in your inbox, your lab, your code repository, and your hiring pipeline. Espionage in 2025 was practice, not theory. Defenses in 2026 must be just as real.
