Both China’s Ministry of Public Security and the Ministry of Foreign Affairs did not respond to faxes requesting comment. But Chinese officials have often boasted about their global efforts to hunt economic fugitives, and the state media has featured reports detailing the aims and successes of Operation Fox Hunt.  Many more details here.

Add in Canada

Chinese police run secret operations in B.C. to hunt allegedly corrupt officials and laundered money

Chinese police agents have been conducting secret operations in Canada — a top destination for allegedly corrupt officials — seeking to “repatriate” suspects and money laundered in real estate.

Vancouver city officials will not comment on co-operation with Chinese agents in “Operation Fox Hunt,” or on suspects pointed to by Chinese news services.

Xinhua news agency reported that while China does not have extradition treaties with Canada, the United States and Australia — the three top destinations for corruption suspects — in 2013 Canada and China signed an agreement to share assets connected to corruption.

Starting in 2014, Chinese agents came to Canada and other countries, Xinhua reported.

The Province found indications in various data sources of large wealth allegedly misappropriated in China and invested in condo and commercial developments and private residences in and around Vancouver.

Also, according to The Province’s review of data posted by the International Consortium of Investigative Journalists, there are a number of offshore shell companies linked to addresses in Vancouver, West Vancouver and Richmond, with connections to Mainland China.

City Manager Penny Ballem was asked if Vancouver officials are taking any actions against money laundering.

“In terms of corruption and money laundering, I can tell you in my conversations with (Vancouver Police Chief) Jim Chu, and the provincial solicitor general, these things are always a challenge for all levels of government,“ Ballem said. “If you want any hard information, you need to talk to Jim Chu.” Many more details of course are here.

France is helping as well?

France offers to help China catch fugitives in Operation Fox Hunt

Why could they also be hackers?

In part: Aliya Sternstein, writing in the August 13, 2015 edition of NextGov.com, notes that the “malicious code the Russians reportedly used to jimmy open a White House network, was also reportedly used by Chinese hackers to rupture Anthem’s network, — and, the malware was free.”  Ms. Sternstein adds that “the [malicious ] worms were delivered the same way, via phishing emails that looked legitimate; but, actually baited recipients into opening a malicious file.”

     “The hackers’ success in each case — underscores how conventional hacking techniques still work against skilled professionals at high-security organizations,” said Patrick Belcher, a Director at the cyber security firm, Invincea.  Mr. Belcher co-wrote a paper detailing the initial penetrations at the White House and Anthem,” Ms. Sternstein noted.  “These aren’t just any dumb users,” Belcher said.  “The top-notch security professionals failed in their jobs not to open suspicious email links.”

     “At Anthem, a bogus message in December 2014, tricked the recipient to install what appeared to be an authentic Citrix software update that was really an infected file,” according to past research, Ms. Sternstein wrote.  And, last fall, “at the White House, a video of a 2007 Super Bowl ad for CareerBuilder.com ad floated around that showed chimpanzees running a corporation and tormenting their human employee,” according to F-Secure.  A State Department email account reportedly was the source of the phishing email that landed at the White House,” NextGov.com noted.

Why could they be spies?

Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”

Emissary Panda group penetrated the networks of industrial espionage targets.

In part from Arstechnica LAS VEGAS—Today at the Black Hat information security conference, Dell SecureWorks researchers unveiled a report on a newly detected hacking group that has targeted companies around the world while stealing massive amounts of industrial data. The majority of the targets of the hacking group were in the automotive, electronic, aerospace, energy, and pharmaceutical industries. The group, believed to be based in China, has also targeted defense contractors, colleges and universities, law firms, and political organizations—including organizations related to Chinese minority ethnic groups.

Designated as Threat Group 3390 and nicknamed “Emissary Panda” by researchers, the hacking group has compromised victims’ networks largely through “watering hole” attacks launched from over 100 compromised legitimate websites, sites picked because they were known to be frequented by those targeted in the attack.

At least 50 organizations in those industries in the US and the United Kingdom had data stolen by members of Emissary Panda. Sites targeted included the website of the Embassy of the Russian Federation in the US (as well as those of other embassies and non-governmental organizations); government agency websites around the world; manufacturing companies, many of whom were suppliers to defense contractors; and the Spanish defense manufacturer Amper. A cultural site for the Chinese Uyghur ethnic group was also used, apparently to target members of the Muslim minority for surveillance.

No zero-day vulnerabilities were used to breach targeted networks, instead “the group relied on old vulnerabilities such as CVE-2011-3544“—a near-year-old Java security hole—”and CVE-2010-0738 to compromise their targets,” Dell SecureWorks’ researchers reported. The group used a number of tools common to other Chinese hacking groups, but they had a few unique tools of their own with interfaces developed for Standard (Simplified) Chinese. One of these is the PlugX remote access tool, “a notorious piece of malware linked to a number of attacks and to another Threat Group, which researchers believe is also likely based out of China,” according to Dell SecureWorks researchers. It also appears the group used China’s Baidu search engine to perform reconnaissance on targets.