i³ Threat Advisory: Disrupting Foreign Interference

Executive summary (TL;DR)

• This advisory examines a foreign interference insider threat involving suspected IP theft and data exfiltration.
• This matters now because trade secret theft and blended attacks are rising.
• Risk is highest for technology, engineering, critical infrastructure, and crown-jewel data teams.
• In this investigation, 3.9GB and 600+ files left via personal OneDrive.
• Primary risks include IP loss, forensic evasion, legal exposure, and competitive harm.
• Organizations should prioritize high-risk user monitoring, crown-jewel labeling, offboarding visibility, and behavioral analytics.

Threat overview

Foreign interference is increasingly surfacing as an insider threat problem. In these cases, the risk is not limited to external compromise. It can involve trusted users with legitimate access who are influenced, recruited, or otherwise motivated to move sensitive information outside the organization.

This advisory examines a real-world DTEX i³ investigation involving suspected data exfiltration in a large technology company. The customer had a mature cybersecurity program and an established response process for security incidents. Even in that environment, the activity required careful correlation across user behavior, browser activity, cloud access, file movement, and forensic evidence.

The advisory is especially relevant for organizations concerned about foreign interference, IP theft, trade secret exposure, and blended attacks. These incidents can be difficult to detect because the activity may appear authorized in isolation. The user may access files they are permitted to access, use approved applications, and operate during normal business activity. The risk becomes clearer when those actions are correlated against intent, timing, destination, concealment, and access to sensitive data.

A foreign interference insider threat may involve:

• Unusual interest in crown-jewel data or commercially sensitive projects
• Data aggregation before departure or role change
• Use of personal email, personal cloud storage, or non-corporate accounts
• Deletion of staged files or other forensic countermeasures
• Job-search or flight-risk behavior aligned to the type of data accessed
• Sensitive file movement through browser-based upload paths

This advisory provides behavioral indicators and mitigations security teams can use to detect, deter, and disrupt insider threat activity before it becomes broader organizational exposure.

DTEX investigation and indicators

A DTEX customer requested an i³ investigation into a user suspected of possible data exfiltration. The company’s legal department initiated a full review of the user’s behavior to determine whether data had been exfiltrated or whether attempted exfiltration had occurred. The review also sought evidence of travel plans to China.

Initial analysis suggested the user may have been involved in potential data exfiltration through the browser. The user had interacted with personal email and deleted files. Each behavior, viewed alone, could appear low risk. When evaluated together in the context of the Insider Threat Kill Chain, the activity indicated a higher level of concern.

The DTEX i³ investigator identified data aggregation before exfiltration. The user copied 3.9GB of sensitive data into a folder on their desktop and then uploaded it to a personal OneDrive account through Google Chrome.

DTEX telemetry also captured the user’s interaction with Chrome, including connection activity to OneDrive. The customer later reviewed OneDrive logs and confirmed the user had logged into a non-corporate account before the exfiltration events. This was further validated through disk image collection.

The investigation identified several important foreign interference insider threat indicators:

The exfiltrated files were primarily related to suppliers, shortage reports, and backlog reports. These documents aligned with the types of jobs the user was researching. Additional investigation confirmed the documents were confidential in nature and directly related to the positions being explored.

Once the analysis was complete, the company’s insider risk team handed the investigation to the legal department. Evidence included the DTEX Platform audit trail, digital forensic evidence from the disk image, and cloud-based logs.

Insider threat profile

This case reflects a high-risk insider threat profile associated with suspected foreign interference and IP theft. The user had legitimate access to sensitive information and used routine enterprise tools in a way that created risk. The activity became significant because of the pattern: data aggregation, personal cloud upload, role-aligned job searching, and deletion of staged files.

Security teams should pay particular attention to users who combine access to sensitive data with behavioral changes or risky file movement. Flight-risk behavior can be a useful early indicator when it appears alongside unusual data access, file staging, or use of personal accounts.

This type of insider threat is difficult to detect through access reviews alone. The user may be authorized to access the data. The stronger signal comes from behavior around the access: what was collected, where it moved, how it was staged, whether personal services were used, and whether the user attempted to remove evidence.

Insider threat persona

The persona in this investigation is best understood as a high-risk insider with access to sensitive business data and possible external motivation. The advisory does not establish intent beyond the investigated behavior, but the pattern was consistent with malicious insider activity associated with IP theft and foreign interference risk.

The important takeaway for security teams is that foreign interference insider threat indicators often appear as combinations of ordinary behaviors. A file copy, a browser upload, a job search, or a deleted folder may not trigger a major response on its own. Together, and in proximity to crown-jewel data, they can indicate a serious threat.

Mitigations: what organizations should do now

Strengthen offboarding visibility

Build rapport with the teams involved in employee offboarding, including HR, IT, legal, privacy, and insider risk teams. Formalize processes so insider risk teams receive timely notice of employee departures, sudden role changes, and other exit-related risk signals.

Where offboarding is unexpected, immediate communication across departments is critical. Security teams should quickly determine whether sensitive data was accessed, aggregated, copied, uploaded, or deleted before the user’s departure.

Identify high-risk user groups

Organizations should identify user groups with elevated access to sensitive data. This may include engineers, executives, employees with access to patents, users working with supplier or shortage data, and employees with access to crown-jewel information.

Prioritizing high-risk users helps focus detection and response resources. This is especially important in large environments where security teams cannot apply the same investigative depth to every user and every alert.

Reduce use of personal accounts

Preventing use of personal accounts on approved enterprise applications can reduce the risk of insider threat data exfiltration. Personal email, personal OneDrive, and other non-corporate cloud accounts can create visibility gaps and complicate investigation.

Security teams should monitor for browser-based uploads to personal cloud services, especially when paired with sensitive file access, file staging, or deletion activity.

Identify and label crown jewels

Organizations should identify their crown jewels, including critical data, sensitive intellectual property, regulated information, commercially sensitive reports, and data tied to strategic advantage.

Sensitivity labeling and data classification allow security teams to monitor activity involving high-value information. Where an organization does not yet have a formal crown-jewel inventory, behavioral sensitivity models can help identify documents that may require additional protection.

Educate employees on the insider risk program

Employees should understand the purpose of the insider risk management program, how it protects the business and workforce, and how suspicious activity can be reported.

Transparency can help deter malicious activity and reduce confusion for employees who may otherwise see monitoring as punitive. A formal reporting mechanism, including an anonymous tip line where appropriate, can support earlier reporting of suspicious behavior.

Use behavioral analytics and proportional controls

Behavioral analytics can help security teams detect activity that traditional controls may miss. In foreign interference insider threat cases, the signal often comes from the correlation of multiple behaviors rather than one obvious violation.

Organizations should use mitigation controls that match the level of user risk. Non-malicious behavior may warrant a teachable moment. High-risk or malicious behavior may require focused observation, legal review, and preservation of audit trails.

Security teams should monitor for:

• Data aggregation before exfiltration
• Access to sensitive or crown-jewel files outside normal patterns
• Uploads to personal cloud accounts
• Use of personal email alongside sensitive file activity
• Deletion of staged files
• Flight-risk behavior near sensitive data movement
• Use of browser-based upload paths to cloud storage
• Activity involving sanctioned or unsanctioned applications

Preserve audit trails for legal and investigative review

Detailed audit trails are critical when an insider threat investigation moves to legal, HR, or law enforcement review. In this case, the organization relied on DTEX audit trails, disk image evidence, and cloud logs.

Security teams should ensure their monitoring strategy supports investigation continuity. That includes preserving file names, timestamps, destinations, process context, browser activity, user actions, and evidence of deletion or concealment.

Investigation support

This advisory includes limited-distribution reporting available only to approved insider risk practitioners. To request access to the redacted material, log in to the customer portal or contact DTEX i³. For organizations assessing suspected related activity, DTEX i³ can provide additional intelligence, indicator support, and investigative guidance. Behavioral detections should be tested and tuned prior to enterprise-wide deployment, particularly in large environments where scale can affect signal quality and operational effectiveness.

Sources

• Chinese National Residing in California Arrested for Theft of Artificial Intelligence-Related Trade Secrets From Google
• MITRE Insider Threat Research & Solutions: Employee reporting

Additional resources

• Foreign Interference – DTEX
• How Behavioral Intelligence Can Counter Foreign Interference
• The Rise and Stealth of the Socially Engineered Insider
• The Rise of AI and Blended Attacks: Key Takeaways from RSAC 2024
• DTEX Insider Threat Kill Chain
• The Value of HR in Your Insider Risk Program
• Detecting Use of Multiple Identities