At least 75 times between 2019 and 2026, University of Texas researchers observed 10-second bursts of high-powered radio signals at 1558.5 MHz: the frequency used by GPS and European navigation satellites to transmit signals to Earth. The bursts disrupted GPS antennas from Romania to Greenland, the researchers write in a paper published this month in the journal Navigation.

The origin of the pulses was a mystery. The vast size of the affected area ruled out ground- and even aircraft-based jammers, so the interference was coming from space. 

Solar flares can disrupt satellite-location services, but unevenly. The disruptions were far more uniform. 

“Clearly, the effects of solar radio bursts manifest differently in the IGS data compared to the transient phenomenon studied here,” they write.

The researchers created a mathematical formula for pinpointing the origin based on how intensely the radio signals hit different antennas across the affected area. The equation pointed to just one likely source: Russia’s Cosmos 2546 satellite. It was launched in May 2020, months after the first disruptions were detected, but it is part of the Edinaya Kosmicheskaya Sistema, a constellation of early missile warning satellites. They fly in the Molniya orbit, whose highly elliptical path keeps them over the high north for most of the time.

The researchers conclude that the radio bursts appear to be intentional, but too short to have any real effect. They offer no specific theory about Russia’s intentions.

But officials have become increasingly concerned about Russian space activity, including the possible orbiting of a nuclear weapon that could break GPS.

“It is unclear exactly what is happening, but it does appear to be a space-based jammer,” said Victoria Samson, the chief director of space security and stability at the Secure World Foundation. “I would guess that the reason why Russia is using its early-warning constellation for this is that it is at the right position and altitude to cover the area that Russia would want to interfere with GPS. It is possible that Russia was willing to risk using its early-warning constellation for this because it was fairly confident that the interference would not be detected; as it was, this has been going on since 2019 and was only discovered in the past several years."

In a press release, the DOJ said the domains were designed to look like legitimate consulting firms and were used to advertise vague, well-paid consulting roles aimed at security clearance holders. The campaign, which allegedly began in November 2023, sought to entice Americans into producing research reports or sharing insider information on topics of interest to the Chinese government, according to court documents.

The seized domains included sites associated with firm names like Centrik Global Consulting, Rightinfo Consulting, Finnacle-Vesper Consulting, CYDF Consulting, Pulse Wave Global, Catalyst Global Solutions, Horizzen, GeoIndopacific, SafeSec Group and others.

The campaign relied on familiar job-market platforms and freelance sites to advertise positions such as “Senior Analyst” and “International Affairs Consultant.”

The Justice Department said the operators used aliases, fake personas, stolen identities and artificial intelligence-generated photographs to make the companies appear credible. The alleged scheme also involved encrypted messaging apps, including Telegram, overseas payments, cryptocurrency and online payment accounts registered under false names, according to an affidavit filed in support of the seizure warrants.

The takedowns mark the latest U.S. government effort to disrupt foreign intelligence schemes that blend online recruiting and financial incentives to reach Americans with access to sensitive national security information. 

Waves of federal layoffs over the past year have pushed thousands of government employees and contractors into an uncertain job market. That disruption has created renewed collection opportunities for foreign intelligence services.

Nextgov/FCW reported in January that a suspected Chinese intelligence outfit contacted a former senior State Department official late last year and offered payment for an assessment of U.S. policy priorities in Venezuela. The person who contacted the former official claimed to be affiliated with a sham consulting firm that had previously surfaced in research first reported by Nextgov/FCW last September, that assessed the firm was part of a broader network of fake companies tied to China.

The U.S. has sought to further publicize targeting efforts. In a rare public disclosure, Army Deputy Chief of Staff for Intelligence Lt. Gen. Anthony R. Hale issued a memo in November warning that foreign adversaries are targeting soldiers, civilians and their families through fake companies and phony recruiters. The advisory was sent to more than a million personnel across the Army, and later to members of the media, marking an unusually direct acknowledgment of the threat.