Wei "William" Qiu and Karmøy Health Norway (2022 - 2026)
- Nick Eftimiades
- 2 days ago
- 9 min read
INTELLIGENCE DOSSIER: OPERATION KARMØY & THE ANDØY SPACEPORT INTERCEPT NET
The Andøy and Otta espionage case involving Wei "William" Qiu and Karmøy Health Norway AS utilized a highly sophisticated, multi-layered array of espionage tradecraft designed to target critical space and telecommunications infrastructure in Norway.
SECTION 1: THE TACTICAL PLOT & KEY LOCATIONS
A. Operational Objective: Strategic Signal Interception
In 2026, Wei "William" Qiu (43), a Singapore-registered Chinese national who has resided in Norway since 2022, attempted to establish a long-range satellite signals intelligence (SIGINT) intercept site near critical defense installations. The cornerstone of this operation was a massive, 22-ton mobile satellite receiver imported from China.
This over dimensioned, motor-driven receiver departed the port of Yangshan, China, on January 1, 2026, inside a container addressed directly to Karmøy Health Norway AS. The Norwegian Police Security Service intercepted and seized this receiver at Oslo Port in April 2026, successfully preventing the hardware from being deployed.
B. Deconstructed Property Profiles
1. The intended Intercept Site: Bjørnskinnveien 644, 8484 Risøyhamn (Andøy Municipality)
The Transaction: On March 17, 2026, the property (parcel Gnr 9, bnr 55) was deeded directly to Karmøy Health Norway AS for 1.66 million NOK.
The Tactical Setup: Located in a remote, water logged bog area of Bjørnskinn, neighbors immediately flagged the 1.66 million NOK purchase price as being "sky-high" and completely disconnected from the property's actual dilapidated condition.
NATO Proximity: This home sits exactly 13 kilometers in a straight line from Andøya Spaceport. The Spaceport is a highly sensitive civilian-military hybrid base heavily funded by the NATO Innovation Fund for launch operations of Isar Aerospace's Spectrum orbital rocket. The 22-ton receiver was scheduled to be permanently erected here, most likely to track and download data from polar-orbiting defense satellites.
2. The Administrative Safe House: Kleivrudvegen 25, 2670 Otta (Sel Municipality)
● While online sources identified this location as an "office building," official registries and real estate records confirm that Kleivrudvegen 25 is a residential detached single-family home purchased privately by Wei Qiu's firm in 2023. This residential property served as the primary registered post/mail address and sub-unit headquarters (Org nr: 929 293 525) for Karmøy Health Norway AS.
● Raids & Ownership Changes: In May 2025, the house was sold for 1.75 million NOK to Liang Qiu (Wei Qiu's cousin), but the front company maintained a heavy financial grip, keeping an outstanding claim of 1.1 million NOK on the sale price. Early in the morning on May 7, 2026, the Norwegian Police executed a counter-espionage raid on this house, finding it empty as Liang Qiu had fled to China under the cover of a vacation.
C. Suspect Profiling: Clarifying the Two Targets
A critical aspect of mapping this network is separating the two distinct Chinese women who held contrasting roles within the espionage cells:
1. Xiaoyin Pan (Otta Resident & Critical Subcontractor Inside Source)
● Xiaoyin Pan is in her 40s. She moved to Norway in 2009 to work as a telecommunications engineer for Huawei, Norge.
● Residence: Listed in public local directories as a private resident at the Kleivrudvegen 25 detached home in Otta.
● Corporate Access: In 2023, Pan transitioned to a role as a Key Account Manager at Frequentis AG. This multinational firm supplies critical, highly classified software and communications platforms across Norway's core infrastructure:
○ MarTRX Launch Suite: Frequentis’ proprietary command platform utilized directly by Isar Aerospace during rocket launches from the nearby Andøya Spaceport.
○ Norway's 5G Emergency Network: Command-and-control software for the nation's public safety systems.
○ Coastal Radio (Kystradioen): Connecting over 500 maritime transmitters spanning 150 stations along the Norwegian coastline.
○ Aviation Control: Managing air traffic suits across 14 major Norwegian airports (including Gardermoen) under a 200 million NOK Avinor contract.
○ Current Status: Pan remains free and actively employed at Frequentis, but her access and transition from Qiu's former shell firm Krefter AS (where she translated Norwegian infrastructure blueprints into Mandarin for Chinese investors) are under intense security scrutiny.[i]
2. The Arrested Andøy Tenant (The 29-Year-Old Suspect)
● Age and Background: A separate, younger Chinese woman who arrived in Norway in March 2026 (name unknown).
● Residence: She was the registered tenant renting the remote intercept bogland property at Bjørnskinnveien 644.
● Current Status: Apprehended by PST at 11:00 AM on May 7, 2026, during a raid on the Andøy house. She was formally charged with complicity in attempted aggravated intelligence activities. On June 5, 2026, the Oslo District Court extended her pre-trial detention (varetektsfengsling) for four additional weeks under strict communication and visitor restrictions.
SECTION 2: CORPORATE LAYERING — ENTERPRISE & KARMØY HEALTH
The direct link between Karmøy Health Norway AS and Endless Enterprise AS exposes a classic corporate-layering and signature-cloning tradecraft used by the MSS to mask logistical and procurement cells
● Shared Nexus via Ling Li: Both Karmøy Health Norway AS and Endless Enterprise AS are linked directly to the administrative footprint of Ling Li.
● Drengsrudhagen 6, Asker: Karmøy Health Norway AS falsely listed its primary metropolitan headquarters at Drengsrudhagen 6, 1385 Asker. This is the exact business and residential registry address of Ling Li, who is recorded in local address directories in Asker.
● The Strategic Purpose of Multi-Firm Layering: In espionage operations, establishing multiple parallel shell entities (such as a marine wholesaler and a general enterprise company) under the same signatory serves several key functions:
● Compartmentalization of Financial Flow: Handlers can distribute transactions across multiple corporate bank accounts, making the rapid movement of foreign cash (like the funds used to purchase the 1.66 million NOK Andøy bogland) look like routine commercial activity rather than a single massive, state-sponsored real estate acquisition.
● Redundant Facades: If one entity is flagged by regulators, the network can instantly shift its leases, contracts, or logistics to the sister shell. When the Norwegian Business Register (Foretaksregisteret) issued a warning to Karmøy Health on May 12, 2026, declaring its Asker address false and ordering corrections, the network's overlapping registrations with Endless Enterprise AS were unmasked.
SECTION 3: HOW LING LI'S DIGITAL FOOTPRINT UNMASKED THE PLOT
Ling Li acted as the logistical and administrative bridge between the front company's fake metropolitan office and its field operations. Her connection was mapped using two primary digital forensic methods:
● Digital Signature Mapping: In Norway, registering an Aksjeselskap (limited liability company), submitting annual financial accounts, or filing corporate amendments to the Brønnøysundregistrene requires verified digital signatures (e.g., BankID). Li's unique digital signature was used to register the articles of association for Karmøy Health on April 16, 2024, and the corporate name changes of the firm (from Krefter SPV 1 AS to Merlion Holding AS in 2023, and finally to Karmøy Health Norway AS in 2024).
● Residential Profiling: By cross-referencing public local registries, investigators mapped her digital footprint to both shell entities. Her profile linked her residence in Asker directly to the fake business office of Endless Enterprise AS and the Asker-based filings of Karmøy Health.
By analyzing these overlapping digital signatures, PST and corporate auditors verified that the seafood business was not a functioning commercial entity but a tightly held, digitally fabricated cover run by a local proxy network.
SECTION 4: THE OTTA SAFE HOUSE (KLEIVRUDVEGEN 25)
The Structure is a physical residential detached single-family home located at Kleivrudvegen 25 and purchased by Qiu's firm, Krefter SPV 1 AS, in early 2023. This property served as a clandestine Mail-Drop & Registry Cover: This residential property served as the registered postal/mailing address for Karmøy Health Norway AS's primary sub-entity (Org nr: 929 293 525). This allowed the shell company to satisfy business registration laws by maintaining a physical address in Norway, while completely avoiding the higher regulatory visibility, security cameras, and physical oversight of a commercial office park.
The property also served as a legitimate residential cover for operatives: Because it is a single family detached home allowing network members to reside there without drawing local suspicion. Xiaoyin Pan was registered as a private resident at this address. By living in a detached house in the small, remote municipality of Sel (Otta), she established a legitimate local profile, allowing her to easily secure high-level security clearances and employment inside Frequentis AG (the critical communications subcontractor for Norway's aviation, defense, and emergency networks) without triggering traditional red flags.
SECTION 5: THE SATELLITE RECEIVER
The 22-ton Chinese satellite receiver intercepted by the Norwegian Police Security Service possesses specialized capabilities designed for high-capacity signal collection and orbital tracking. Its primary documented technical features include the following:
● Polar Orbit Data Harvesting: The receiver is technically optimized to download data from satellites operating in polar orbits.
● Active Motorized Tracking: The system features a large, motorized receiver array. This motorized tracking capability is highly relevant for maintaining active communication links with moving satellites and capturing high-altitude telemetries.
● Over-dimensioned Physical Scale: The physical scale of the receiver is heavily oversized if its intended function were merely to tap telemetry data from rockets during launch sequences. This massive footprint points to a much broader capability for intercepting defense and satellite signals.
● Advanced Signal Processing Alignment: Just before the hardware was seized, operatives in the network were actively analyzing and sharing developments in AI-based sensor technology for tracking satellites in orbit, alongside AI-assisted signal processing. This indicates that the receiver's hardware was meant to operate in tandem with advanced signal-filtering and target-tracking software.
Status of Case: Alleged
Tradecraft: The specific tradecraft methods applied in this case include the following:
1. Front Companies and Commercial Cover
The Seafood Cover: Wei "William" Qiu established Karmøy Health Norway AS under the commercial guise of a marine-oil and supplement wholesaler focusing on fish and krill oil products. The company reported zero employees and had no commercial activities, indicating its sole purpose was to serve as an intelligence cover.
The Green Technology Cover: Qiu co-founded Krefter AS with a local Norwegian partner under the guise of developing "green, power-saving" data centers. This commercial cover allowed them to negotiate leases with local municipalities (such as Vågå) and obscure any Chinese state ties.
2. Fake Corporate Addresses and Mail-Drops
Fake Metropolitan Front: To project legitimacy, the network registered its primary corporate address at Drengsrudhagen 6, 1385, Asker. However, the Norwegian Business Register (Foretaksregisteret) flagged this address as false and ordered immediate corrections.
Low-Visibility Mail Drop: The actual administrative mail-drop and registry address was quietly routed to a private, detached residential home at Kleivrudvegen 25, 2670 Otta. This allowed the front company to satisfy legal business registration laws while avoiding the higher security profile, surveillance cameras, and public audits of standard commercial office parks.
3. Corporate Layering and Hidden Ownership
Offshore Middlemen: The network employed complex corporate structures, local strawmen (stråmenn), and hidden ownership (skjult eierskap) to mask its operations. Karmøy Health Norway AS was owned and funded by a Singapore-registered holding company, Karmoy Health Norway Pte. Ltd.. Utilizing Singapore as a corporate middleman allowed the cell to transfer capital and mask direct ties to Chinese intelligence.
4. Strategic Real Estate and Ground Site Acquisitions
Inflated Remote Purchases: The network purchased a remote residential property at Bjørnskinnveien 644 (property parcel Gnr 9, bnr 55) in Risøyhamn (Andøy municipality) on March 17, 2026, for an unusually high price of 1.66 million NOK, which police and neighbors flagged as unusually expensive given its remote location and poor condition.
Targeting Critical Infrastructure: This remote bogland property sits just 13 kilometers in a straight line from Andøya Spaceport, providing an ideal geographic vantage point to intercept satellite signals and telemetry from NATO-financed space launches, monitor the landings of the Svalbard fiber-optic cables, and spy on maritime weapons testing.
5. Supply Chain Infiltration (Insider Placement)
Probable infiltration of Subcontractors: Xiaoyin Pan works in Frequentis AG, a major systems supplier and critical subcontractor which supplies command-and-control software for Norway’s 5G emergency network, maritime coastal radio, and the MarTRX launch communications suite used by Isar Aerospace at Andøya Spaceport. Pan previously worked under Wei Qiu at the suspected front company Krefter AS.
6. Clandestine Technical and Wireless Operations
Oversized Interception Hardware: The espionage network attempted to import a 22-ton mobile satellite receiver shipped from Yangshan, China, on January 1, 2026, under the guise of commercial operations.
Terrestrial Sniffing Capabilities: The individuals possibly leveraged technical expertise of Pan’s husband François Pönsgen specializing in cracking GSM network encryption algorithms and deploying false mobile base stations (IMSI catchers) to capture local metadata and cellular transmissions.
7. Political Outreach and Influence Operations
Infiltrating National Institutions: The network engaged in political outreach to establish legitimacy and build relationships. In 2019, representatives from Bitmain (a Chinese crypto firm linked to the network's data center projects) visited the Stortinget (Norwegian Parliament) alongside high-ranking Norwegian politicians, including the deputy leader of the Scrutiny and Constitutional Committee, to build political goodwill and access.
-----------------------------------------------------------------------------------------------------------------
[i] Note - Pan’s husband (François Pönsgen) may have been involved. To date, there has been no legal action against him. He has specialized training and professional access reside at the intersection of cellular airwave interception, cryptographic decryption, and physical network manipulation:
1. Pönsgen's university master's thesis explicitly focused on the setup of false mobile base stations, commonly referred to as IMSI catchers.
2. Cryptographic Vulnerabilities (GSM Decryption). His academic research also focused on cracking of the encryption algorithms for the GSM network.
3. Supply Chain and Physical Infrastructure Infiltration vulnerability. Pönsgen‘s past and current professional include the following roles:
Base Station Hardware Access: Pönsgen has been photographed physically mounting mobile base stations in Oslo during his tenure at Huawei Norge.
Foundational Fiber Network Access: He is currently employed by Netel, a critical infrastructure contractor that secured a 1-billion-NOK contract with Telenor in 2024 to build out Norway's physical fiber-optic network.