Using online job offers to recruit insiders
Recruiter: “We are impressed by your government experience. We’d like to offer you paid consulting work.”
Federal retiree: “Consulting? What kind of work?”
The message sounded like a perfect opportunity. A recently retired military analyst wanting to stay professionally active was approached online by someone claiming to represent an international consulting company.
The recruiter praised the analyst’s expertise and offered flexible, remote assignments writing short reports. The work appeared harmless. The pay was generous. The recruiter seemed professional.
But the opportunity was not what it seemed.
“Foreign intelligence services frequently use professional networking websites, social media platforms, and job boards to identify and target individuals under the guise of consulting or employment,” said Roman Rozhavsky, the assistant director of the FBI’s Counterintelligence and Espionage Division.
The tactic is known as virtual targeting, a strategy that some foreign intelligence services use to find new intelligence sources. Instead of meeting in person, foreign actors use online platforms to identify and recruit individuals with access to sensitive or classified information.
Using false online identities, they may pose as recruiters, consulting firm representatives, researchers, or analysts to establish professional relationships and collect information that supports their intelligence objectives.
Foreign intelligence services rely heavily on online platforms because they provide direct access to potential targets. Among U.S. foreign adversaries, China is by far the most prolific practitioner.
Take the case of Korbein Schultz, a former U.S. Army intelligence analyst who was sentenced to seven years in prison for conspiring to collect and transmit national defense information; unlawfully exporting controlled information; and accepting bribes in exchange of sensitive, non-public U.S. government information.
“Foreign intelligence services frequently use professional networking websites, social media platforms, and job boards to identify and target individuals under the guise of consulting or employment,”
Roman Rozhavsky, assistant director, FBI Counterintelligence and Espionage Division
An individual masquerading as a client from a geopolitical consulting firm contacted Schultz through a freelance web-based work platform. The individual was a foreign national residing in China. This individual solicited Schultz to produce detailed analyses on U.S. military capabilities and planning, particularly in relation to Taiwan and the Russia-Ukraine conflict. Over time, the individual made demands for increasingly more sensitive materials—including technical manuals, operational procedures, and intelligence assessments—in exchange for money. Schultz used his access to restricted databases to download and transmit at least 92 sensitive U.S. military documents. He also tried to recruit a fellow Army analyst into the conspiracy.
Throughout his engagement with the foreign national, Schultz never met the individual in person but continued to complete tasks asking for more sensitive information. Schultz was tasked via commercial messaging applications and paid through online payment platforms, removing the need for any face-to-face interactions.
Adversaries contact hundreds of people quickly and at low cost by using online resources. They can also easily hide their true identities and locations.
They target platforms full of potential prospects: current and former government employees, military members, contractors, and private sector professionals. Foreign recruiters seek individuals with government, military, diplomatic, technological, or economic experience—or access to individuals with this experience.
Even people without current access to sensitive information may be contacted because their education and professional experience may lead to positions with access to valuable information in the future.
“Anyone with specialized knowledge or government-related experience may be of interest. Even seemingly routine expertise can help foreign intelligence services better understand U.S. systems and capabilities,” Rozhavsky said.
Foreign intelligence services devote particular attention to current and former U.S. government personnel. These individuals often have access to sensitive or non-public information and remain attractive targets even after leaving government service.
Foreign agents often start the relationship with a simple message offering consulting work or research opportunities.
The next step is building trust. Operatives may begin with basic assignments, such as writing reports or white papers using publicly available information or sharing professional opinions.
These early requests help them evaluate whether the person is willing to cooperate. Payment for these initial tasks helps establish legitimacy and encourages continued engagement.
Over time, requests may become more specific and involve sensitive or non-public information. This progression is designed to build a relationship and increase the likelihood of continued communication. Operatives frequently flatter the individual and their expertise.
“These relationships often begin with harmless-looking tasks using public information,” according to Rozhavsky. “Once trust is established, the assignments gradually become more specific, more lucrative, and more sensitive.”
As the relationship develops, the recruiter may request exclusive insights or offer more money. They may also move communications from professional platforms to encrypted messaging applications.
Payment methods rely on informal or less traceable methods, such as cryptocurrency or peer-to-peer payment services. These tactics help hide the relationship and protect the identity of the foreign agency. Most foreign adversaries are well-versed in U.S.-based payment applications to help make their approach less alarming.
“Anyone with specialized knowledge or government-related experience may be of interest. Even seemingly routine expertise can help foreign intelligence services better understand U.S. systems and capabilities.”
Roman Rozhavsky, assistant director, FBI Counterintelligence and Espionage Division
Individuals targeted through virtual recruitment may not realize they are communicating with a foreign intelligence service, at least at first. Operatives present themselves as legitimate employers and rely on professional communication, financial incentives, and relationship building to gain trust.
In some cases, individuals who become successful sources are encouraged to recruit colleagues, friends, or former coworkers. Their experience, including payments and perks, lends more credibility to the offer.
Individuals with clearances or who worked in sensitive positions should remember they are responsible for protecting certain information after employment—and that even seemingly harmless information can be valuable to foreign adversaries.
Current clearance holders or government employees should also review their department’s secondary employment policy and make sure they are reporting outside employment if required.
Virtual targeting is a serious and persistent threat, but awareness can prevent people from getting snared in a recruitment attempt. Anyone offered unexpected remote consulting or employment opportunities should evaluate the situation carefully. Verify the company independently. Be cautious about sharing professional information and remain alert to unusual requests or payment methods.
If you believe a foreign agency has contacted you, stop communicating immediately and report the contact to the FBI at tips.fbi.gov.
