VORANT. Threat Intelligence Sign in Get the full feed

FBI warns of Chinese virtual recruitment espionage

low threat government-nationaldefense

The FBI details how foreign intelligence services, especially China, use fake online job offers to recruit U.S. insiders for espionage.

The FBI's Counterintelligence and Espionage Division has published guidance warning about "virtual targeting," a recruitment tactic used by foreign intelligence services to identify and cultivate insider sources through professional networking sites, social media, and freelance job platforms. Operatives pose as consulting firm representatives or researchers, initially requesting harmless open-source analysis work, then gradually escalating to requests for sensitive or classified information while increasing payments and moving communications to encrypted apps and cryptocurrency or peer-to-peer payment methods to avoid detection.

The article highlights the case of Korbein Schultz, a former U.S. Army intelligence analyst sentenced to seven years for transmitting at least 92 sensitive military documents to a China-based individual posing as a geopolitical consulting client. The relationship was conducted entirely online via a freelance work platform and commercial messaging apps, with payment through online platforms, illustrating how adversaries avoid face-to-face contact entirely while building trust and extracting increasingly sensitive material over time.

This is a counterintelligence awareness advisory rather than a report on an active malware campaign or technical exploit. It targets current and former U.S. government employees, military personnel, contractors, and cleared individuals, urging vigilance against unsolicited remote consulting offers and encouraging reporting of suspected foreign contact to the FBI.

Mentioned in this report

Threat actors Chinese intelligence services

Source reporting: https://www.fbi.gov/news/stories/foreign-virtual-targeting

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free