Back www.intel471.com

Insiders for Hire: Underground Recruitment, Access Claims and Insider-Enabled Services

www.intel471.com • November 8, 2026

Threat actors are increasingly targeting employees for the access, capabilities and workflows they control. Intel 471's latest report examines the underground insider ecosystem, drawing on 85 insider-related leads linked to 80 actor handles collected between August 2025 and August 2026.

In this report, you'll learn :

How threat actors recruit insiders through open solicitations, targeted approaches, referrals, brokers and deceptive recruitment

The types of insider capabilities being sought, including restricted information, account manipulation, SIM swaps, shipment intervention, fraud, intrusion and extortion

How insider access and capabilities are monetized through one-time payments, referral fees, revenue sharing and ongoing arrangements

How threat actors turn employee privileges into repeatable, customer-facing services and outsource insider-enabled activity

Why transportation, technology and telecommunications were among the sectors with the highest concentration of observed insider-related activity

Download Intel 471's report Insiders for Hire: Underground Recruitment, Access Claims and Insider-Enabled Services to explore how threat actors source, monetize and operationalize insider capabilities.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Recruit Insiders for Cybercrime Operations Threat actors are increasingly recruiting employees to exploit their access and capabilities for malicious purposes. A recent report analyzed 85 insider-related leads from August 2025 to August 2026, revealing that 53% of these activities focused on recruitment rather than direct access sales. The recruitment methods include open solicitations, targeted approaches, and referrals, with a focus on obtaining specific insider capabilities such as account manipulation and SIM swaps. Criminal forums are now functioning similarly to staffing agencies, offering referral fees for introductions to potential insiders. This trend highlights the need for organizations to enhance their prevention strategies against insider threats, as risks can begin even before employment. The sectors most affected include transportation, technology, and telecommunications. 1 sources 40

Extracted Entities

Industries (3)

Technology Telecommunications Transportation