Skip to content
Threat Actors Recruit Insiders for Cybercrime Operations

Threat Actors Recruit Insiders for Cybercrime Operations

First seen 8 Nov 2026, 20:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 8, 2026 at 20:19 UTC
  • •53% of insider-related activities focus on recruitment for specific tasks.
  • •Threat actors use criminal forums to find and pay insiders for their access.
  • •Organizations must enhance prevention strategies against insider threats.

Threat actors are increasingly recruiting employees to exploit their access and capabilities for malicious purposes. A recent report analyzed 85 insider-related leads from August 2025 to August 2026, revealing that 53% of these activities focused on recruitment rather than direct access sales. The recruitment methods include open solicitations, targeted approaches, and referrals, with a focus on obtaining specific insider capabilities such as account manipulation and SIM swaps. Criminal forums are now functioning similarly to staffing agencies, offering referral fees for introductions to potential insiders. This trend highlights the need for organizations to enhance their prevention strategies against insider threats, as risks can begin even before employment. The sectors most affected include transportation, technology, and telecommunications.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-11-08
Report on insider recruitment published
Intel 471 released a report detailing the underground recruitment ecosystem for insider threats, analyzing 85 leads from August 2025 to August 2026.
www.intel471.com

More articles in this cluster (2)

Extracted Entities (4)

1 / 2

Common questions

What types of insider capabilities are being targeted?
Threat actors seek capabilities such as accessing sensitive information, account manipulation, and conducting SIM swaps.
How are insider threats being monetized?
Insider access is monetized through one-time payments, referral fees, and ongoing arrangements for repeatable services.
What sectors are most affected by insider recruitment?
Transportation, technology, and telecommunications have the highest concentration of observed insider-related activity.