Criminal recruiters want people on your payroll

Legitimate employee access can let criminals circumvent security controls that would be difficult to overcome from outside an organization. Routine actions such as information lookups, account resets, transaction approvals and shipment changes can become services sold to criminal customers, according to Intel 471’s Insiders for Hire: Underground Recruitment, Access Claims and Insider-Enabled Services report.

A market for insider capabilities

Cybercriminals sought employees at specific organizations, offered payments to brokers and referrers to find suitable personnel, and advertised services allegedly enabled by employee privileges.

Recruitment accounted for 45 of the 85 records analyzed, making it the largest activity category. Another 15 records involved claims of insider capability, including 11 claims of insider access, while 12 advertised insider-enabled services. Other records involved access and data offerings, a recruitment guide and a complaint.

Threat actors sought employees who could retrieve restricted information, manipulate accounts, facilitate subscriber identity module (SIM) swaps, interfere with shipments, enable fraud or support intrusion and extortion.

Some actors advertised services based on alleged employee privileges, while buyers and operational partners sought these capabilities for broader criminal schemes. Criminal forums, messaging platforms and other marketplaces connected participants, providing channels for recruitment, advertising, referrals and negotiation.

How criminals recruit and compensate insiders

Recruiters used public solicitations, targeted approaches, referrals, brokers and partnership offers to identify potential insiders. Referrals and brokerage allowed criminals to outsource recruitment, while self-proclaimed insiders offered their access or cooperation. Some recruiters used deception or cultivated relationships with prospective insiders over time.

In deliberate employment schemes, actors sought willing participants who would apply for jobs at targeted organizations and misuse their privileges once hired. Other recruitment models focused on existing employees whose roles gave them control over valuable information, systems or business processes.

Advertised compensation models included per-action payments, one-time access or data sales, referral and recruitment fees, revenue sharing and ongoing arrangements. Payments could go directly to an insider, to a facilitator or to multiple participants according to their roles.

Threat actors used or proposed escrow, staged payments, verification requirements and other transaction controls to manage trust and reduce risk.

Transportation leads observed insider demand

Transportation was the most frequently referenced industry in the sample, appearing in 19 leads, followed by technology in 17 and telecommunications in 15. Another 26 leads were cross-sector or could not be confidently assigned to a specific industry.

The distribution of industries mentioned as targets in insider-related leads.

Individual leads could reference multiple industries, so the percentages are not mutually exclusive. They describe the industries represented in the sample and do not measure how common insider threats are across sectors.

Criminals sought transportation insiders who could locate, hold or reroute shipments and alter related records. In telecommunications, they wanted help with SIM swaps, subscriber lookups and account resets to support account compromise and fraud. Technology-related cases focused on internal user data, account administration, content moderation and privileged enterprise access.

FedEx and UPS were each mentioned in nine of the 85 leads, the highest count for any organization. Instagram appeared in four. DoorDash, Facebook, Meta, Verizon and eBay each appeared in three. AT&T, Apple, LinkedIn, PayPal, Santander, T-Mobile and UAB Urbo Bankas were each mentioned twice.