Criminal recruiters want people on your payroll

1. Executive summary

Intel 471 has published a study of 85 underground records in which criminals recruited employees, advertised insider-enabled services, or claimed existing insider access, with recruitment the largest category at 45 records. The advertised capabilities map directly onto routine financial operations: information lookups, account resets, transaction approvals and shipment changes, sold per action or as ongoing arrangements. No CVE, no malware and no named threat actor is involved; the exposure is the trust placed in legitimate employee credentials and business-process authority. For EMEA financial services the risk is concentrated in payment approval, account recovery and third-party logistics workflows, where an insider can bypass controls that would stop an external attacker. The report is single-sourced to Intel 471 and the sample is small, so the figures describe that sample and not sector-wide prevalence.

2. Regulatory framing

No other article in the reference is engaged by this item. The report contains no incident at a specific institution, so DORA Art. 18 and Art. 19 classification and reporting duties are not triggered by the report itself; they apply if and when a client suffers such an event.

3. Technical analysis & attack chain

This is a criminal-market study, not an intrusion report. There is no exploited component, no payload and no command-and-control infrastructure in the source. What follows is the recruitment and compensation model as described, and the operational steps it implies.

1. Criminals identify a target organization and the role whose privileges they need. Transportation was the most referenced industry with 19 leads, then technology with 17 and telecommunications with 15; 26 leads were cross-sector or unassigned. Individual leads can reference multiple industries and the percentages are not mutually exclusive.
2. They recruit through public solicitations, targeted approaches, referrals, brokers and partnership offers. Referral and brokerage let the recruiter outsource the search. Some recruiters used deception or cultivated a relationship with a prospective insider over time.
3. Two recruitment models are described. In deliberate employment schemes, the actor finds a willing participant who applies for a job at the target organization and misuses privileges after being hired. The other model targets existing employees whose role already gives them control over valuable information, systems or business processes.
4. Compensation is agreed. Advertised models include per-action payments, one-time access or data sales, referral and recruitment fees, revenue sharing and ongoing arrangements. Payment can go to the insider, to a facilitator, or split across multiple participants by role.
5. Transaction controls are used to manage trust between buyer and insider: escrow, staged payments and verification requirements.
6. The insider performs the action. The capabilities advertised or sought were retrieval of restricted information, account manipulation, SIM swaps, interference with shipments, enabling fraud, and support to intrusion and extortion. In telecommunications the specific asks were SIM swaps, subscriber lookups and account resets to support account compromise and fraud. In transportation, insiders were sought to locate, hold or reroute shipments and alter related records.
7. The output is sold onward. Buyers and operational partners sought these capabilities for broader criminal schemes, with criminal forums, messaging platforms and other marketplaces providing the channels for recruitment, advertising, referrals and negotiation.

Named organizations in the sample: FedEx and UPS each appear in nine of the 85 leads, the highest count for any organization. Instagram appears in four. DoorDash, Facebook, Meta, Verizon and eBay each appear in three. AT&T, Apple, LinkedIn, PayPal, Santander, T-Mobile and UAB Urbo Bankas each appear twice. These are mentions in recruitment leads, not confirmed compromises.

Confidence caveats. The entire dataset is single-sourced to Intel 471's Insiders for Hire report and covers 85 records, a small sample. The industry distribution describes the industries represented in that sample and does not measure how common insider threats are across sectors. The "insider access" claims are claims: 11 of the 15 capability records were claims of insider access, and the source does not state that any were verified. Treat every advertised capability as unverified until independently corroborated. No MITRE ATT&CK profile exists for the attributed actor "Intel 471" in the verified reference data; Intel 471 is the reporting vendor, not a threat actor, and no actor attribution should be drawn from this item.

4. Mitigation & containment

The controls that matter here are process and personnel controls, not patches. There is no vendor fix for this item.

P1 (within 24 hours)

• Identify every role in your institution that can approve a payment, reset an account, release or reroute a shipment, or look up restricted customer data, and confirm that each such action requires a second person. The advertised services are exactly these actions, so single-person authority is the exposure.
• Review recent account-reset and payment-approval activity for actions performed outside the operator's normal hours, geography or volume baseline. The source names account resets and transaction approvals as sold services; the detection signal is the action, not a file.
• Confirm that your third-party logistics and telecommunications providers have a named contact for reporting suspected insider activity, and that the contract requires them to notify you of insider-enabled events affecting your transactions. This is the DORA Art. 28 and NIS2 Art. 21(2)(d) exposure named in §2.

P2 (within 72 hours)

• Add a verification step to SIM-swap and number-porting requests that does not rely on the mobile number itself. Telecommunications insiders were sought specifically for SIM swaps and subscriber lookups to support account compromise and fraud.
• Require callback verification to a previously registered number, not a number supplied in the request, for any change to payment beneficiary details or shipment routing.
• Review joiner, mover and leaver records for the roles identified in P1 over the last 12 months, with attention to hires whose role gives transaction authority. The deliberate employment scheme in the source depends on getting a willing participant hired into exactly such a role.

P3 (within 7 days)

• Add insider-enabled fraud scenarios to the fraud risk assessment: per-action payments and revenue-sharing arrangements mean an insider may act repeatedly over time rather than once, so retrospective review windows should cover months, not days.
• Brief HR and recruitment on the deliberate-employment pattern so that background checks for transaction-authority roles account for it.
• Where you use referral or brokerage arrangements for any outsourced function, confirm that the intermediary's personnel are subject to the same access controls as your own.

5. Indicators of compromise

No indicators of compromise available in the source material. The source contains no hashes, domains, IP addresses, file paths or command lines.

The source does describe observable behaviours. These are not atomic indicators and cannot be enforced as blocklist entries.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source contains no file artefacts, command lines, registry keys, scheduled-task names or network values from which a YARA or Sigma rule could be built. A rule keyed on the vendor name, the report title or the named organizations would detect reporting about the activity, not the activity itself.

Detection for this item belongs in behavioural analytics against identity, payment and logistics audit logs, as set out in §5.

7. Sources

• Help Net Security, "Criminal recruiters want people on your payroll", 2026-10-02. https://www.helpnetsecurity.com/2026/10/02/intel-471-insider-threat-recruitment-report/
• Intel 471, "Insiders for Hire: Underground Recruitment, Access Claims and Insider-Enabled Services" report, cited within the Help Net Security article above. The primary report was not supplied to Adverse Trace; all figures in this advisory are taken from the Help Net Security summary and are single-sourced.

8. Adverse Trace position

We assess this as a medium-severity process risk rather than a technical vulnerability, and we are not inflating it: the source reports a criminal market and advertised capabilities, not a confirmed compromise at any named organization, and the 85-record sample is small and single-sourced. The client impact is concentrated in payment approval, account recovery and third-party logistics, where an insider bypasses controls that hold against an external attacker. We will track whether Intel 471 or other vendors corroborate the recruitment patterns with case data, and we will reissue if a named financial institution is confirmed as a target or victim. Clients who want to act now should start with the P1 second-person control review in §4, because it addresses the exact actions the source says are being sold.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.