Cybercriminals are increasingly relying on insiders rather than hacking

For the report «The Market for Trust: How Cybercriminals Recruit Corporate Insiders,» TrendAI researchers Mayra Rosario Fuentes, Stephen Hilt, and David Sancho examined how the trade in insider access is organized on the dark web. Their finding: What once consisted of isolated incidents has evolved into a mature business based on the division of labor—with fixed prices, profit-sharing, referral bonuses, and long-term partnerships that are more reminiscent of a regular industry than of traditional cybercrime.

«Today, the easiest way to infiltrate a company no longer necessarily involves exploiting a security vulnerability—often, all it takes is an employee. In the cybercrime underground, trusted access is increasingly being traded like a commodity: Criminals specifically recruit insiders who can bypass security measures simply by doing their regular jobs. Protecting against insider threats today also means recognizing that your own employees have become targets themselves,» explains David Sancho, Senior Threat Researcher at TrendAI, the enterprise cybersecurity division of Trend Micro.

An Overview of the Key Findings

• Today, insider recruitment is an industry in its own right. On underground forums and Telegram channels, brokers, escrow services, and regular business partners now operate as openly as they would in a mainstream industry.
• It's not the most user rights that matter, but the greatest decision-making power. Criminals specifically target employees who can authorize payments, restore accounts, or bypass fraud checks—actions that an external attacker could never credibly mimic.
• Insider services are becoming mass-market products. Whether it's unlocking social media accounts, manipulating shipping tracking, or obtaining discounts through fraudulent means: There are now fixed prices, guaranteed turnaround times, and even reseller programs for all of these services.
• The AI industry is coming under scrutiny. The more valuable model data, training material, and privileged access AI companies accumulate, the more attractive their employees become to criminals.

«For a long time, when we thought of insider threats, we mainly thought of frustrated employees or human error. What we’re seeing today is something fundamentally different: Criminals are specifically recruiting trustworthy employees through organized underground marketplaces and turning insider access into a service that can be bought and sold,» says Mayra Rosario Fuentes, Senior Threat Researcher at TrendAI.

The report examines this phenomenon across a range of industries—from government agencies, healthcare, social media, telecommunications, and finance, through manufacturing, energy, logistics, and retail, to review platforms.

Three Industries in the Spotlight

Three industries in particular—telecommunications, social media, and finance—clearly illustrate how far this trend toward professionalization has already progressed. In these sectors, the report documents the most concrete case studies backed by reliable figures—some of which have even led to criminal prosecution.

• Telecommunications: SIM Swapping as the Most Lucrative Business: A bribed employee can use a SIM swap to bypass SMS-based two-factor authentication, thereby giving attackers access to bank and crypto accounts. On the black market, this service costs up to $20,000 for Verizon, T-Mobile, or AT&T, plus a 20 percent cut. A case from the U.S. shows that law enforcement agencies are already taking action: In November 2025, the Manhattan District Attorney’s Office indicted a SIM-swapping ring that allegedly stole approximately $435,000 from four victims with the help of bribed AT&T and T-Mobile employees.
• Social Media: Suspended Accounts, Reactivated for Cash: Insiders reactivate suspended accounts on Meta, TikTok, or X for between $1,000 and over $7,000, or approve fraudulent ads. At Meta, the misuse of the internal tool «Oops» by bribed employees led to the termination or other disciplinary actions against more than two dozen employees and contractors in late 2022. Meta subsequently sued the alleged intermediaries in a Canadian court in 2023.
• Finance: Bank Account Key: A seller on an underground forum offered three years of insider access to the accounting records of a company with $25 million in annual revenue, with a starting bid of $25,000. For referring a single corrupt employee at crypto exchanges such as Binance or Robinhood, clients paid up to $5,000 as a bounty or, alternatively, a 15 percent share of the proceeds.

Source: TrendAI

This article originally appeared on m-q.ch - https://www.m-q.ch/de/cyberkriminelle-setzen-zunehmend-auf-insider-statt-auf-hacking/