Insider as a service: what is in demand on underground marketplaces

Intel 471 analyzed 85 insider-related leads from 80 threat actors on underground marketplaces collected between August 2025 and August 2026. The report covers a broad range of countries, with examples from the United States, the United Kingdom, Canada, Brazil, Ukraine, Russia, Lithuania, Portugal, and elsewhere.

To start, a brief overview in figures: • 53% of the leads involved recruiting new insiders; the rest concerned selling existing insider access and services based on it. • The industries most frequently identified as targets were transportation and logistics (22%), followed by technology companies (20%) and telecommunications (18%). • FedEx and UPS appeared 9 times—more often than any other specific organization in the sample. • Ads offered up to $50,000 for an introduction to the right employee, and up to $10,000 for a specific insider action.

But the most interesting part of the report is not the individual figures, but the data on what exactly threat actors are buying.

An employee's value is determined by their impact on a specific process. For example, buyers seek support staff, bank tellers, and logistics workers — people who can reset a password, approve a payment, unblock a specific user, or reroute a shipment. This type of access is often more useful than broad administrative privileges.

Increasingly, what is being sold is not the access or credentials themselves, but a completed action. Examples include carrying out a SIM swap, unblocking an account, obtaining customer information, or interfering with the delivery of mail items. This model allows a single insider to work with multiple clients at once without directly exposing themselves.

Recruitment is becoming a service in its own right. Intel 471 identified brokers who offered to find an employee at a client-specified company, contact them, persuade them to cooperate, and hand over a ready-made insider.

An insider can be created before they even gain access. One user on an underground forum was looking for unemployed individuals in the United States and offering to pay them to deliberately seek jobs in customer support at telecom operatorsso they could carry out SIM swaps after being hired.

The most advanced schemes turn an insider into the persistent participant of a criminal operation. Instead of a one-time sale of access, they use recurring assignments and a share of the proceeds.

More specific examples of ads from underground forums can be found in the full report.

Insider activity increasingly resembles a market for organizational capabilities. Threat actors often care less about broad privileges than about the ability to perform a specific action within a normal business process without raising suspicion. As a result, organizations should focus not only on privileged users but also on the business processes themselves—especially where a single employee action can have serious consequences.