A report from Intel 471, covered by Help Net Security, examined 85 leads from criminal forums and marketplaces and found that recruiting employees is the largest category of insider-related activity. Recruitment accounted for 45 of those leads, with another 15 involving claims of insider capability and 12 advertising insider-enabled services. The sought-after capabilities include information lookups, account resets, transaction approvals, and shipment changes that would let criminals bypass security controls from inside an organization.
Recruiters used public solicitations, targeted approaches, referrals, brokers, and partnership offers to find insiders. Some schemes deliberately placed willing applicants into jobs at targeted organizations. Compensation models ranged from per-action payments and one-time data sales to revenue sharing and referral fees, and criminals used escrow or staged payments to manage trust.
Transportation was the most frequently referenced industry, appearing in 19 leads, followed by technology in 17 and telecommunications in 15. FedEx and UPS were each mentioned in nine leads, the highest count for any organization. The report notes that individual leads could reference multiple industries, so the figures describe representation in the sample rather than the overall prevalence of insider threats across sectors.