Criminals recruit employees to bypass corporate controls
Cybercriminals are actively recruiting employees of target companies to exploit their internal credentials and bypass security systems. According to Intel 471's Insiders for Hire report, 53% of the cases analyzed involve recruitment activities, with a specific focus on sectors such as transportation, technology, and telecommunications.
Quick Response
Cybercriminals recruit employees to exploit their internal credentials, with a focus on transportation, technology, and telecommunications. Recruitment activities represent 53% of the cases analyzed, with compensation ranging from one-time payments to profit-sharing agreements.
A black market for privileged access
The report highlights how criminals seek employees capable of retrieving confidential information, manipulating accounts, facilitating SIM swaps, interfering with shipments, enabling fraud, or supporting intrusions and extortion. 17% of the cases analyzed concern offers of services based on privileged access, while 13% involve claims of internal capabilities.
Recruitment methods and compensation
Recruiters use various techniques, including public ads, targeted approaches, referrals, intermediaries, and partnership offers. Some criminals adopt deliberate employment schemes, recruiting people who apply for specific jobs and then abuse their credentials once hired. Compensation models include payments per action, sales of access or data, referral commissions, and profit-sharing agreements.
Most affected sectors
The transportation sector is the most frequently mentioned, with 19 cases out of 85, followed by technology (17 cases) and telecommunications (15 cases). Criminals target transportation employees capable of locating, detaining, or redirecting shipments and modifying related records. In the telecommunications sector, they aim at SIM swaps, subscriber searches, and account resets to support fraud and account compromise.
Targeted organizations
The companies most frequently mentioned in the analyzed cases include FedEx and UPS (nine mentions each), Instagram (four mentions), DoorDash, Facebook, Meta, Verizon, and eBay (three mentions each). AT&T, Apple, LinkedIn, PayPal, Santander, T-Mobile, and UAB Urbo Bankas are mentioned twice each.
Implications for corporate cybersecurity
This trend underscores the importance of implementing Managed SOC solutions and MDR services to monitor and respond to internal threats. Companies should also consider a cyber risk policy to mitigate the financial risks associated with data breaches caused by insiders.
Prevention and response measures
To counter this threat, organizations should adopt a zero trust architecture and implement Identity Access Management (IAM) solutions. Additionally, it is crucial to develop an incident response plan that includes specific procedures for managing internal threats.
The importance of compliance
Companies must ensure they comply with regulations such as the NIS2 Directive and the DORA Regulation, which require robust security measures and digital operational resilience. Compliance with these standards can help prevent and effectively manage internal threats.
The recruitment of employees by cybercriminals represents a significant threat to corporate security. Organizations must adopt a proactive approach, combining advanced technologies, rigorous security policies, and secure crypto asset management to protect themselves from these emerging threats.
Impact on the cyber insurance market
The increase in these internal threats is already affecting the market for cyber risk policies, with a consequent rise in the cyber insurance cost for the most exposed companies. Insurance companies are reviewing contractual clauses to include specific exclusions related to breaches caused by insiders, pushing organizations to invest more in breach remediation and incident response solutions.
The role of regulations in countering internal threats
The NIS2 Directive and the DORA Regulation are pushing companies to completely review their digital operational resilience strategies. The regulations require not only the protection of critical infrastructures but also the ability to quickly recover in case of breaches, including those caused by insiders. Companies must demonstrate that they have preventive measures and effective disaster recovery as a service procedures in place.
The importance of continuous training for employees
A crucial element in defending against these threats is the continuous training of employees. Organizations must implement specific awareness and training programs to recognize and report recruitment attempts by cybercriminals. Awareness of the risks associated with privileged credentials and the psychological manipulation techniques used by recruiters is fundamental to preventing incidents.
The future of internal threats
Security experts predict that internal threats will continue to grow, with a further increase in recruitment activities by cybercriminals. The evolution of manipulation techniques and the adoption of deliberate employment schemes make a proactive approach necessary. Organizations must be ready to continuously adapt their security strategies to counter this new frontier of cyber threats.
The integration of advanced technologies
To effectively address internal threats, companies should consider integrating advanced technologies such as Data Loss Prevention (DLP) and Security Information and Event Management (SIEM) solutions. These technologies can help monitor insider activities, detect suspicious behaviors, and prevent unauthorized access. Additionally, implementing a managed Security Operations Center can provide an additional level of surveillance and response.
The importance of audits and certifications
Companies should consider obtaining ISO 27001 certification to demonstrate their commitment to information security management. Regular security audits can identify vulnerabilities and areas for improvement, while certifications can strengthen customer and stakeholder trust. Additionally, compliance with international standards can facilitate access to globalized markets and improve competitive positioning.
Risk mitigation strategies
An effective risk mitigation strategy must include network segmentation to limit access to sensitive data and the implementation of access controls based on zero trust principles. Companies should also adopt Identity Access Management (IAM) solutions to manage and monitor user identities. Additionally, it is essential to develop a plan for regular penetration tests to identify and correct vulnerabilities before they can be exploited.
The need for clear governance
Clear governance is fundamental to addressing internal threats. Organizations must define clear roles and responsibilities, establish rigorous security policies, and implement monitoring and reporting procedures. Creating a dedicated security committee can help coordinate efforts and ensure that security measures are integrated across all areas of the organization.
Future forecasts and emerging trends
Experts predict that internal threats will continue to evolve, with an increase in recruitment activities and manipulation techniques. Organizations must be ready to adapt their security strategies to address these emerging challenges. The adoption of advanced technologies, continuous employee training, and a proactive approach to cybersecurity will be essential to protect companies from these ever-evolving threats.
The importance of a strategic partnership
Collaborating with Managed Detection and Response (MDR) service providers can offer an additional level of protection. These partnerships can provide access to specialized expertise, advanced technological resources, and continuous support to address internal threats. Additionally, integrating enterprise backup and business continuity solutions can ensure operational recovery in case of incidents.
The challenge of managing human risk
One of the most complex aspects of internal threats is managing human risk. Organizations must develop strategies to identify and manage at-risk employees, providing support and resources to prevent recruitment by cybercriminals. Corporate wellness programs and psychological support lines can contribute to creating a safe and protected work environment.
The adoption of a security culture
Finally, creating a security culture is fundamental to addressing internal threats. Organizations must promote a security mindset across all areas of the company, raising employee awareness of risks and encouraging secure behaviors. Leadership must be actively involved in promoting a security culture, demonstrating the importance of protecting data and critical infrastructures.
Frequently Asked Questions
Which sectors are most affected by these internal threats?
The most affected sectors are transportation, technology, and telecommunications, with a specific focus on companies like FedEx, UPS, and Instagram.
How can companies prevent the recruitment of employees by cybercriminals?
Companies can prevent recruitment by implementing continuous training programs, adopting advanced technologies such as DLP and SIEM solutions, and developing a security culture.
What are the legal implications of breaches caused by insiders?
Breaches caused by insiders can have serious legal implications, including sanctions for non-compliance with regulations such as the NIS2 Directive and the DORA Regulation, as well as potential legal actions from customers and stakeholders.
How can companies mitigate the financial risks associated with internal threats?
Companies can mitigate financial risks by investing in breach remediation solutions, adopting a cyber risk policy, and developing a business continuity plan.
Which are the most effective technologies to counter internal threats?
The most effective technologies include Data Loss Prevention (DLP) solutions, Security Information and Event Management (SIEM), zero trust architectures, and Identity Access Management (IAM).
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not carry out real-time information activities.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves autonomously before making any decision.