Cybercriminals Recruit Insiders via Dark Web for Corporate Breaches

Cybercriminals are increasingly using the dark web to recruit insiders from various organizations, posing a significant threat to corporate security. These activities include both public recruitment posts and private messages on professional networking platforms like LinkedIn. By enlisting malicious insiders, cybercriminals can gain direct access to sensitive company resources, enabling them to steal confidential data or execute devastating cyberattacks.

Research conducted by cybersecurity firm NordStellar has identified dark web posts from users actively seeking employees from specific organizations over the past year. A notable focus of these posts is on insiders working for social media and cryptocurrency platforms. For example, in 2025, the cryptocurrency exchange platform Coinbase revealed that it had fallen victim to a breach where cybercriminals bribed employees to leak user information.

According to Vakaris Noreika, a cybersecurity expert at NordStellar, the methods of recruitment vary significantly. While some cybercriminals openly advertise the need for insiders through dark web posts, others adopt a more discreet approach. Over the past 12 months, NordStellar’s team identified 25 unique posts that specifically targeted employees within certain organizations.

Understanding Insider Threats

Insider threats take on a new dimension as they provide cybercriminals with access to critical data, including personal customer information and confidential business agreements. Noreika explains, “This data can be utilized to deploy ransomware attacks, sell intelligence on business agreements to competitors, or carry out sophisticated phishing scams on unsuspecting victims whose personal data they managed to obtain.”

The challenge with insider threats lies in their often undetectable nature. Employees, being trusted members of the organization, have legitimate access to company resources, making it difficult to identify any anomalies in their behavior. Noreika notes that unlike external threats, insiders may not trigger typical security alerts, such as unusual login attempts or data transfers. They are also familiar with the organization’s internal security policies, allowing them to adjust their actions to avoid suspicion.

Combatting Insider Recruitment

While cybercriminals are increasingly seeking insiders through the dark web, Noreika emphasizes that recruitment processes are usually carried out privately. These bad actors target specific employees, particularly those with technical expertise or access to highly sensitive data.

To safeguard against insider threats, businesses must establish a strong cybersecurity strategy that emphasizes high observability into system and data usage. Noreika advises that any unexpected system behavior or access patterns should be flagged, reported, and thoroughly examined. “Patterns of unusual behavior are the first indicator that a user might be an insider,” he says. Security teams should monitor employees who frequently access sensitive information to ensure they possess the proper authorization. Data exfiltration to external parties or devices is another major red flag.

Furthermore, having an incident recovery plan is crucial for minimizing the fallout from a cyberattack originating from insider threats. This plan should cover incident detection and outline key steps the organization should take to contain the threat and mitigate damage.

In related news, Google has announced its intention to shut down its dark web monitoring tool, the Dark Web Report, which was designed to scan the dark web for exposed personal information. The shutdown is scheduled for January 15, 2026, with scans for new dark web breaches ceasing on that date. The Dark Web Report will no longer be available after February 16, 2026, and all data related to the report will be deleted. Google has indicated a desire to focus on tools that provide clearer, actionable steps for customers to protect their online information, though no specific announcements regarding new cybersecurity tools have been made.

As cybercriminals continue to adapt their tactics, the need for robust cybersecurity measures that address both external and internal threats has never been more critical. Organizations must remain vigilant in monitoring employee behavior and protecting sensitive data to thwart the growing risks posed by insider recruitment on the dark web.