Insider Threat Report: Dark Web Recruitment & Access Trends

Unknowingly, a member of key personnel is living two separate lives. On the clock, they are a highly-trusted systems administrator, but in their personal time, they moonlight on the deep and dark web, advertising their trust and access to the highest bidder. One day, they get a simple offer: $15,000 in the crypto of their choice to approve a single push notification at 2 AM. They accept. By morning, the attacker walks away  with active domain admin credentials without the need for malware or cracking firewalls.

This is just one example of how insider threats lead to modern enterprise breaches. As perimeter security, EDR coverage, and other security tools mature, threat actors continue to target the human element, seeking employees and contractors willing to provide access to corporate systems or facilitate fraudulent activity.

In a threat landscape where identity is becoming the primary attack surface, monitoring illicit marketplaces and recruitment efforts is critical. This new monthly report leverages Flashpoint’s Primary Source Collection (PSC) to analyze insider threat tactics, tracking active recruitment and advertising on dark web forums and encrypted networks.

The Insider Threat Landscape: September 2026

In September 2026, Flashpoint analysts identified a total of 9,787 insider-related posts across 1,216 channels and 1,778 authors. While the volume of observed activity decreased, threat actors continued to actively seek and advertise insider access, particularly within industries where legitimate employee privileges can be exploited to facilitate fraud. These communications included threat actors attempting to recruit insiders at target organizations, insiders advertising their services, and general discussions involving insider-related threat activity.

Of these communications, Flashpoint observed 857 unique posts between September 1 and September 30, 2026.

The majority of these posts appeared in mid-tier English-language Telegram channels, where threat actors sought or advertised insider access to organizations across several industries. Much of the observed activity focused on recruiting insiders to facilitate fraud operations.

Where Insider Threat Activity is Concentrated

Retail, telecommunications, and financial services remained prominent targets for insider threat activity in September 2026. However, a significant portion of the observed activity could not be attributed to a specific industry.

Flashpoint found that 45.7% of unique insider posts fell into the “Unknown” category, meaning analysts could not determine the targeted organization or industry. Among posts with an identifiable industry, retail accounted for the largest share, followed by telecommunications, financial services, and technology.

Together, these four industries accounted for 419 unique posts, or nearly 49% of all unique insider-related activity observed during the month.

The concentration of activity in retail, telecommunications, and financial services reflects continued threat actor interest in insiders who may be positioned to facilitate fraud, provide access to customer accounts, or exploit legitimate organizational privileges.

The following table shows a breakdown of unique insider posts by industry in July 2026:

Industry	Posts
Other	392
Retail	135
Telecom	116
Financial	85
Technology	83
Public Sector	41
Healthcare	3
Media	2
Total	857

Insider Threats: Recruiting vs. Advertising

Active insider threats generally involve two types of activity: an insider is recruited by a malicious outside party, or an insider advertises their access and services to interested threat actors. These arrangements can enable adversaries to exfiltrate sensitive data, install malware, compromise accounts, or carry out fraudulent activities such as SIM swaps.

In September 2026, Flashpoint analysts identified 15 notable insider recruitment and advertising posts across underground communities and chat forums. Of these, nine involved threat actors attempting to recruit insiders, while six involved actors advertising insider services.

Telecommunications accounted for the largest number of notable posts, with five instances of recruitment or advertising. Retail and technology followed with three each, while financial services and the public sector accounted for two each.

These examples illustrate how threat actors continue to seek access across industries, with particular interest in employees and contractors who can facilitate fraud or provide privileged access to organizational systems.

Flashpoint also observed numerous insider solicitations repeated across multiple discussion threads, often with limited details about the access or services being offered. Analysts could not independently verify the legitimacy of the recruitment and advertising claims.

Protect Against Insider Threats Using Flashpoint

Insider threats are inherently difficult to detect using internal security controls alone because the malicious activity relies on valid credentials and legitimate access privileges. Relying solely on internal logs means security teams often only detect an insider threat after data exfiltration or system sabotage has already occurred.

Flashpoint protects organizations against insider threats through our Primary Source Collection (PSC) and specialized intelligence platforms:

• External Threat Intelligence & Early Warning: Flashpoint monitors deep and dark web forums, invite-only threat communities, and encrypted chat platforms to identify employee solicitations, stolen corporate domain mentions, and active recruitment attempts before an intrusion develops.
• Identity Protection & Infostealer Tracking: By tracking illicit marketplaces and infostealer activity, Flashpoint identifies compromised corporate credentials and active session tokens, preventing threat actors from utilizing purchased access.
• User & Entity Behavior Context: Flashpoint’s intelligence equips SOC, Security Operations, and Risk Management teams with adversary TTPs, enabling security operations to look for anomalous data downloads, off-hours access, or unauthorized software installation.

To learn more about how Flashpoint can help protect your enterprise from insider risk and monitor illicit underground communities, Request a Demo Today.

Frequently Asked Questions (FAQs)

What is the Flashpoint Insider Threat Report?

The Flashpoint Insider Threat Report is a monthly intelligence brief that analyzes trends, volume, targeted industries, and tactics surrounding insider threat recruitment and illicit access advertising on the deep web, dark web, and encrypted chat channels.

How does Flashpoint collect insider threat data?

Flashpoint collects data using its Primary Source Collection (PSC) engine, which actively monitors thousands of dark web forums, illicit marketplaces, and underground chat networks where threat actors and malicious insiders communicate.

What is the difference between insider recruitment and insider advertising?

Insider recruitment occurs when an external cybercriminal attempts to entice a corporate employee into assisting with a cyberattack. Insider advertising occurs when an employee or contractor proactively lists their legitimate access or services for sale on illicit marketplaces.