Insider Recruitment by Threat Actors: Spotting and Stopping Employee Collusion

Extortion and ransomware groups no longer need to break in when they can pay someone already inside to hand over credentials, approve a sign-in prompt or copy records they can see for their job. CISA calls this a collusive insider threat: one or more insiders collaborating with an external threat actor to compromise an organisation. Government reviews and incident disclosures since 2022 describe groups openly advertising for employees, contractors and outsourced support staff, offering weekly payments or a share of a future ransom. This guide explains how recruitment works, which roles are targeted, and how to make a recruited insider less useful and easier to spot: access design, sign-in controls, detection, reporting routes and response. It is for security leaders, insider risk teams and identity owners; it is written for defenders and contains no attacker procedures.

Source note: incident details below are summarised from the CSRB, CISA, Microsoft, NCC Group and SEC sources listed in the references, as checked in November 2026. Confirm against the official text before relying on it.

Key takeaways

• Recruitment is an initial access technique. The Cyber Safety Review Board's review of Lapsus$ and related groups lists insider recruitment alongside SIM swapping and help desk social engineering as ways in, with insiders providing credentials, approving MFA requests or acting with their own access.
• Support, telecoms and outsourced roles are prime targets. People with broad read access to customer records or account recovery tools are valuable even with no administrative rights, as the Coinbase disclosure of bribed overseas support staff shows.
• Design access so one person cannot do much harm. Ticket-bound record access, masked sensitive fields, phishing-resistant MFA that cannot be approved on someone else's behalf, and two-person approval for high-risk actions blunt most offers.
• Make reporting an approach easy and safe. When Medusa approached a BBC journalist in 2025, the target involved security experts and the employer cut off his access as a precaution; staff need a known route and no penalty for being contacted.
• Treat contractors and BPOs as part of the insider estate. The CSRB found organisations did not always consider third parties and business process outsourcers in their risk management; contracts, monitoring and access reviews must reach them.

What insider recruitment looks like

Insider recruitment differs from the classic malicious insider because the intent and the plan come from outside. The insider may have no grievance and no technical skill: they are paid to perform one small act that bypasses controls built to stop outsiders. Public sources describe three recurring patterns.

NCC Group's December 2025 threat pulse also notes ransomware-as-a-service groups increasingly treating employees, contractors and trusted partners as gateways, and reports guilty pleas by two security professionals who helped ALPHV BlackCat attack US organisations. The insider can therefore sit inside the security function itself. See the Lapsus$ Threat Actor Profile, the Medusa Ransomware Threat Actor Profile and the ALPHV BlackCat Threat Actor Profile for group-level detail. For the scale of insider incidents generally, see the Insider Threat Statistics Guide.

Which roles are targeted and why

Recruiters look for access that converts into money quickly, held by people who may be poorly paid, remote, newly hired or managed by a third party. Risk follows the access, not the job title.

Outsourced staff deserve particular attention. They often sit outside the organisation's HR processes, vetting and culture, yet use the same tools. See the Contractor Identity Lifecycle Guide.

How approaches reach staff

Approaches arrive through channels the employer does not control: encrypted messaging apps, social media direct messages, criminal forums, and posts on public channels advertising for "employees of" a named company or sector. In the reported Medusa case the first contact came over Signal, and when the target stalled, the target's phone was flooded with MFA push requests, an attempt to get an accidental approval. That escalation matters for defenders: an employee who declines or delays may be targeted with pressure or MFA fatigue next. Awareness training should cover this sequence explicitly, and the security team should treat a reported approach as an indicator that the reporter's accounts may be targeted.

Microsoft's DEV-0537 guidance recommends training staff to recognise and report unusual contacts, and making help desks hypervigilant about suspicious users. CISA's Insider Threat Mitigation Guide sets out a framework of defining, detecting and identifying, assessing and managing insider threats, scalable to an organisation's size and maturity.

Making a recruited insider less useful

Prevention aims to ensure that no single paid act gives an attacker much. The controls below map to the techniques recruiters buy.

Microsoft's guidance specifically advises requiring MFA for all users and locations, preferring FIDO tokens or authenticator apps with number matching, avoiding telephony-based factors because of SIM swap risk, and not storing work credentials in browsers or personal password vaults. The CSRB likewise recommends moving away from SMS and voice MFA to phishing-resistant, FIDO2-compliant methods. A device-bound passkey cannot be approved by an insider on someone else's behalf from a chat message, which removes the cheapest thing a recruiter buys. See the Phishing-Resistant MFA Guide and the MFA Fatigue and Bypass Guide.

Two-person control: for actions that convert directly into fraud (SIM swaps, payment detail changes, privileged account resets, bulk exports), require a second approver who is not chosen by the requester. This is NIST SP 800-53 AC-5 Separation of Duties applied to business operations.

Least privilege for support tools: build support consoles so that agents search for a customer only through a ticket, see masked fields by default and must justify unmasking. This is AC-6 Least Privilege expressed in application design, and it limits what a paid agent can copy.

Where identity fits

Recruited insiders sell identities: their own account, their MFA approval, or the ability to change someone else's credentials. Non-human identities are part of that market too. An engineer can be paid to create an API key, add a credential to a service principal or copy a deployment token, which then works long after the insider has gone and does not trigger MFA. Alert on new keys and application credentials created outside change windows, require ownership and expiry on every machine credential, and rotate the secrets an insider could reach when they leave or come under investigation. See the Insider Threat and Identity Guide and the Privileged Access Management Guide.

Detection: signals of collusion

Collusion is hard to detect because the insider uses legitimate access. Look for access that does not match work, and for the moment external and internal activity meet.

• Access without business need: records viewed with no linked ticket, customers outside the agent's queue or region, or sudden interest in high-value accounts. Coinbase's filing states its monitoring had independently detected access without business need in the months before the extortion email.
• Volume against peers: an agent who views far more records than colleagues on the same queue. Use peer group baselines rather than fixed thresholds. See the UEBA Guide.
• MFA approvals from unusual context: an approval seconds after a sign-in from an unfamiliar device, country or hosting provider, especially for a user whose own device was not active.
• New remote tools: remote management software appearing on a workstation without a change record. See Detecting RustDesk, MeshCentral and Tactical RMM Abuse.
• Screen capture and copy patterns: repeated screenshots or copy actions in support consoles, or photos of screens where policies allow monitoring of that behaviour.
• High-risk business actions clustered on one operator: several SIM changes, recovery resets or payout changes by the same agent in a short period, particularly for unrelated customers.

Monitoring must be lawful and proportionate. Agree it with legal, HR and employee representatives where required, state it in policy, and focus on access to sensitive systems rather than private behaviour. The Insider Threat Programme Guide covers governance and privacy in depth.

Reporting routes and culture

The cheapest detection is the employee who tells you they were approached. Make that easy:

• A named route: a mailbox, phone line or form for "I have been offered money for access", publicised in onboarding and annual training, with an option to report anonymously.
• No penalty for being approached: say clearly that being contacted is not misconduct, and thank people who report.
• Fast protective action: when someone reports, treat their accounts as likely targets: check recent sign-ins and MFA prompts, and watch for MFA fatigue attempts.
• Share indicators: pass recruitment adverts and contact handles to the threat intelligence function and, where appropriate, to law enforcement.
• Extend to suppliers: require BPOs and MSPs to run equivalent reporting routes and to tell you promptly when their staff report approaches about your account.

Responding to suspected collusion

1. Assemble the insider case team: security, HR, legal and, for contractors, supplier management. Keep the group small and need-to-know.
2. Preserve evidence quietly: export access logs, ticket records, MFA logs and endpoint telemetry before acting, so the insider is not tipped off into deleting data.
3. Scope: list every record, system and credential the insider accessed or could access, and look for peers on the same team showing similar patterns; recruiters often approach several people.
4. Contain: revoke sessions and access, rotate any secrets and keys the insider could reach, and remove any remote tools or persistence they installed.
5. Protect affected customers: warn them about impersonation, add verification to flagged accounts and monitor for fraud, as Coinbase described doing.
6. Assess notification duties: personal data exposure may trigger regulator and individual notification under applicable data protection and sector rules; legal decides.
7. Review controls: feed findings into access design, monitoring and supplier contracts.

See the Departing Employee Data Protection Playbook and the Insider Data Theft Guide for data-focused steps.

Measuring the programme

• Share of high-risk actions under two-person control: SIM changes, privileged resets, payout changes and bulk exports.
• Phishing-resistant MFA coverage: percentage of workforce and contractor accounts, and number of remaining SMS or voice factors.
• Record access with a business justification: percentage of sensitive record views linked to a ticket or case.
• Time from anomalous access alert to review: for support and privileged roles.
• Reported approaches per quarter: a rising number after training usually means reporting works, not that risk has grown.
• Supplier coverage: share of BPOs and MSPs with monitoring, log sharing and notification clauses in contract.

Common failure patterns

• Treating support staff as low risk: no admin rights does not mean no value; broad read access to customer data is exactly what the Coinbase insider breach exploited.
• Push MFA that anyone can approve: a recruited user can approve a prompt for an attacker in seconds; simple push and SMS remain the cheapest thing to buy.
• Third parties outside the programme: outsourced agents use your tools but sit outside your vetting, training and monitoring.
• Punishing people who report: staff who fear suspicion for being contacted stay silent, and the first sign becomes the extortion email.
• Containment that tips off the insider: disabling access before preserving logs and scoping peers loses evidence and the chance to find other recruits.
• Forgetting machine credentials: keys and tokens created by the insider survive account termination.

Framework mapping

Practitioner checklist

The checklist below sets out NHI Mgmt Group recommendations, drawn from the sources cited on this page.

• Identify roles with broad customer data access, account recovery powers or privileged access, including outsourced staff.
• Bind sensitive record access to open tickets and mask identity documents and financial fields by default.
• Move workforce and contractor accounts to phishing-resistant MFA and remove SMS and voice factors.
• Require two-person approval for SIM changes, privileged resets, payout changes and bulk exports.
• Alert on access without business need, peer-outlier volumes, new remote tools and new machine credentials.
• Publish a safe, no-blame route for reporting recruitment approaches and protect reporters' accounts.
• Put monitoring, log sharing and prompt notification clauses into BPO and MSP contracts.
• Run a collusion scenario in an insider risk tabletop exercise, including evidence preservation and peer scoping.

Standards and references

• CISA: Defining Insider Threats
• CISA: Insider Threat Mitigation Guide
• Cyber Safety Review Board: Review of the Attacks Associated with Lapsus$ and Related Threat Groups
• Microsoft Security: DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
• US SEC: Coinbase Global Form 8-K, May 2025
• NCC Group: Monthly Threat Pulse, December 2025
• NIST: SP 800-53 Rev. 5
• MITRE ATT&CK: Multi-Factor Authentication Request Generation

Related NHI Mgmt Group resources: Insider Threat Statistics Guide · Insider Threat Programme Guide · Insider Threat and Identity Guide · Lapsus$ Threat Actor Profile