Blogs

Blog

Insider Threat Report: Dark Web Recruitment & Access Trends

Flashpoint’s monthly analysis of insider threat recruitment, illicit access advertising, and threat actor activity targeting enterprise environments.

Unknowingly, a member of key personnel is living two separate lives. On the clock, they are a highly-trusted systems administrator, but in their personal time, they moonlight on the deep and dark web, advertising their trust and access to the highest bidder. One day, they get a simple offer: $15,000 in the crypto of their choice to approve a single push notification at 2 AM. They accept. By morning, the attacker walks away  with active domain admin credentials without the need for malware or cracking firewalls.

This is just one example of how insider threats lead to modern enterprise breaches. This year, Flashpoint uncovered 7,282 unique insider threat posts, with an average of 34 unique posts being posted daily. As perimeter security, EDR coverage, and other security tools mature, threat actors are finding it faster—and cheaper—to target the human element and simply buy an insider’s credentials or pay an employee to open the front door.

In a threat landscape where identity is becoming the primary attack surface, monitoring illicit marketplaces and recruitment efforts is critical. This new monthly report leverages Flashpoint’s Primary Source Collection (PSC) to analyze insider threat tactics, tracking active recruitment and advertising on dark web forums and encrypted networks.

The Insider Threat Landscape: July 2026

In July 2026, Flashpoint analysts identified a total of 12,653 insider posts. These communications include both threat actors attempting to recruit insiders in target organizations, as well as insiders advertising their services on illicit forums and marketplaces.

Of these total communications, Flashpoint observed 1,132 unique posts in July 2026.

Where Insider Threat Activity is Concentrated

Historically, the Telecommunications, Retail, and Financial industries are most adversely affected by insider threat activity. However, July 2026 findings noticeably deviate from this trend. Flashpoint found 58.6% of total insider threat posts affected “Other” industries—suggesting adversaries are diversifying their target base. Threat actors may be attempting to recruit within supply chain partners, logistic hubs, manufacturing platforms, and specialized service providers to find alternative entry points into target networks.

The following table shows a breakdown of unique insider posts by industry in July 2026:

Industry	Posts
Other	663
Financial	150
Retail	112
Technology	84
Telecom	74
Public Sector	43
Healthcare	3
Media	3
Total	1,132

Insider Threats: Recruiting vs. Advertising

Active insider threats work in two ways: an insider is “recruited” by a malicious outside party, or a malicious insider “advertises” their access and skills to an interested threat actor. Regardless, by leveraging this connection, insiders assist adversaries by exfiltrating valuable data, installing malware, sabotaging IT systems, or performing SIM swaps.

In July 2026, Flashpoint found that over 75% of unique threat actor posts came from insiders advertising their access to malicious third parties. This indicates a highly motivated internal threat landscape where disgruntled employees actively seek out buyers for corporate data and network entry points.

Protect Against Insider Threats Using Flashpoint

Insider threats are inherently difficult to detect using internal security controls alone because the malicious activity relies on valid credentials and legitimate access privileges. Relying solely on internal logs means security teams often only detect an insider threat after data exfiltration or system sabotage has already occurred.

Flashpoint protects organizations against insider threats through our Primary Source Collection (PSC) and specialized intelligence platforms:

• External Threat Intelligence & Early Warning: Flashpoint monitors deep and dark web forums, invite-only threat communities, and encrypted chat platforms to identify employee solicitations, stolen corporate domain mentions, and active recruitment attempts before an intrusion develops.
• Identity Protection & Infostealer Tracking: By tracking illicit marketplaces and infostealer activity, Flashpoint identifies compromised corporate credentials and active session tokens, preventing threat actors from utilizing purchased access.
• User & Entity Behavior Context: Flashpoint’s intelligence equips SOC, Security Operations, and Risk Management teams with adversary TTPs, enabling security operations to look for anomalous data downloads, off-hours access, or unauthorized software installation.

To learn more about how Flashpoint can help protect your enterprise from insider risk and monitor illicit underground communities, Request a Demo Today.

Frequently Asked Questions (FAQs)

What is the Flashpoint Insider Threat Report?

The Flashpoint Insider Threat Report is a monthly intelligence brief that analyzes trends, volume, targeted industries, and tactics surrounding insider threat recruitment and illicit access advertising on the deep web, dark web, and encrypted chat channels.

How does Flashpoint collect insider threat data?

Flashpoint collects data using its Primary Source Collection (PSC) engine, which actively monitors thousands of dark web forums, illicit marketplaces, and underground chat networks where threat actors and malicious insiders communicate.

What is the difference between insider recruitment and insider advertising?

Insider recruitment occurs when an external cybercriminal attempts to entice a corporate employee into assisting with a cyberattack. Insider advertising occurs when an employee or contractor proactively lists their legitimate access or services for sale on illicit marketplaces.

See Flashpoint in Action

Blogs

Blog

Understanding Illicit Ecosystems: How Dark Web Forums Structure Cybercrime

As part of our ongoing series, we analyze how dark web forums operate, breaking down Flashpoint’s tiered classification system and examining how specialized, hybrid platforms function together as an interconnected cybercrime supply chain.

When a high-profile data breach hits headlines, the default assumption is often to view the dark web as a single, centralized marketplace where any illicit service or tool can be bought. While many illicit forums aspire to be seen as a “one-stop shop,” the reality is that the underground economy relies on an interconnected network of specialized hubs that each align with distinct phases of the cybercrime lifecycle.

To understand how cybercrime thrives, it is vital to learn how these online spaces survive and how they play their parts in graduating threat actors from entry-level novices to sophisticated adversaries.

Navigating the Cybercrime Ecosystem: Entry Barriers and Forum Tiering

An illicit community’s survival hinges on its operational value and culture, which is ultimately created by its supporters. In a low-trust environment filled with cybercriminals, hidden law enforcement, and security researchers, these digital spaces are inherently defensive. To protect their communities from competitors’ attacks, surveillance, and eventual takedowns, forums implement rigorous gatekeeping mechanisms.

As such, Flashpoint organizes the cybercrime ecosystem into a tiered structure, separating them into low, mid, or top-tier forums, defined by several key factors such as: 

• Entry Barriers: The financial or reputational requirements for a user to join the community, indicating the forum’s exclusivity.
• Technical Expertise: The collective technical skills and proficiency of the forum’s members.
• Trade Quality: The quality and value of illicit goods and services exchanged, such as advanced hacking tools or high-value data leaks.
• Operational Security (OP SEC): The extent to which the community upholds strict security protocols and practices.

By analyzing these vectors, the ecosystem naturally separates into three distinct operational tiers.

Low-Tier Forums

These communities are easily accessible, often requiring a small fee or completely free registration with little to no vetting. They host less sophisticated users, beginner hackers, and minor data brokers seeking free material. Because the technical barrier is low, these spaces primarily share low-cost, high-volume data, including large data leaks, generic phishing guides, unchecked stolen accounts, and cracked software.

Consequently, these environments face a persistently high risk of scams and poor quality data. Within low-tier forums, reputation is often built by sharing free data or purchasing a rank or upgrade which is viewable by other users.

Mid-Tier Forums

Moderately accessible via both Tor and the clearnet, entry into these spaces typically require a vouch from an existing member, a minimal registration fee, or an initial deposit. These platforms concentrate on large-scale fraudulent activity and the exchange of various datasets—including bulk carding data, stolen credentials, stealer logs, phishing kits, botnets, and various malware.

The user base includes a mix of vendors, experienced threat actors, affiliates of larger groups, and aspiring cybercriminals looking for training. To protect users from internal fraud, these forums heavily prioritize integrated escrow services and reputation systems, which can be improved by purchasing an internal high-tier status.

Top-Tier Forums

These are highly exclusive platforms dedicated to high-value, highly technical, and targeted criminal operations. New applicants face a stringent vetting process, typically demanding either a formal invitation or a substantial registration payment. This exclusive layer hosts highly skilled, professional threat actors, malware developers, and key decision-makers within major illicit groups.

This is the ecosystem where adversaries build trust through valuable technical contributions or community reputation points and execute complex money laundering schemes, trade zero-day exploits, facilitate ransomware-as-a-service (RaaS) partnerships, and conduct large-scale initial access broker sales.

What Are the Different Types of Dark Web Forums?

Once a community establishes its tier, it usually functions as a specialized hub linked to a specific stage in the overall cybercrime lifecycle. They do this to cultivate talent and expertise, which naturally bridges communities together, creating a supply chain where different forums handle distinct operational and structural needs.

General Information and Community Boards

Modeled after surface-web sites like Reddit, these platforms serve as social and informational hubs. Discussions prioritize coordination, reputation management, and the propagation of best practices regarding OPSEC. Users share news about cybercriminal arrests, look for advice on how to remain anonymous, report potential exit-scams, and provide detailed reviews of specific vendors, particularly those selling illicit drugs.

Financial Theft and Carding Forums

These semi-structured environments blend marketplaces with social networks, utilizing a professionalized supply chain for selling stolen cards, dumps, and fullz. To reduce internal fraud, they rely heavily on reputation-building tools like verified seller statuses and integrated refund systems for invalid data. To ensure operational longevity, they are typically hosted on bulletproof infrastructure located in states that do not comply with international takedown requests, such as the Russian Federation.

Data Leak Forums

Depositories for stolen databases where raw breach information is structured into a tradeable commodity. Leaks are listed by victim name and sector, allowing actors to quickly find credentials or corporate records to repurpose for credential stuffing, extortion, or identity fraud.

Cracking and Hacking Tutorials (Knowledge Bases)

Existing entirely for knowledge exchange and offensive techniques, threat actors share methods, tutorials, fraudulent schemes, and bypass techniques, often encouraging educational sharing through competitions.

High-Skill Exploit and Access Forums

Top-tier platforms hosting the “upper echelons” of the community, such as initial access brokers, exploit developers, and malware creators. They rely heavily on strict arbitration systems, mandatory vendor deposits, and escrow mechanisms to safely conduct high-impact transactions and corporate intrusions.

Low-Barrier Retail Forum

High-traffic segments trading mass-market digital goods like cracked subscription accounts, premium software, and online gaming assets. Characterized by an exceedingly low barrier to entry and a relatively young user base seeking quick profit without the capability for advanced, complex operations.

Map the Illicit Pipeline Using Flashpoint

What makes the cybercriminal ecosystem truly cohesive is that the lines between these various types of forums and communities constantly blur. Most illicit communities are hybrid and transitional, intentionally or naturally blending categories to cater to each other’s needs and boost monetization.

Hybrid forums frequently connect the how-to tutorials with actual stolen data and network access, effectively creating a structural pipeline for threat actor progression. Platforms like BreachForums combine the attention-grabbing aspect of a data leak site with a structured marketplace for selling logs and other sensitive data. This type of hybridization allows a threat actor to progress from a beginner reading tutorials to an active criminal deploying stolen data.

Monitoring these fluid structures and transitions is the only way to understand how threat actors develop, and how the interconnected cybercrime landscape shifts over time. Therefore, it is essential for security teams to look beyond cyber threats as isolated, and recognize the multi-platform strategies these actors employ. Request a demo to gain visibility into these threat actor communities and proactively defend your organization from across the entire cybercrime supply chain.

Check out the rest of our “Understanding Illicit Ecosystems” series:

Understanding Illicit Ecosystems: The Hybrid Threat of “The Com”

Understanding Illicit Ecosystems: XSS and the Current State of the Russian-Speaking Underground

Understanding Illicit Ecosystems: Weaponizing Mainstream Apps and Social Infrastructure

See Flashpoint in Action