Loading story…
A group of outsourced staff at Ubisoft were bribed by cybercriminals, leading to the compromise and sale of the company's most valuable intellectual property. This incident highlights the growing risk of insider threats, particularly when external contractors are targeted by threat actors seeking privileged access to sensitive assets. The breach underscores the importance of robust vetting and monitoring of third-party personnel, as well as the need for strong internal controls to detect and prevent insider collusion.
In a related trend, cybersecurity professionals themselves have admitted to acting as affiliates for the BlackCat ransomware group, leveraging their technical expertise to facilitate attacks. These revelations demonstrate the increasing willingness of individuals with legitimate access and skills to collaborate with cybercriminal organizations, either for financial gain or under coercion. The convergence of insider threats and professional expertise within cybercrime operations poses a significant challenge for organizations seeking to defend against sophisticated, multi-vector attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cybersecurity professionals were reported to have admitted moonlighting as affiliates for the BlackCat ransomware group, exposing an insider threat within the cybersecurity industry. The case underscored how trusted individuals with legitimate access and expertise can participate in ransomware operations.
A cybersecurity incident involving Ubisoft was reported in which outsourced personnel were allegedly bribed by cybercriminals and gave access to highly valuable internal assets described as the company's 'crown jewels.' The report highlights a third-party insider threat affecting Ubisoft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly targeting employees within banks, telecommunications companies, and technology firms, offering substantial payments in exchange for insider access to sensitive systems and data. Recent research by Check Point highlights that these recruitment efforts are conducted via darknet forums, with payouts ranging from $3,000 to $15,000 for one-time access or specific information, and even higher for particularly valuable data such as large cryptocurrency exchange records. The campaigns specifically name high-profile organizations, including major banks, cryptocurrency exchanges like Coinbase and Binance, and tech giants such as Apple and Samsung, as well as cloud service providers and consulting firms. Insiders are being solicited to provide network access, leak credentials, disable security defenses, or facilitate attacks such as SIM-swapping, which can be used to bypass two-factor authentication. The recruitment tactics often employ emotional manipulation, promising financial freedom and long-term arrangements, with some offers including weekly payments for ongoing cooperation. The financial sector remains a primary target due to the direct access to funds and customer data, but the threat extends to other industries, including telecommunications and technology, where employees can enable attacks on infrastructure and user accounts. These developments present a significant security challenge, as insider threats are more difficult to detect and mitigate compared to external attacks, and highlight the need for organizations to strengthen internal monitoring and employee awareness programs.
Jun 29, 2026
Three former employees of cybersecurity firms DigitalMint and Sygnia have been indicted for orchestrating a series of BlackCat (ALPHV) ransomware attacks against five U.S. companies between May and November 2023. The accused, including Kevin Tyler Martin and Ryan Clifford Goldberg, allegedly abused their positions as incident response professionals to gain unauthorized access to victim networks, deploy ransomware, steal sensitive data, and demand cryptocurrency ransoms ranging from $300,000 to $10 million. The Department of Justice and FBI state that the group operated as BlackCat affiliates, with at least one successful extortion resulting in a $1.27 million payment from a Tampa medical device manufacturer after its servers were encrypted. The indictment details additional targets, including a Maryland pharmaceutical company, a California doctor's office, a California engineering firm, and a Virginia drone manufacturer, though it is unclear if further ransom payments were made. DigitalMint and Sygnia have both denied organizational involvement, terminated the implicated employees, and are cooperating with law enforcement. The case highlights the risk of insider threats within cybersecurity firms and the sophisticated tactics used by ransomware operators to exploit trusted access for criminal gain.
Jun 29, 2026
Organizations are facing a growing risk from insider threats, as cybercriminals increasingly exploit both the hiring process and employee online behavior to gain unauthorized access to sensitive data. Attackers are now impersonating cybersecurity and IT professionals, using fabricated resumes, deepfake technology, and stolen identities to secure legitimate positions within companies. Once inside, these "fake workers" can access confidential databases and systems, often leveraging remote work vulnerabilities and sophisticated obfuscation techniques such as VPNs and proxy servers to mask their true origins. At the same time, employees' tendency to overshare on professional and social platforms like LinkedIn, GitHub, and X provides threat actors with valuable intelligence. Publicly available information about job roles, internal relationships, technical stacks, and even travel plans can be weaponized for spearphishing, business email compromise, and other targeted attacks. The combination of lax vetting in remote hiring and excessive online disclosure significantly increases the attack surface, making it easier for adversaries to infiltrate organizations and execute sophisticated social engineering campaigns.
Jun 29, 2026