Loading story…
Ransomware groups are increasingly seeking employees, contractors, and business partners who can provide valid credentials, network access, or sensitive data, as stronger perimeter defenses make external intrusion more difficult. Dark-web recruitment activity reflects demand for access to high-value organizations, though insider assistance remains a less common initial-access method than other intrusion routes.
Organizations face elevated exposure where offboarding is delayed, privileges are excessive, and access by third parties is insufficiently controlled. Security teams should rapidly deprovision departing personnel, enforce least privilege, MFA, and privileged-access controls, protect backup and hypervisor administration, and monitor endpoints and anomalous access while encouraging employees to report mistakes or suspicious approaches promptly.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Flashpoint reported that more than 75% of unique threat-actor posts it examined on the dark web came from insiders advertising access to malicious third parties.
Mimecast's State of Human Risk 2026 reported that organizations experienced a 42% year-over-year increase in malicious-insider activity.
SentinelOne reported that insider threats cost organizations $19.5 million annually on average in 2026, with negligent insiders accounting for 56% of incidents. It also reported an average $4.9 million cost for incidents involving malicious insiders with elevated privileges.
Christopher Dobbins was sentenced to federal prison for hacking his former medical-packaging employer and sabotaging its electronic shipping records. The sabotage caused more than $200,000 in damage and delayed COVID-19 personal protective equipment shipments.
LockBit 2.0 reportedly used ransom notes and desktop wallpapers to seek insider recruitment, requesting VPN, Remote Desktop Protocol, and email credentials.
Scattered Spider was cited as having bribed telecommunications employees to facilitate SIM-swapping attacks against targeted users.
Coalition investigated a malicious-insider case in which an employee allegedly siphoned victim funds into a personal bank account.
A fired IT director reportedly retained credentials after leaving an organization and later deployed malware that locked down its systems.
An alleged Medusa ransomware-as-a-service member offered BBC World Service correspondent Joe Tidy 25% of a ransom payment in exchange for access to his computer, seeking secret access to the BBC corporate environment.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent report by insurance specialist Hiscox reveals that ransomware attacks continue to pose a significant threat to businesses, with 27% of 5,750 surveyed small and medium-sized enterprises (SMEs) targeted by ransomware in the past year. Of those affected, 80% paid the ransom, yet only 60% managed to recover all or part of their data, highlighting the unreliable nature of ransom payments as a recovery strategy. The report also notes that nearly a third of companies that paid were subsequently met with additional demands for more money, compounding the financial and operational risks. The impact of these attacks is severe, with some high-profile companies such as Marks and Spencer, the Co-op, and Jaguar Land Rover (JLR) experiencing significant disruptions. JLR, for example, received a £1.5bn government loan guarantee to protect its supply chain after a month-long factory shutdown. Many SMEs, lacking such support, face existential threats from ransomware incidents, with some already forced to lay off staff. The study also points to vulnerabilities introduced by artificial intelligence as a contributing factor to the rise in successful cyber attacks. In parallel, ransomware gangs are evolving their tactics, as illustrated by the Medusa ransomware group's attempt to recruit a BBC journalist as an insider. The gang offered the journalist a substantial share of any ransom paid if he provided access to the BBC's internal systems, with the promise of anonymity and references to previous successful insider-assisted attacks. Medusa, active since 2021, is known for double-extortion tactics and has been linked to over 300 attacks on critical infrastructure in the United States, according to CISA. The group typically recruits initial access brokers via cybercrime forums and darknet marketplaces, focusing on leveraging insider threats and post-compromise extortion. The incident involving the BBC journalist underscores the increasing sophistication of ransomware groups in targeting not just technical vulnerabilities but also human factors within organizations. These developments highlight the urgent need for organizations to strengthen both their technical defenses and insider threat detection capabilities. The financial and reputational risks associated with ransomware are escalating, with attackers employing a mix of extortion, social engineering, and exploitation of emerging technologies. The Hiscox report and the Medusa case collectively demonstrate that paying ransoms does not guarantee data recovery and may even invite further extortion. Organizations are advised to invest in comprehensive cybersecurity measures, employee awareness training, and robust incident response plans to mitigate the growing threat landscape. The trend of targeting SMEs, which often lack the resources of larger enterprises, suggests that all organizations, regardless of size, are at risk. The evolving tactics of ransomware groups, including the recruitment of insiders, represent a significant challenge for security teams and require a multi-layered approach to defense.
Jun 29, 2026
Zscaler ThreatLabz reported that a real-world ransomware campaign disproportionately compromised employees with business authority rather than only users with obvious technical privilege. In a one-month sample tied to a single ransomware operation, researchers identified **351 victims across 334 organizations**, with **62%** of victims holding manager-level titles or higher. The campaign was linked to a group known for gaining initial access, stealing large volumes of corporate data, and selectively encrypting critical systems. The victim set was concentrated in functions that can unlock sensitive business processes: roughly **75%** worked in accounting and finance, sales, operations, human resources, or marketing, while **50%** were in industrials or information technology. ThreatLabz said these roles can expose payments, contracts, vendor relationships, sensitive records, and cross-business communications that help attackers move laterally and increase extortion pressure. The researchers said organizations should tighten external collaboration controls, strengthen impersonation-focused training, deploy inline network and endpoint detection, monitor for compromise, enforce least privilege, and apply **Zero Trust** segmentation.
Aug 11, 2026
Ransomware operators are increasingly leveraging legitimate remote access tools (RATs) such as AnyDesk, Splashtop, UltraViewer, AppAnywhere, RustDesk, CloneDesk, and TightVNC to facilitate their attacks and bypass traditional security measures. These tools, originally intended for IT administration and remote support, are being misused by cybercriminals to gain persistent, stealthy access to victim networks. Attackers exploit the fact that these RATs are often whitelisted and trusted within enterprise environments, allowing them to evade endpoint detection and response (EDR) solutions and other security controls. The use of legitimate RATs enables adversaries to connect to compromised systems without user interaction, transfer malicious binaries, exfiltrate sensitive data, and execute administrative tasks remotely. Encrypted communications provided by these tools further help attackers avoid network monitoring and detection. Security researchers have observed a trend where ransomware gangs prefer these off-the-shelf RATs over custom malware, as their legitimate signatures and widespread use make them less likely to raise suspicion. The abuse of these tools is often facilitated by poor configuration, lack of monitoring, or inadequate management within organizations. Once inside a network, attackers use RATs to move laterally, harvest credentials, and disable security defenses before deploying ransomware payloads. The sophistication of these campaigns has increased, with adversaries employing advanced evasion techniques and maintaining long-term persistence. Organizations are advised to review their use of remote access tools, ensure proper configuration, and monitor for unusual activity associated with these applications. Security teams should also consider implementing stricter application whitelisting and network segmentation to limit the potential impact of RAT abuse. The trend highlights the need for continuous vigilance and updated security policies to address the evolving tactics of ransomware operators. The exploitation of trusted IT tools for malicious purposes underscores the importance of balancing operational convenience with robust security oversight. As ransomware attacks continue to evolve, defenders must adapt their detection and response strategies to account for the abuse of legitimate software. The growing reliance on RATs by threat actors represents a significant challenge for organizations seeking to protect their networks from ransomware threats. Proactive monitoring, user education, and regular security assessments are critical components in mitigating the risks associated with the misuse of remote access tools. Failure to address these vulnerabilities can result in significant data loss, operational disruption, and financial damage due to ransomware incidents.
Jul 12, 2026