Intel 471 found recruitment in 45 of 85 underground insider records, with criminals paying brokers and referrers to find staff. The work on sale is routine, such as account resets and shipment changes, done under access that sidesteps controls built for outsiders.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
Intel 471 tracked a $50,000 bounty for an introduction to a crypto exchange's KYC or compliance employee in a year of underground insider ads. Admins are still wanted, but so are support agents, tellers and logistics staff that many insider programs leave out.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+20
- Incentives60
- Confidence45
SANS's 2026 hunting survey found 72.7% of hunters who caught nation-state actors saw them living off the land, against 63.4% for ransomware crews. Hunters rank data quality as their top barrier, so detecting misused admin tools starts with the telemetry those hunts depend on.
Reality
- Evidence50
- Adoption45
- Hype gap+10
- Incentives60
- Confidence50
Intel 471's 18-month sweep of the underground counted 340 financial-sector extortion victims across 74 countries, 159 firms with access for sale and 562 claimed DDoS attacks. The dated intrusions came in through vendors and help-desk calls.
Reality
- Evidence40
- Adoption55
- Hype gap+22
- Incentives78
- Confidence47
Intel 471 found an unauthenticated panel called AppPanda running fake streaming lures behind paid Facebook ads, with affiliate tooling that re-signs the Android payload every hour and tracks ad spend the way a growth team would.
Reality
- Evidence64
- Adoption74
- Hype gap+15
- Incentives58
- Confidence56
Intel 471 says sanctions thinned the top tier of criminal hosting and upstarts filled the gap. The practical effect is that each takedown and each ASN block now covers less of the market.
Reality
- Evidence55
- Adoption58
- Hype gap+12
- Incentives68
- Confidence52