Criminal recruiters price insiders by the workflow they control, Intel 471 finds

Each role on the target list can produce a result an outside attacker would otherwise have to work hard to get around, according to Intel 471 ^[8]. A support agent can reset an account ^[8]. A carrier employee can swap a SIM, a logistics worker can hold or reroute a package, and a moderator can unban a profile ^[8]. Each of those outcomes can be sold again across separate transactions ^[8]. The July buyer hunting for a crypto exchange insider did not want credentials or a database, Intel 471 wrote. The buyer wanted the person who controls the workflow ^[3].

Privileged-user programs still cover real demand. IT administrators remain wanted, per Intel 471, but they share the list with KYC personnel, bank tellers, customer support agents, moderation teams, logistics employees and verification staff ^[7]. Intel 471 says many insider risk programs are scoped around privileged users and argues its data justifies extending that scope to support, logistics, moderation, finance and verification staff ^[15]. A program that watches only admins is covering part of the demand and missing the desks where outcomes are sold ^[7][15].

The weaker assumption is the disgruntled employee. Intel 471 calls that image out of date and says today's insider is often recruited, not self-motivated ^[16]. A grievance indicator has nothing to find in the carrier placement case, where recruits were asked to apply for jobs and then run the swaps ^[4]. North Korean IT workers hired under false identities follow the same pattern, and Intel 471 says they are only one part of it ^[17].

Transportation appeared in 22% of leads, technology in 20% and telecommunications in 18% ^[9]. FedEx and UPS between them account for as many as 18 of the 85 leads, about 21%. That count is a ceiling, because a single lead could name both ^[1]. Intel 471 attributes the concentration to demand for repeatable operational workflows, not to sector size ^[11]. Other sellers skip access entirely. They offer lookups and account recovery across major telecom, social media, e-commerce and payment platforms, with tiered pricing and escrow ^[13]. I'd read escrow and price tiers as signs of repeat business ^[13].

Intel 471 states the limits itself. The sample is 85 leads from 80 actor handles, collected between Aug. 25, 2025, and Aug. 23, 2026, on criminal forums, Telegram groups, messaging platforms and marketplaces ^[1]. An advertisement does not prove a genuine insider exists or that the capability works, the firm says ^[14]. The paper measures demand, before anything has necessarily happened inside a victim organization ^[18]. It does not measure how many employees accepted ^[14][18].