Criminals on underground forums are actively recruiting employees at delivery companies, telecom carriers and technology firms to look up customer data, change accounts, carry out SIM swaps and tamper with shipments, according to a new report from threat intelligence firm Intel 471, Help Net Security reported Friday. FedEx and UPS were the companies mentioned most often in the records the firm analyzed.

What Happened

The report, titled "Insiders for Hire: Underground Recruitment, Access Claims and Insider-Enabled Services," draws on 85 underground records. Recruitment posts were the largest group at 45. Another 15 records involved claims of existing insider capability, 11 of them claims of insider access, and 12 advertised services that relied on an insider. The remainder included offers of access or data, recruitment guides and complaints.

By sector, transportation accounted for 19 leads, most of them about locating or rerouting shipments and changing records. Technology had 17, centered on internal user data, account administration, content moderation and privileged enterprise access. Telecommunications had 15, focused on SIM swaps, subscriber lookups and account resets used for fraud. Another 26 leads were cross-sector or could not be assigned.

RelatedDealership IT Vendor Reports Attack Surge, Says MFA Was in Place When Logins Were Stolen

FedEx and UPS appeared nine times each. Instagram was named four times, and DoorDash, Facebook, Meta, Verizon and eBay three times each. AT&T, Apple, LinkedIn, PayPal, Santander, T-Mobile and UAB Urbo Bankas were each mentioned twice.

How the Deals Work

The criminals offered several payment structures: fees for each action performed, one-time sales of data or access, referral and recruitment commissions, revenue sharing and longer-term arrangements. To manage trust between criminals and insiders, the report found, deals used escrow services, staged payments and verification requirements.

Recruitment took several forms, including open solicitations on forums, targeted approaches to specific employees, referrals, brokers who match buyers with insiders, partnership offers and deception. In some cases, Help Net Security reported, actors sought people who would apply for jobs at a target organization and misuse their privileges once hired.

Why It Matters

Insiders can bypass the technical controls companies rely on to stop outside attackers. An employee at a carrier who can move a phone number to a new SIM card can defeat text-message verification for that customer's bank and email accounts. A staff member with account administration rights at a social platform can hand over or reset accounts without any password being stolen. In logistics, an insider who can redirect a package or alter a delivery record makes cargo theft far easier.

The report's central point, as Help Net Security summarized it, is that ordinary job functions are what is being sold. Intel 471 wrote that "routine actions" such as information lookups, account resets, transaction approvals and shipment changes can become services sold to criminal customers. That makes the problem hard to address with perimeter security alone, since the insider is using permissions the job legitimately requires.

The ranking of FedEx and UPS above any social platform or carrier also shows that the market is not limited to account takeover. Shipment manipulation, the main ask in transportation, gives criminals a route to physical goods rather than data.

What to Watch

Help Net Security's summary did not include specific recommendations from Intel 471. The findings point companies in the named sectors toward closer monitoring of high-risk actions such as SIM changes, account overrides and shipment reroutes, and toward watching for signs that employees are being approached on social media or forums. Hiring checks may also get more attention given the reports of criminals trying to place recruits inside target companies.