Ransomware Gangs Are Now Paying Insiders to Unlock the Front Door
Criminal groups are bribing employees to hand over company access rather than hacking their way in. It is cheaper, faster, and harder to detect, and the insider threat problem is getting worse.
Key points
- Breaches tied to malicious insiders with elevated privileges cost organisations an average of $4.9 million per incident in 2026, according to SentinelOne.
- Organisations recorded a 42% rise in malicious insider incidents over the past year, per Mimecast's 2026 State of Human Risk report.
- Ransomware group LockBit 2.0 embedded insider recruitment pitches directly into ransom notes left on infected machines.
- A Medusa ransomware member offered BBC journalist Joe Tidy 25% of any ransom payout in exchange for access to his employer's network.
- Insiders on criminal forums have claimed payments of up to $15,000 for a single set of valid company credentials.
Breaking into a company used to mean finding a crack in its defences. Ransomware gangs are increasingly skipping that step and paying someone who already has the keys.
Security researchers and incident responders, speaking to Dark Reading, describe criminal groups actively recruiting employees and contractors, offering cash or a cut of the ransom in exchange for legitimate login credentials or system access. The tactic is not dominant yet, but it is gaining ground precisely because corporate defences elsewhere are improving.
How does an inside job actually work?
Sometimes an employee approaches criminals. Other times criminals do the approaching. Either way, attackers walk straight past the firewall, the VPN (a private tunnel companies use to protect remote connections), and every perimeter control security teams have spent years building.
Over 75% of unique posts from criminal insiders found on the dark web advertised existing access for sale, according to Flashpoint research published in July. Buyers are not hard to find.
Jamie Levy, senior director of adversary tactics at Huntress, describes cases where ransomware operators explicitly plant contacts inside target organisations. "We'll pay you to give us access," is a pitch she has heard used. Notorious group Scattered Spider, for example, bribed telecoms workers to perform SIM swapping, a scam where a victim's phone number is moved to a criminal-controlled device so attackers can intercept one-time login codes sent by text.
Money is one motivator. Anger is another.
What happens when a fired employee keeps their access?
Access that isn't revoked the moment someone leaves becomes a weapon. Justin Miller, a retired US Secret Service agent and now associate professor of cyber studies at the University of Tulsa, worked a case where an IT director was fired at 8 a.m. But told to finish his shift. Nobody cancelled his credentials. He came back at 2 a.m. And deployed malware, software designed to damage or disable systems, that locked the company's entire network.
"You don't want to piss off the guy who's in charge of your network," Miller told Dark Reading.
The fix sounds straightforward: when someone leaves, cut their access immediately. Levy recommends same-hour deprovision, meaning the moment an employee is let go, their single sign-on account (the one central login that opens all company tools), VPN, cloud access and code repositories are all shut off at once. That means revoking live session tokens, the digital passes that keep someone logged in even after a password is changed, not just resetting the password. We covered the gaps that make this harder than it sounds in our earlier look at how Workspace breaches typically begin.
| Metric | Figure | Source / Date |
|---|---|---|
| Average cost, malicious insider breach | $4.9 million per incident | SentinelOne, 2026 |
| Overall insider threat cost per organisation | $19.5 million per year | SentinelOne, 2026 |
| Rise in malicious insider incidents | 42% year-on-year | Mimecast, 2026 |
| Insider payment claims on criminal forums | Up to $15,000 per access set | Flare research |
| LockBit 2.0 recruitment method | Ransom notes and desktop wallpapers | Tenable research |
Should ordinary employees be worried?
If you work at a mid-to-large company, you may receive an approach you don't recognise as criminal. It might look like a job offer or an unusual message from someone claiming to be a consultant. The ask will seem small: a username, a temporary login, a screenshot of an internal tool.
Report anything that feels off. Recruitment attempts often fail because the targeted employee turns the criminals in, which is exactly what happened when a Medusa ransomware member approached BBC journalist Joe Tidy. Tidy played along long enough to document the scheme before exposing it publicly.
For organisations, the practical checklist is short: enforce multi-factor authentication (MFA, which requires a second proof of identity beyond a password) across every system, apply least-privilege access (give each person only the permissions their role actually needs), and treat offboarding as a security event that deserves the same urgency as a detected breach.
The blunt read on this trend: bribery scales more cheaply than zero-days, and until offboarding is treated as a hard security boundary rather than an HR formality, ransomware groups will keep finding willing sellers.
