Threat reportThreat IntelligenceTL-2026-3595
Insider Threat Report: Dark Web Recruitment & Access Trends (Flashpoint)
Insider Threat Report (TL-2026-3595) is a medium-severity tracked intrusion set, first published 2026-10-15. It has no confirmed attribution, affects Multiple Enterprise identity and access systems (cross-industry, maps to 8 MITRE ATT&CK techniques (T1005, T1078, T1078.002), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3595
- Threat ID
- TL-2026-3595
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, retail, technology, telecoms, public-sector, health, news - media
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Insider Threat Report
Malware and tooling: Infostealers (family unspecified), telegram
How Insider Threat Report works
Flashpoint reports 7,282 unique insider threat posts over the past year (~34 per day) on dark web forums and encrypted chat platforms, including 1,132 unique posts (12,653 total) in July 2026. More than 75% of unique posts were insiders proactively advertising their own access rather than being recruited by external actors.
Flashpoint's Primary Source Collection (PSC) monitors deep and dark web forums, illicit marketplaces, invite-only threat communities and encrypted chat networks for insider-related activity. Its August 2026 report counts 7,282 unique insider threat posts over the reporting period (about 34 per day). In July 2026 alone it identified 12,653 total insider posts, of which 1,132 were unique. Flashpoint distinguishes two modes: recruitment, where external threat actors entice employees to take part in cyberattacks, and advertising, where employees proactively list legitimate access or services for sale. More than 75% of unique posts were of the advertising type.
The report states that insiders are being used to exfiltrate data, install malware, sabotage IT systems and perform SIM swaps. One cited example is an offer of $15,000 in the crypto of the buyer's choice to approve a single push notification at 2 AM, which yielded domain administrator credentials. Buying legitimate access bypasses perimeter controls, EDR and other technical defenses, because the activity originates from a valid, authorized account.
By industry, July 2026 posts split as: Other 663 (58.6% of total insider posts), Financial 150, Retail 112, Technology 84, Telecom 74, Public Sector 43, Healthcare 3, Media 3. Corroborating reporting provides longer-term context. Flashpoint's 2022 year-in-review recorded 109,146 insider recruiting/advertising posts (22,985 unique) across 3,964 Telegram and other channels, with LAPSUS$ and LockBit named as recruiters and telecom, retail and financial services as the most exposed sectors. A January 2026 article citing Flashpoint data counts 91,321 insider recruitment, advertising and discussion instances in 2025 (42% telecom), 10,475 channels and 17,612 unique authors; it describes Telegram as the primary hub and expects activity to shift toward Signal as bans on illicit groups continue. Telecom employees are the most frequent sellers of access, while technology and financial sectors show higher buyer demand, making carriers a stepping stone via SIM swap and identity theft. CYFIRMA (January 2026) describes the Scattered Lapsus$ Hunters collective recruiting insiders for AD-joined systems (25% commission), Okta, Azure Portal and AWS IAM root credentials (10% commission), and VPN/VDI/Citrix/AnyDesk access. Those links are context only; the Flashpoint 2026 report names no actors, malware families or specific forums.
Flashpoint's recommended defensive posture is to monitor dark web forums and encrypted networks for mentions of the organization, track infostealer activity and compromised credentials, and analyze anomalous user behavior with user and entity behavior context. This is a trend report: no CVEs, CVSS scores, network IOCs or hashes are provided. Severity MEDIUM is an analyst judgment.
MITRE ATT&CK techniques used in TL-2026-3595
Collection
Initial Access
T1078 Valid Accounts; T1199 Trusted Relationship
Persistence
Privilege Escalation
T1078.002 Valid Accounts: Domain Accounts
initial-access
Impact
Credential Access
T1621 Multi-Factor Authentication Request Generation
Resource Development
Affected products and versions in Insider Threat Report
- Multiple — Enterprise identity and access systems (cross-industry exposure)
Remediation for Insider Threat Report
Immediate actions
- Monitor dark web forums and encrypted chat platforms (e.g. Telegram) for posts offering or soliciting access to your organization
- Review and tighten approval workflows for MFA push notifications; require number matching or phishing-resistant MFA for privileged accounts
- Audit privileged and domain administrator accounts for anomalous logons and recent credential changes
Workarounds
- Require out-of-band verification and dual approval for high-risk actions such as SIM changes, credential resets and privileged access grants
Longer-term hardening
- Deploy user and entity behavior analytics to flag anomalous access, bulk data access and exfiltration by authorized users
- Track infostealer activity and compromised credentials tied to employee and contractor identities
- Apply least privilege and separation of duties for sensitive systems, SIM/telecom provisioning and help desk functions
- Establish a formal insider risk program with HR, legal and security collaboration
Timeline of Insider Threat Report
- Flashpoint publishes its 2022 insider threat year-in-review: 109,146 insider recruiting/advertising posts (22,985 unique) across 3,964 channels; Telegram the primary platform; LAPSUS$ and LockBit named as recruiters
- Start of the roughly 12-month window in which Flashpoint counted 7,282 unique insider threat posts (about 34 per day) on dark web forums and encrypted chat platforms
- Public reporting describes a Telegram channel combining the brands of Scattered Spider, LAPSUS$ and ShinyHunters, associated with insider and access recruitment (context, not named in the Flashpoint report)
- CYFIRMA publishes research on the Scattered Lapsus$ Hunters resurgence, describing commission-based insider recruitment (25% for AD-joined systems, 10% for Okta/Azure/AWS IAM root) in closed Telegram clusters (context)
- Telecoms Tech News, citing Flashpoint, reports 91,321 insider recruitment/advertising instances in 2025 (42% telecom), 10,475 channels and 17,612 authors; Telegram the main hub and Signal expected to grow (context)
- July 2026: Flashpoint identifies 12,653 total insider posts, 1,132 of them unique; Other 663, Financial 150, Retail 112, Technology 84, Telecom 74, Public Sector 43, Healthcare 3, Media 3
- End of the July 2026 measurement period; over 75% of unique posts were insiders advertising their own access
- Flashpoint publishes 'Insider Threat Report: Dark Web Recruitment & Access Trends' citing a $15,000 crypto offer for approving a single push notification at 2 AM that yielded domain admin credentials
Sources cited for Insider Threat Report
- Insider Threat Report: Dark Web Recruitment & Access Trends
- Risk Intelligence Year in Review: Insider Threat (Flashpoint)
- Are employees to blame for rise in insider access threats? (TechRadar)
- Insider Threats: Turning 2025 Intelligence into a 2026 Defense Strategy (DRJ)
- Protecting assets against threat actors targeting telecoms (Telecoms Tech News)
- Resurgence of Scattered Lapsus$ Hunters (CYFIRMA)
- Trinity of Chaos: LAPSUS$, ShinyHunters and Scattered Spider alliance (Resecurity)
- MITRE ATT&CK T1078 Valid Accounts
Detection coverage for TL-2026-3595
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3595 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.