Threat Intelligence

Ransomware Gangs Turn to Insider Recruitment as Outside Defences Improve

Dark Reading · 2 Sept 2026

Key Takeaway Review who has access to sensitive systems and data, and put monitoring in place to catch unusual insider activity before it leads to a breach.

Security researchers have observed a rise in ransomware attacks that involve help from insiders — employees or contractors who provide access, credentials, or information to attackers in exchange for payment or under coercion. This shift appears to be a direct response to improved perimeter and endpoint defences, which have made purely external attacks harder to pull off.

Insider-assisted attacks are particularly dangerous because they bypass many traditional security controls designed to stop outsiders. A trusted employee with legitimate access can hand over credentials, disable security tools, or provide a foothold that would otherwise take attackers weeks to establish. Beyond ransomware, malicious insiders more broadly have been linked to costly incidents, including data theft and fraud, making this a threat category that extends well past any single attack type.

For small and medium businesses, this trend is a reminder that cybersecurity isn't just about firewalls and antivirus software — it's also about people and processes. Limiting access based on role, monitoring for unusual account activity, and fostering a workplace culture where employees feel able to report suspicious approaches can all reduce the risk of insider-assisted attacks.

Summarised by CISO AI from Dark Reading. We link back to every original so you can read it yourself.