ZeroFox Intelligence Flash Report - Campaign to Recruit Cryptocurrency Insiders

ZeroFox Intelligence Flash Report - Campaign to Recruit Cryptocurrency Insiders

Product Serial: F-2026-02-06b

TLP:CLEAR

In this Flash report, ZeroFox researchers report on a recent campaign posted on the popular dark web forum Exploit seeking potential partners to recruit insiders within large cryptocurrency exchanges—preferably those from “third-world” countries.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• A newly registered and untested threat actor known as “LocalVulture” posted on popular dark web forum Exploit seeking potential partners to recruit insiders within large cryptocurrency exchanges—preferably those from “third-world” countries.
• Notably, the actor provided a guidance manual and numerous specific suggestions on how to approach and profile prospective insiders. ZeroFox assesses this is a change in previously observed tactics that is likely to reinvigorate long-standing efforts among financially motivated threat actors to infiltrate and target major cryptocurrency exchanges.
• In the post, LocalVulture shared three categories of insider individuals recruitment partners should target. It is likely that the actor has identified these categories in order to exploit financially motivated and inexperienced crypto exchange employees that may be more easily swayed to provide insider knowledge.
• LocalVulture specifies that, after identifying suitable insider targets for recruitment, partners are expected to rely on social engineering techniques to establish and maintain effective communication. ZeroFox assesses this indicates the actor is interested in conducting more sophisticated operations beyond financial fraud, such as ransomware deployment, data extortion, and cyber espionage.