MFA Fatigue and Million-Dollar Bribes: The New Face of Insider Threats

Editor’s Note: Insider recruitment has gone operational. This on-the-record account from BBC cybersecurity correspondent Joe Tidy shows how a Medusa-linked actor dangled life-changing money, then pivoted to MFA-fatigue coercion when persuasion stalled. For cybersecurity, information governance, and eDiscovery leaders, it’s a timely reminder to treat outreach attempts as incidents to contain, not curiosities to observe. Build cross-functional insider-risk programs (HR, Legal, IT, Security), harden authentication with phishing-resistant methods and number-matching, and preserve evidence across chat apps and identity logs. The takeaway is simple and urgent: attackers target perceived access, so every employee is in scope—and speed of detection and response is the new differentiator.

Industry News – Cybersecurity Beat

MFA Fatigue and Million-Dollar Bribes: The New Face of Insider Threats

ComplexDiscovery Staff

When a cybercrime message arrived in BBC correspondent Joe Tidy’s encrypted Signal app in July 2025, it carried the kind of proposition that would test every journalist’s ethical boundaries. “You’ll never need to work again,” promised the shadowy figure known as “Syndicate,” offering millions of dollars for something that should have been unthinkable: betraying his employer from within.

The unsolicited message represented something far more sinister than a simple bribe attempt—it illuminated the sophisticated machinery of insider threat recruitment that has become one of cybercrime’s fastest-growing enterprises. What began as a 15% cut of any ransom payment quickly escalated to 25% of what the criminals projected could reach tens of millions of pounds if they successfully infiltrated the BBC’s systems.

After consulting with senior editors, Tidy made the extraordinary decision to engage with the criminals, feigning interest to gather intelligence on their operations. This choice would provide unprecedented insight into how modern ransomware gangs recruit insiders, exploit human psychology, and deploy increasingly aggressive tactics when their targets resist.

The Digital Recruitment Marketplace

The approach to Tidy reflects a broader transformation in cybercrime: the emergence of what security researchers now call the “insider threat digital recruitment marketplace.” According to investigations by threat intelligence firm Nisos, insider threat activities increased rapidly from 2019 to 2024, with threat actors actively recruiting across cloud-based messaging apps and dark web forums. According to Cybersecurity Insiders’ 2024 Insider Threat Report, 83% of organizations reported at least one insider attack in the past year. Notably, the share of organizations experiencing 11–20 incidents rose fivefold from 2023 to 2024, jumping from 4% to 21%.

The criminals targeting Tidy identified themselves as representatives of Medusa, a ransomware-as-a-service (RaaS) operation. A March 2025 CISA/FBI/MS-ISAC advisory attributes more than 300 impacted organizations in the U.S. critical-infrastructure sectors to Medusa as of February 2025. Unlike traditional cybercrime groups, Medusa operates through a sophisticated business model that recruits affiliates to execute attacks while the core operators provide the infrastructure, negotiation platforms, and technical support.

The reach-out manager who contacted Tidy—later switching his alias from “Syndicate” to “Syn”—claimed to be the only English speaker in the group and positioned himself as operating from the West, though security experts believe Medusa’s leadership operates from Russia or allied states. The criminal demonstrated detailed knowledge of how insider recruitment works, boasting of successful infiltrations at a UK healthcare company and a U.S. emergency services provider.

Psychological Manipulation and Escalation

The conversation revealed the psychological sophistication behind modern insider threat recruitment. Rather than relying on simple monetary incentives, the criminals crafted a narrative of financial freedom and anonymity. Syn proposed that Tidy take 25% of any final ransom negotiation as the criminals extracted what they claimed would be 1% of the BBC’s total revenue, adding the tantalizing promise that Tidy would “never need to work again”—a projection the criminals claimed could reach tens of millions of pounds.

To establish credibility, the criminals offered to deposit 0.5 Bitcoin—approximately $55,000—as a “trust payment” before any breach occurred. They provided links to their dark-web presence and walked Tidy through secure communication on Tox—a channel also noted in a U.S. advisory about Medusa.

The recruitment attempt followed a pattern that insider threat experts recognize as increasingly common. Organizations face what researchers describe as a “triple threat” environment where foreign intelligence entities, cybercriminals, and internal bad actors converge. The criminals assumed Tidy possessed high-level technical access to BBC systems—a misunderstanding that reveals how threat actors often target individuals based on their perceived rather than actual capabilities.

When Persuasion Becomes Coercion

The situation took a darker turn when Tidy began stalling for time. After setting a deadline of midnight on a Monday, the criminals launched what cybersecurity professionals refer to as an “MFA bombing” or “MFA fatigue” attack. Tidy’s phone was suddenly flooded with a barrage of two-factor authentication notifications from the BBC’s security system.

This technique exploits human psychology and the limitations of attention spans. By overwhelming targets with authentication requests, attackers hope victims will eventually approve one, either accidentally or out of frustration, to make the notifications stop. The tactic gained notoriety after its use in the 2022 Uber breach and has since become a standard tool in the cybercriminal arsenal.

“The criminals had escalated their approach from a relatively professional dialogue to aggressive notifications on my phone, akin to having intruders pounding on my front door,” Tidy later wrote. The experience provided visceral insight into how quickly insider threat attempts can shift from persuasion to coercion.

The Professional Response

Recognizing the escalating threat, Tidy immediately contacted the BBC’s information security team. As a precautionary measure, they disconnected him from all BBC systems, including emails, the intranet, internal tools, and privileges. This rapid response demonstrated the kind of decisive action that security experts recommend when insider threats are detected.

The criminals’ reaction to Tidy’s system lockout was telling. Rather than disappearing immediately, they sent a strangely apologetic message claiming they were merely “testing” the BBC’s login systems. They maintained that their offer remained available for several days before finally deleting their Signal account and vanishing when Tidy failed to respond.

Implications for Modern Organizations

Tidy’s experience illuminates several troubling trends in the evolving threat landscape. The incident demonstrates how cybercriminals are becoming more sophisticated in their recruitment approaches, moving beyond opportunistic attempts to target specific individuals they believe have valuable access. The criminals’ willingness to invest considerable time and resources—including offering substantial upfront payments—suggests that insider recruitment has become a profitable business model.

The ransomware-as-a-service model that enabled this recruitment attempt represents a broader shift in cybercrime economics. By operating like legitimate businesses, these groups can scale their operations, recruit specialized talent, and offer customer service that rivals legitimate technology companies. Modern RaaS programs provide affiliate dashboards, documentation and marketing materials, and support channels that mirror legitimate SaaS operations.

For organizations defending against these threats, Tidy’s experience highlights the importance of comprehensive insider threat programs that combine technological monitoring with human-centered approaches. Experts recommend developing formal insider threat programs that include cross-functional teams from HR, legal, IT, and security departments, along with clear incident response procedures.

The rapid deployment of MFA bombing tactics when the initial recruitment failed also underscores the need for robust authentication systems that can detect and respond to such attacks. To blunt MFA fatigue attacks, organizations should adopt phishing-resistant MFA where feasible and enable number matching on push-based MFA systems. Organizations should also implement adaptive authentication systems that can identify patterns of automated login attempts and implement rate limiting to prevent MFA fatigue attacks.

A Growing Underground Economy

The targeting of Tidy reflects the maturation of what researchers describe as a thriving underground economy built around insider threats. Dark web forums now feature dedicated sections for recruiting insiders, with threat actors offering substantial payments for access to everything from telecommunications companies to major retailers. According to Nisos’ research, threat actors are particularly focused on recruiting insiders at telecommunications companies and major e-commerce and cloud ecosystems—organizations that either hold valuable data or provide access to multiple downstream targets. Some criminals specialize in connecting buyers with insiders, operating as brokers in what has become a sophisticated marketplace.

Recent intelligence suggests that the recruitment often includes detailed instructions on how to maintain operational security and avoid detection. The financial incentives driving this marketplace are substantial. The 2025 Ponemon/DTEX study estimates an average annual insider-risk cost of $17.4 million per organization, with costs varying significantly by incident type. These figures help explain why criminal organizations are willing to invest heavily in recruitment efforts.

As the BBC incident demonstrates, no organization is immune to these recruitment attempts, regardless of its reputation or security posture. The criminals specifically targeted what they assumed was a cybersecurity professional at a major media organization, suggesting they view such targets as particularly valuable due to their presumed technical access and knowledge of security systems.

The question facing every organization today is not whether they will be targeted by insider threat recruitment, but how effectively they can detect, respond to, and learn from such attempts when they inevitably occur. In an era where trust has become both an organizational asset and a potential vulnerability, how prepared are we to recognize when that trust is being weaponized against us?

News Sources

• ‘You’ll never need to work again’: Criminals offer reporter money to hack BBC (BBC News)
• Ransomware gang sought BBC reporter’s help in hacking media giant (BleepingComputer)
• Joint FBI/CISA Advisory Highlights Medusa Ransomware Threat (Forcepoint)
• 83% of organizations reported insider attacks in 2024 (IBM)
• 2025 Ponemon Cost of Insider Threats Global Report: Takeaways (DTEX Systems)
• Insider Threats & Digital Recruitment: A Growing Risk (Nisos)

Assisted by GAI and LLM Technologies

Additional Reading

• European Drone Incidents Expose Critical Gaps in Enterprise Security and Hybrid Defense
• Microsoft Disables Cloud Services for Israeli Intel Unit Citing Surveillance Misuse
• EU Agrees on GDPR Cross-Border Enforcement Reform: New Procedural Rules to Streamline Investigations
• When Legal Privilege Isn’t Enough: Cyber Threats Escalate in the Legal Industry

Source: ComplexDiscovery OÜ