Help Wanted: Dark Web Job Recruitment is Up
None
<p><i><span style="font-weight: 400;">If you’re an industrious, persistent, English-speaking bad actor with a documented expertise in AI and a penchant for wreaking havoc on business, government and infrastructure, please apply within.</span></i></p><p><span style="font-weight: 400;">Or so it goes on the <a href="https://securityboulevard.com/2025/05/on-the-hunt-for-cyber-jihadists-on-the-dark-web-an-analysis/" target="_blank" rel="noopener">dark web</a>, where the “economy” is apparently booming and recruiters are pulling out all the stops to lure the best and brightest tech miscreants. In just seven months, the number of recruitment and self-promotion posts on cybercriminal forums like “Exploit” and “RAMP” has already reached last year’s number (which was already double the number recorded in 2023), according to </span><a href="https://reliaquest.com/blog/threat-spotlight-cybercrime-is-hiring-recruiting-ai-iot-and-cloud-experts/" target="_blank" rel="noopener"><span style="font-weight: 400;">research from Reliaquest</span></a><span style="font-weight: 400;">.</span></p><p><span style="font-weight: 400;">I think it is fair to say that the recruiters on the dark web are going just as hard as those on legit job boards. And the qualifications they are seeking are pretty specific and not surprising. </span></p><div class="code-block code-block-12 ai-track" data-ai="WzEyLCIiLCJCbG9jayAxMiIsIiIsMV0=" style="margin: 8px 0; clear: both;"> <style> .ai-rotate {position: relative;} .ai-rotate-hidden {visibility: hidden;} .ai-rotate-hidden-2 {position: absolute; top: 0; left: 0; width: 100%; height: 100%;} .ai-list-data, .ai-ip-data, .ai-filter-check, .ai-fallback, .ai-list-block, .ai-list-block-ip, .ai-list-block-filter {visibility: hidden; position: absolute; width: 50%; height: 1px; top: -1000px; z-index: -9999; margin: 0px!important;} .ai-list-data, .ai-ip-data, .ai-filter-check, .ai-fallback {min-width: 1px;} </style> <div class="ai-rotate ai-unprocessed ai-timed-rotation ai-12-1" data-info="WyIxMi0xIiwxXQ==" style="position: relative;"> <div class="ai-rotate-option" style="visibility: hidden;" data-index="1" data-name="VGVjaHN0cm9uZyBHYW5nIFlvdXR1YmU=" data-time="MTA="> <div class="custom-ad"> <div style="margin: auto; text-align: center;"><a href="https://youtu.be/Fojn5NFwaw8" target="_blank"><img src="https://securityboulevard.com/wp-content/uploads/2024/12/Techstrong-Gang-Youtube-PodcastV2-770.png" alt="Techstrong Gang Youtube"></a></div> <div class="clear-custom-ad"></div> </div></div> </div> </div><p><span style="font-weight: 400;">“Our adversaries work in campaigns, and they’re incentivized to build an ecosystem and marketplace of specialized service providers and technical services — they clearly share and collaborate without the overhead and legal hurdles that defensive security teams do,” says Trey Ford, chief strategy and trust officer at Bugcrowd.</span></p><p><span style="font-weight: 400;">Among the most in-demand skills is English-speaking social engineering, with job posts more than doubling from 2024 to 2025,” say the Reliaquest Threat Research Team, who analyzed hundreds of dark-web job postings from January 1, 2023, to July 31, 2025. </span></p><div class="code-block code-block-15" style="margin: 8px 0; clear: both;"> <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2091799172090865" crossorigin="anonymous" type="f9282fe4347aaf264f79e04b-text/javascript"></script> <!-- SB In Article Ad 1 --> <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-2091799172090865" data-ad-slot="8723094367" data-ad-format="auto" data-full-width-responsive="true"></ins> <script type="f9282fe4347aaf264f79e04b-text/javascript"> (adsbygoogle = window.adsbygoogle || []).push({}); </script></div><p><span style="font-weight: 400;">They note that recruiters make up 87% of the postings, “indicating strong demand, likely fueled by the success of groups like Scattered Spider in leveraging this skill for initial access attacks.” </span></p><p><span style="font-weight: 400;">While references to Scattered Spider “tend to garner a lot of attention, the real trendline to watch is the integration of AI into cyber adversaries’ toolsets to automate reconnaissance and create precision-targeted, customized attacks at scale,” says Dave Tyson, partner, intelligence operations, iCounter. </span></p><p><span style="font-weight: 400;">After a dip in 2024, recruits skilled in compromising IoT have become a hot role again, with r</span><span style="font-weight: 400;">ecruitment rebounding and on track by the end of 2025 to exceed activity in previous years. Not surprisingly, AI experts are in demand, as they have been since Q3 2024, to automate operations, which Reliaquest researchers say marks “a shift from using AI for isolated tasks — like leveraging LLMs to develop malware—to fully integrating AI into operational processes.”</span></p><p><span style="font-weight: 400;">It seems recruiters are finding “worthy” candidates who have already yielded results. </span><span style="font-weight: 400;">For instance, “recruitment of ClickFix experts to distribute malware triggered a 200 percent spike in ClickFix activity between March and April 2025.” </span></p><p><span style="font-weight: 400;">Taking the pulse of the dark-web job market can predict cybercrime’s future. “Understanding what skills attackers are recruiting for now can help organizations anticipate—and counter—their next moves,” the researchers said. </span></p><p><span style="font-weight: 400;">Cloud exploitation clearly remains a top goal of those job seekers who traverse the dark web — the researchers say mentions of Azure and Entra quadrupled from 2023 to mid-2025.</span></p><p><span style="font-weight: 400;">And of course, AI will dominate the future, with an emphasis on recruits who have deepfake capabilities that let attackers impersonate employees for more effective social engineering attacks.</span></p><p><span style="font-weight: 400;">The researchers believe that once adversaries can remove language barriers in real time (currently a technical challenge), deepfakes will be an even greater threat. “Attackers could target organizations across multiple languages, significantly expanding their reach,” they said, noting that with “recruitment for English-speaking social engineers already at an all-time high, real-time deepfake technology offers an alternative to traditional methods.”</span></p><p><span style="font-weight: 400;">They expect an uptick in social engineering attacks as a result. “Without robust security measures, organizations face significant risk from these increasingly deceptive tactics, which are expected to emerge in the long-term future beyond 12 months,” they said. </span></p><p><span style="font-weight: 400;">And successful attacks will continue to drive the dark web job market. </span><span style="font-weight: 400;">“The increase in AI functionality to rapidly increase forged criminal content used in social engineering attacks is a direct linkage to both the success of the attacks and the need for more personnel,” Tyson says, because as bad guys rack up more wins by using AI, it drives higher staffing needs and higher compensation for threat actors. </span></p><p><span style="font-weight: 400;">“Our adversaries work in campaigns, and they’re incentivized to build an ecosystem and marketplace of specialized service providers and technical services—they clearly share and collaborate without the overhead and legal hurdles that defensive security teams do,” says Trey Ford, chief strategy and trust officer at Bugcrowd.</span></p><p><span style="font-weight: 400;">Threat actors will be early adopters of tools like AI to streamline and find efficiency – this makes campaigns faster to set up, modify, adapt, and re-use over time.</span></p><p><span style="font-weight: 400;">Ford says it is more important than ever to aggressively monitor the new hire pipeline. “New accounts need to be closely monitored for baseline adoption, access and usage — identity proofing at new hire onboarding, and account access behaviors should be a focal point right now,” he says.</span></p><p><span style="font-weight: 400;">Experts expect a thriving dark economy in the months and years to come. Maybe the cybersecurity industry should start tracking jobs added each month, a la the U.S. government. And, who knows, perhaps recruits will start demanding more “job benefits.”</span></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2025/08/help-wanted-dark-web-job-recruitment-is-up/" data-a2a-title="Help Wanted: Dark Web Job Recruitment is Up"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F08%2Fhelp-wanted-dark-web-job-recruitment-is-up%2F&linkname=Help%20Wanted%3A%20Dark%20Web%20Job%20Recruitment%20is%20Up" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F08%2Fhelp-wanted-dark-web-job-recruitment-is-up%2F&linkname=Help%20Wanted%3A%20Dark%20Web%20Job%20Recruitment%20is%20Up" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F08%2Fhelp-wanted-dark-web-job-recruitment-is-up%2F&linkname=Help%20Wanted%3A%20Dark%20Web%20Job%20Recruitment%20is%20Up" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F08%2Fhelp-wanted-dark-web-job-recruitment-is-up%2F&linkname=Help%20Wanted%3A%20Dark%20Web%20Job%20Recruitment%20is%20Up" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2025%2F08%2Fhelp-wanted-dark-web-job-recruitment-is-up%2F&linkname=Help%20Wanted%3A%20Dark%20Web%20Job%20Recruitment%20is%20Up" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>