Executive SSNs for Sale: Defending Against Identity-as-a-Service Dark Web Marketplaces — Detection and Response Guide

Rapid7's threat research team recently published findings on what they describe as an "Identity-as-a-Service" economy operating across dark web marketplaces — dedicated shops and broker channels trading the Social Security numbers (SSNs), dates of birth, home addresses, and associated PII of corporate executives, board members, and other high-value individuals. The reporting underscores a reality many security programs still underweight: identity data is a permanent compromise. Unlike a stolen credit card number, an SSN cannot be deactivated or reissued on demand. Once an executive's SSN is circulating in criminal marketplaces, it can be monetized for years — through unauthorized credit lines, synthetic identity construction, fraudulent tax filings, and, most relevant to defenders, highly credible executive impersonation and business email compromise (BEC) pretexts.

This is not a vulnerability with a patch. It is an exposure problem with a detection and containment answer. If your organization has executives whose PII has surfaced in breach corpora — and statistically, some of them have — your SOC, fraud team, and executive protection function need a coordinated playbook. This post provides one.

Severity: High for targeted organizations. The risk is not abstract. Executive identity data directly enables impersonation of the very people authorized to approve wire transfers, release W-2 data, and override controls.

Technical Analysis

What is actually being traded

There is no CVE associated with this threat — no software flaw to patch, no vendor advisory to track. The "product" is aggregated identity data sourced from:

• Historical breach corpora — data broker breaches, healthcare clearinghouses, financial services incidents, and background-check provider compromises
• Data broker and people-search sites — legitimately operating aggregators that publish executive home addresses, relatives, and phone numbers, scraped and repackaged by criminals
• Stealer log ecosystems — infostealer output (credentials, session cookies, autofill data containing SSNs and personal details) sold in bulk logs markets
• Insider-sourced records — payroll, benefits enrollment, and HR system extracts

Rapid7's research highlights that executive records command premium pricing precisely because the victims are high-net-worth, high-authority individuals whose identity documents unlock larger credit facilities and more convincing fraud.

Why executives specifically

From an attacker's cost-benefit perspective, an executive identity delivers:

1. Higher credit ceilings — fraudulent lines of credit and loan applications against an executive's identity yield more per record.
2. Synthetic identity construction — combining a real SSN with fabricated names/addresses to build durable fraudulent identities that survive basic KYC checks.
3. Tax refund fraud — filing returns before the legitimate taxpayer does; the FTC receives over 1 million identity theft reports annually, with imposter scams and related fraud accounting for billions in losses.
4. Corporate attack surface — an executive's personal details (home address, family members, personal email, phone) dramatically improve the success rate of spear phishing, vishing against help desks, SIM-swap social engineering, and BEC pretexts.

The enterprise attack chain defenders should model

The path from a dark web SSN listing to enterprise impact typically looks like this:

1. Acquire — attacker purchases an executive identity package (SSN, DOB, address history, phone, personal email).
2. Enrich — cross-references data broker listings, LinkedIn, SEC filings, and corporate bios for reporting structure and assistants.
3. Impersonate or target — either (a) impersonate the executive to banks, carriers, or the company's own help desk, or (b) use the executive's identity as the pretext to target finance and HR staff with fraudulent requests.
4. Establish control — inbox forwarding rules on a compromised mailbox, SIM swap of the executive's number to intercept MFA, or payroll redirect via HR self-service.
5. Monetize — wire fraud, W-2 bulk theft (which in turn feeds more SSN inventory), fraudulent credit, and tax refund diversion.

Notice that steps 4 and 5 produce observable telemetry inside your environment. That is where defenders win.

Exploitation status

This is confirmed, ongoing, and industrialized criminal activity — not theoretical. Identity theft reporting to the FTC exceeds one million reports per year, and dark web identity marketplaces are a mature, continuously operating ecosystem. Organizations should assume executive PII exposure as a baseline condition and build controls accordingly, rather than treating it as a hypothetical.

Detection & Response

The most reliable internal detections for executive identity abuse cluster around three behaviors: (1) mailbox manipulation on executive and finance accounts, (2) bulk access or staging of PII-bearing files (payroll, W-2, benefits data), and (3) unauthorized forwarding/redirect rules that siphon executive communications. The rules below target those behaviors with tunable allowlists so they survive contact with a real environment.

Sigma Rules

---
title: Suspicious Inbox Forwarding or Redirect Rule on Executive or Finance Mailbox
id: 3f9c1a72-8e4b-4d61-bf23-7a5e9c012345
status: experimental
description: Detects creation or modification of Exchange inbox rules that forward or redirect mail to external addresses on executive, finance, or HR mailboxes. A common follow-on action after executive account compromise or impersonation-driven BEC. Tune the VIP list to your organization's executive and finance mailbox set.
references:
  - https://attack.mitre.org/techniques/T1114/003/
  - https://www.rapid7.com/blog/post/tr-identity-as-a-service-dark-web-marketplaces-executive-ssn
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1114.003
logsource:
  product: o365
  service: exchange
detection:
  selection_operation:
    Operation:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  selection_forwarding:
    Parameters|contains:
      - 'ForwardTo'
      - 'ForwardAsAttachmentTo'
      - 'RedirectTo'
  filter_internal:
    Parameters|contains:
      - '@yourdomain.com'
  condition: selection_operation and selection_forwarding and not filter_internal
falsepositives:
  - Legitimate executive assistant delegation and approved external forwarding (maintain an allowlist)
level: high
---
title: Bulk Copy or Staging of HR Payroll and PII Directories
id: 8b2e4d61-5c7a-4f92-ac34-1d6f8b902134
status: experimental
description: Detects bulk copy utilities (robocopy, xcopy) or archive staging commands referencing directories and filenames associated with payroll, W-2, I-9, SSN, or benefits data. Executive SSN trafficking ecosystems are fed by exactly this class of PII extraction from HR and finance shares. Scope the path keywords to your actual HR share naming conventions.
references:
  - https://attack.mitre.org/techniques/T1074/
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1074.001
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\robocopy.exe'
      - '\xcopy.exe'
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_target:
    CommandLine|contains:
      - '\payroll\'
      - 'w-2'
      - 'w2_'
      - 'i-9'
      - 'ssn'
      - 'social_security'
      - 'benefits_enrollment'
      - '\hr_records\'
  condition: selection_tool and selection_target
falsepositives:
  - Scheduled HR backup jobs (exclude known service accounts and backup server hostnames)
  - Legitimate HR staff archival activity at fiscal year boundaries
level: high

Microsoft Sentinel / Defender KQL

This hunt correlates new external inbox forwarding rules on a curated VIP/finance mailbox list with sign-in context, and separately surfaces mass downloads from HR/payroll SharePoint libraries by accounts outside the authorized HR group. Run it on a 7–14 day lookback and schedule it as an analytics rule once tuned.

// Executive identity abuse hunt: VIP mailbox forwarding + HR PII mass download
// Maintain these lists from your CMDB / identity governance tool
let VIPMailboxes = dynamic(["ceo@yourdomain.com","cfo@yourdomain.com","controller@yourdomain.com"]);
let AuthorizedHRUsers = dynamic(["hr-service@yourdomain.com"]);
let HRLibraries = dynamic(["Payroll","Benefits","EmployeeRecords","W2"]);
let lookback = 14d;
// Part 1: New external forwarding rules on VIP / finance mailboxes
let ForwardingRules =
OfficeActivity
| where TimeGenerated > ago(lookback)
| where OfficeWorkload == "Exchange"
| where Operation in ("New-InboxRule","Set-InboxRule")
| where UserId in~ (VIPMailboxes) or MailboxOwnerUPN in~ (VIPMailboxes)
| extend Params = tostring(Parameters)
| where Params has_any ("ForwardTo","RedirectTo","ForwardAsAttachmentTo")
| where Params !has "yourdomain.com"
| project TimeGenerated, UserId, MailboxOwnerUPN, Operation, Params, ClientIPAddress, ResultStatus;
// Part 2: Sign-in anomalies for the same VIP accounts (new ASN / failed MFA burst)
let VipSignins =
SigninLogs
| where TimeGenerated > ago(lookback)
| where UserPrincipalName in~ (VIPMailboxes)
| summarize FailedSignins = countif(ResultType != 0), SuccessfulSignins = countif(ResultType == 0),
    DistinctIPs = dcount(IPAddress), IPSet = make_set(IPAddress, 10)
  by UserPrincipalName, bin(TimeGenerated, 1d)
| where FailedSignins > 5 or DistinctIPs > 3;
// Part 3: Mass file download from HR/payroll libraries by non-HR accounts
let HRDownloads =
OfficeActivity
| where TimeGenerated > ago(lookback)
| where Operation in ("FileDownloaded","FileSyncDownloadedFull")
| where OfficeObjectId has_any (HRLibraries) or SourceFileName has_any ("W2","W-2","payroll","ssn","I-9")
| where UserId !in~ (AuthorizedHRUsers)
| summarize DownloadCount = count(), Files = make_set(SourceFileName, 25) by UserId, ClientIP = ClientIPAddress, bin(TimeGenerated, 1h)
| where DownloadCount > 20;
ForwardingRules
| union VipSignins, HRDownloads
| sort by TimeGenerated desc

Velociraptor VQL

Stolen PII frequently transits through endpoints as staged CSV/Excel exports before exfiltration. This artifact hunts user-writable paths for files whose names indicate SSN, payroll, or tax-form content outside designated HR systems — both as a detection for staging and as an exposure inventory you can use to reduce the amount of executive PII at rest.

-- Hunt for staged PII files (SSN/payroll/tax-form indicators) in user-writable paths
-- Pair with your DLP for content-level confirmation; this is a filename/staging hunt
LET pii_globs = [
  'C:/Users/*/Documents/**/*.{csv,xlsx,xls,pdf,txt}',
  'C:/Users/*/Downloads/**/*.{csv,xlsx,xls,pdf,txt}',
  'C:/Users/*/Desktop/**/*.{csv,xlsx,xls,pdf,txt}',
  'C:/Temp/**/*.{csv,xlsx,xls,pdf,txt}',
  'C:/ProgramData/**/*.{csv,xlsx,xls}'
]
SELECT FullPath,
       Size,
       Mtime,
       B.Name AS Filename
FROM glob(globs=pii_globs)
WHERE FullPath =~ '(?i)(ssn|social.?security|w-?2|w2_|i-?9|payroll|benefits|employee.?list|tax.?return)'
  AND Size > 1024
ORDER BY Mtime DESC

Remediation / Audit Script

The following PowerShell audits Exchange Online executive mailboxes for forwarding rules and external redirects, and scans a designated endpoint or file share for files matching PII naming conventions. Run the mailbox audit against your full VIP list weekly; treat any unapproved external forward as a presumptive incident.

# Requires: ExchangeOnlineManagement module, Mail.Read permissions for mailbox audit
# 1) Connect and audit VIP mailboxes for external forwarding rules
Connect-ExchangeOnline
$VipMailboxes = Get-Content -Path "C:\Audit\vip-mailboxes.txt"
foreach ($mbx in $VipMailboxes) {
    Get-InboxRule -Mailbox $mbx | Where-Object {
        $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo
    } | Select-Object MailboxOwnerId, Name, ForwardTo, RedirectTo, ForwardAsAttachmentTo, Enabled |
    Export-Csv -Path "C:\Audit\vip-forwarding-audit-$(Get-Date -Format 'yyyyMMdd').csv" -Append -NoTypeInformation
}
# Also pull tenant-level transport rules that silently redirect executive mail
Get-TransportRule | Where-Object {
    $_.RedirectMessageTo -or $_.BlindCopyTo -or $_.AddToRecipients
} | Format-List Name, State, RedirectMessageTo, BlindCopyTo, AddToRecipients

# 2) Scan for PII-indicator files on a target share or host path
$ScanPaths = @("\\fileserver\departments", "C:\Users")
$Pattern = '(?i)(ssn|social.?security|w-?2|i-?9|payroll|benefits)'
foreach ($path in $ScanPaths) {
    Get-ChildItem -Path $path -Recurse -Include *.csv,*.xlsx,*.xls,*.pdf,*.txt -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -match $Pattern -and $_.Length -gt 1KB } |
        Select-Object FullName, Length, LastWriteTime |
        Export-Csv -Path "C:\Audit\pii-file-inventory-$(Get-Date -Format 'yyyyMMdd').csv" -Append -NoTypeInformation
}

Remediation & Hardening

Because there is no patch for exposed identity data, remediation is a layered containment program across people, process, and monitoring.

1. Contain the individual exposure (executive level)

• Credit freezes with all three U.S. bureaus (Equifax, Experian, TransUnion) for every executive and board member — free and the single highest-impact control against credit-line abuse.
• IRS Identity Protection PIN (IP PIN) enrollment for executives to block fraudulent tax filings in their name.
• Fraud alerts and ChexSystems freeze to cover bank-account-opening abuse that credit freezes don't reach.
• Data broker opt-outs — engage a removal service (or internal resource) to systematically delist executive home addresses, phone numbers, and family data from people-search sites; this directly degrades attacker enrichment (step 2 of the chain above).
• Identity theft monitoring as an executive benefit, with clear escalation into your IR process when alerts fire. If fraud is confirmed, report at identitytheft.gov to generate an FTC recovery plan.

2. Reduce corporate PII leakage

• Audit what executive personal data appears in SEC filings, proxy statements, press releases, and corporate bios — remove personal phone numbers, home addresses, and family details.
• Restrict HR self-service so payroll direct-deposit changes and W-2 downloads require out-of-band verification (not just MFA push, which is SIM-swap/Push-bombing vulnerable).
• Enforce DLP policies on payroll/HR repositories; the KQL and VQL hunts above give you the telemetry baseline.

3. Harden authentication and approval workflows

• Phishing-resistant MFA (FIDO2/passkeys) for all executives and finance staff — SMS and push MFA are precisely what SIM-swap and social engineering defeat.
• Callback verification for any wire transfer, payroll redirect, or W-2 bulk request — using a number from the directory, never one provided in the request.
• Help desk runbooks requiring manager or hardware-token verification before MFA resets, number port-outs, or password changes on executive accounts — this is the control that blunts SIM-swap-assisted account takeover.

4. Monitor and respond

• Subscribe to a dark web / breach corpus monitoring capability (commercial threat intelligence or your MSSP) with alerting keyed to executive names, personal emails, and corporate domains — the Rapid7 research demonstrates these listings exist and are queryable.
• Deploy the mailbox forwarding detections above as scheduled analytics; treat external forwarding on a VIP mailbox as a sev-2+ incident by default.
• Pre-stage an executive identity compromise playbook in your IR plan: who contacts the banks, who handles carrier/SIM-swap lockdown, who coordinates credit freezes, and how corporate communications are handled.

5. Governance

• Report executive identity exposure as a standing risk to the board — it materially affects fiduciary fraud exposure.
• Include executive impersonation scenarios in tabletop exercises at least annually; finance and HR teams are the real control surface.

Key Takeaways

• Executive SSN trafficking is an industrialized, ongoing criminal economy — assume exposure and build detection and containment accordingly.
• The enterprise impact materializes as observable behaviors: mailbox forwarding rules, HR PII bulk access, payroll redirects, and help desk social engineering. Detect those, and you break the chain.
• Credit freezes and IRS IP PINs are free, fast, and high-impact — push them to every executive this quarter.
• Phishing-resistant MFA plus callback verification on financial approvals are the two controls that most reliably stop monetization.
• Treat external forwarding rules on executive mailboxes as presumptive incidents, not configuration drift.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub