initial-access-brokers

Initial Access Brokers

Executive Summary

Initial Access Brokers (IABs) are specialized cybercriminal actors who focus exclusively on gaining unauthorized access to corporate networks and then selling that access to other threat actors — most commonly ransomware affiliates. IABs represent a critical node in the cybercrime supply chain, effectively decoupling the intrusion phase from the monetization phase and enabling a division of labor that increases overall ecosystem efficiency. By purchasing pre-validated network access, ransomware operators and affiliates can skip the time-consuming and technically demanding initial intrusion phase, reducing their time-to-impact from weeks to hours.

The IAB marketplace operates primarily on Russian-language cybercrime forums, with Exploit, XSS, and RAMP being the most active venues. Access listings typically specify the victim's country, industry sector, revenue (a key pricing factor), access type (RDP, VPN, web shell, Active Directory credentials), and level of privilege. Pricing varies dramatically: basic RDP access to a small company might sell for $500-$2,000, while domain admin access to a Fortune 500 company can command $20,000-$50,000 or more. The median price for IAB listings is approximately $1,500-$3,000. Some IABs operate through private channels and maintain exclusive relationships with specific ransomware operations rather than selling on open forums.

The infostealer-to-IAB pipeline has become the dominant supply mechanism for access inventory. IABs systematically purchase or harvest infostealer logs from marketplaces (Russian Market, Telegram channels), filter for corporate VPN credentials (Cisco AnyConnect, Fortinet, Palo Alto GlobalProtect, Pulse Secure/Ivanti), validate access, escalate privileges where possible, and list the access for sale. This pipeline means that an employee's malware infection on a personal device — often via malvertising or a trojanized software download — can directly lead to a ransomware attack on their employer weeks or months later. Separately, IABs exploit vulnerabilities in internet-facing infrastructure (VPN appliances, Citrix, Exchange, firewalls) to harvest access at scale.