Initial Access Brokers

Initial Access Brokers

Executive Summary

Initial Access Brokers (IABs) are specialized cybercriminal actors who focus exclusively on gaining unauthorized access to corporate networks and then selling that access to other threat actors — most commonly ransomware affiliates. IABs represent a critical node in the cybercrime supply chain, effectively decoupling the intrusion phase from the monetization phase and enabling a division of labor that increases overall ecosystem efficiency. By purchasing pre-validated network access, ransomware operators and affiliates can skip the time-consuming and technically demanding initial intrusion phase, reducing their time-to-impact from weeks to hours.

The IAB marketplace operates primarily on Russian-language cybercrime forums, with Exploit, XSS, and RAMP being the most active venues. Access listings typically specify the victim's country, industry sector, revenue (a key pricing factor), access type (RDP, VPN, web shell, Active Directory credentials), and level of privilege. Pricing varies dramatically: basic RDP access to a small company might sell for $500-$2,000, while domain admin access to a Fortune 500 company can command $20,000-$50,000 or more. The median price for IAB listings is approximately $1,500-$3,000. Some IABs operate through private channels and maintain exclusive relationships with specific ransomware operations rather than selling on open forums.

The infostealer-to-IAB pipeline has become the dominant supply mechanism for access inventory. IABs systematically purchase or harvest infostealer logs from marketplaces (Russian Market, Telegram channels), filter for corporate VPN credentials (Cisco AnyConnect, Fortinet, Palo Alto GlobalProtect, Pulse Secure/Ivanti), validate access, escalate privileges where possible, and list the access for sale. This pipeline means that an employee's malware infection on a personal device — often via malvertising or a trojanized software download — can directly lead to a ransomware attack on their employer weeks or months later. Separately, IABs exploit vulnerabilities in internet-facing infrastructure (VPN appliances, Citrix, Exchange, firewalls) to harvest access at scale.

Key Actors

Note: IAB handles change frequently. Actors rebrand, retire, and new actors enter the market regularly. The above represents observed active handles but is not exhaustive.

Current Activity

Infostealer Log-to-Access Pipeline Acceleration (2024-2025)

The volume of corporate credentials available via infostealer logs has grown substantially, driven by the proliferation of Lumma, StealC, and other stealer families. IABs have industrialized the process of filtering corporate VPN/SSO credentials from bulk log purchases, validating access, and listing it for sale. Some have developed automated tools to test credentials at scale across VPN endpoints. The time from employee infostealer infection to corporate access listing has compressed, with some operations completing the cycle within days. KELA and Flare research indicates IAB listings have grown year-over-year, with several hundred active listings at any given time.

Vulnerability Exploitation for Mass Access Harvesting

IABs increasingly exploit critical vulnerabilities in edge devices to build access inventory at scale. Exploited products in 2023-2025 include Citrix NetScaler/ADC (CVE-2023-4966 "Citrix Bleed"), Fortinet FortiOS (multiple CVEs), Ivanti Connect Secure (CVE-2024-21887/CVE-2023-46805), Cisco ASA/FTD, ConnectWise ScreenConnect (CVE-2024-1709), and Palo Alto PAN-OS (CVE-2024-3400). Actors exploit these vulnerabilities to deploy webshells or create accounts across hundreds of organizations, then sell individual accesses as listings. This approach provides inventory at near-zero marginal cost per victim.

Ransomware-IAB Relationship Tightening

Evidence from ransomware chat leaks (Conti leaks 2022, Black Basta chat leak early 2025) confirms that ransomware operations maintain regular purchasing relationships with IABs, sometimes with standing arrangements for specific types of access (particular sectors, revenue thresholds, geographic regions). Some ransomware programs have dedicated budget lines for access purchases. Premium ransomware affiliates may negotiate exclusive first-look arrangements with top-tier IABs.

Historical Events

TTP Evolution

Access Acquisition Methods:

• 2019-2021: Predominantly RDP brute-forcing, VPN credential stuffing from data breaches, and exploitation of common vulnerabilities (BlueKeep, Exchange ProxyLogon/ProxyShell).
• 2022-2023: Shift toward infostealer log harvesting as primary credential source; increasing exploitation of VPN/edge device vulnerabilities.
• 2024-present: Mature pipeline combining automated infostealer log processing with rapid exploitation of newly disclosed vulnerabilities in edge infrastructure. Some IABs specialize in one method or the other.

Access Types Sold:

• RDP/VPN credentials: Most common; buyer needs to do their own reconnaissance and privilege escalation.
• Web shells: Pre-deployed persistent access; common from vulnerability exploitation campaigns.
• Domain admin/enterprise admin: Premium access where IAB has already escalated privileges; commands highest prices.
• Citrix/Remote Desktop Gateway: Provides access to virtualized environments with broader reach.
• Cloud/SaaS access: Emerging category; M365 Global Admin, AWS root credentials from infostealer logs.
• MSP/RMM access: High value due to downstream access to MSP clients; treated as premium listings.

Pricing Factors: Access pricing correlates with: victim revenue (strongest factor), access type and privilege level, country (US/EU commands premium), sector (finance/insurance/healthcare premium), network size, and whether security tools were observed. Forum reputation and seller track record also affect willingness to pay. Auction formats are sometimes used for high-value access.

Operational Security: Established IABs use forum escrow services to protect both parties. Listings avoid naming victims directly, instead providing country, sector, revenue, number of hosts, and access type. Some use "check" services where potential buyers can verify the access is still valid before completing purchase. Communication for sensitive details moves to encrypted messengers (Tox, Jabber/XMPP).

Ecosystem & Infrastructure Patterns

Forum Marketplace Structure: Major forums (Exploit, XSS, RAMP) have dedicated sections for access trading with established rules, escrow services, and reputation systems. Sellers build reputations through consistent delivery and positive buyer reviews. Some forums require initial deposits or vetting to participate. Listings follow semi-standardized formats specifying access parameters.

Supply Chain Position: IABs sit at the critical junction between initial compromise and monetization. Their upstream suppliers include: infostealer operators (providing raw credential logs), vulnerability researchers (providing exploits), and botnet operators (providing infected machine access). Their downstream customers include: ransomware affiliates (primary buyers), corporate espionage operators, data theft groups, and occasionally state-sponsored actors using criminal infrastructure.

Seasonal and Event-Driven Patterns: Access listings spike following major vulnerability disclosures in edge devices, as IABs race to exploit and list access before victims patch. Listing volumes also correlate with infostealer campaign waves. New ransomware programs entering the market can create demand spikes as affiliates stock up on access.

Quality Assurance: Sophisticated IABs provide "freshness" guarantees — confirming that access is validated within a recent timeframe. Some offer brief replacement guarantees if access becomes invalid shortly after sale. The most professional operations provide detailed information about the victim environment (domain structure, security tools observed, number of hosts) to help buyers assess the opportunity.

Pricing Benchmarks (approximate, based on public research):

Tooling

Intelligence Gaps

• Private deal volume: A significant portion of IAB activity occurs through private channels and direct relationships rather than public forum listings. The ratio of public to private access trading is unknown but likely skews heavily toward private, meaning forum monitoring captures only a fraction of activity.
• Time-to-exploitation: The average elapsed time from an access listing appearing on forums to a ransomware affiliate purchasing and deploying ransomware is not well-characterized. Faster timelines reduce the defensive window.
• IAB-ransomware attribution: Connecting specific ransomware incidents to specific IAB listings/sellers is extremely difficult without insider access, law enforcement data, or ransomware group chat leaks. This limits disruption targeting.
• Cloud access pricing and volume: As corporate environments shift to cloud/SaaS, the IAB market for cloud admin access is emerging but not well-studied compared to traditional network access.
• IAB operator demographics: Beyond a few arrested individuals, the demographics, geographic distribution, and organizational structure of IAB operators remain largely unknown.
• Infostealer log to access conversion rate: What percentage of corporate credentials in infostealer logs are actually viable for network access (not expired, not MFA-blocked, etc.) is poorly quantified.

Sources & References

1. KELA - "IAB Landscape Reports" and access listing tracking — https://www.kelacyber.com/
2. Flashpoint - "Initial Access Broker Intelligence" — https://flashpoint.io/
3. Group-IB - "Hi-Tech Crime Trends: Initial Access Brokers" — https://www.group-ib.com/
4. CrowdStrike - "Access Broker Tracking and ECrime Index" — https://www.crowdstrike.com/
5. Mandiant - "FIN12 and Access Broker Relationships" — https://www.mandiant.com/resources
6. Secureworks - "Initial Access Broker Marketplace Analysis" — https://www.secureworks.com/
7. Digital Shadows (now ReliaQuest) - "IAB Marketplace Monitoring" — https://www.reliaquest.com/
8. CISA - Known Exploited Vulnerabilities Catalog (edge device CVEs) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Change Log