How initial access brokers operate

  1. They gain access through exposed and unpatched internet-facing systems, stealer logs, credential stuffing or phishing.
  2. They confirm the access works and estimate its value, for example the victim's revenue and level of privilege.
  3. They advertise it on criminal forums without naming the victim, then sell it to the highest bidder or a trusted buyer.

Why IABs matter to defenders

IABs are part of a criminal supply chain. The person who breaks in is often not the person who deploys ransomware, so there can be days or weeks between initial access and the main attack. Spotting a listing that matches your organisation, or finding the exposed service or leaked credential that made it possible, gives a chance to act before the access is used.

Reducing your value to IABs

  • Remove or protect exposed remote access services.
  • Patch internet-facing systems quickly.
  • Enforce multi-factor authentication on all remote access.
  • Monitor for leaked credentials and criminal listings mentioning your organisation.

How DarkInvader helps

DarkInvader's Dark Web Monitoring and research team watch criminal forums and channels for access listings and mentions linked to your organisation, while Asset Discovery and Leaked Credentials close the exposed services and stolen logins IABs rely on.

Explore Dark Web Monitoring

Frequently asked questions

What is the difference between an IAB and a ransomware group?

An IAB specialises in getting into networks and selling that access. A ransomware group or affiliate buys the access and carries out the extortion. Some groups do both.

How much do initial access brokers charge?

Prices vary widely with the victim's size, sector and the level of access, from a few hundred to many thousands of dollars.

Can I find out if access to my company is for sale?

Listings rarely name the victim, but analysts can often match the description of sector, country, revenue and access type. This is one reason dark web monitoring includes human research as well as automation.

Related terms and reading

Sources