An initial access broker (IAB) is a criminal who breaks into organisations and then sells that access to others, often ransomware groups. They trade stolen credentials, VPN and remote access, and footholds on dark web forums and channels. IABs are the supply chain of ransomware, turning one exposed credential into a full-scale attack.

An initial access broker, or IAB, is a cybercriminal who specialises in obtaining access to organisations and selling that access to other criminals.

The broker does not necessarily deploy ransomware, steal large volumes of data or conduct the final attack. Their role comes earlier in the chain. They find a way into an organisation, establish that the access works, and then offer it to another threat actor.

This has changed the economics of cybercrime. Instead of every ransomware operator having to find and compromise its own victims, access can be purchased from someone who has already done the initial work. Microsoft describes access brokers as part of the commercialisation of cybercrime, with brokers selling stolen credentials and footholds into organisations. (Microsoft Digital Defense Report)

The result is a specialised criminal market where access itself becomes a commodity.

A stolen employee password can become a product.

A compromised VPN account can become a product.

Access to a corporate network can become a product.

Once that access is sold, another criminal can use it as the starting point for ransomware, fraud, espionage or data theft.

What Is an Initial Access Broker?

An IAB is an attacker who obtains unauthorised access to an organisation and sells that access to another threat actor.

Palo Alto Networks Unit 42 defines IABs as actors who offer compromised network access for sale. Their motivation is generally to sell the access rather than conduct the final attack themselves. Unit 42 has also observed ransomware groups using access purchased from IABs. (Palo Alto Networks Unit 42)

The distinction matters because it separates the initial intrusion from what happens later.

Consider a simple example.

An attacker obtains an employee’s credentials.

They test the credentials against a corporate VPN.

The credentials work.

The attacker confirms that the account provides access to the organisation.

Rather than immediately launching ransomware, the attacker sells the access.

A ransomware affiliate purchases it.

The affiliate enters the environment and begins its own attack.

The organisation may therefore be dealing with a ransomware incident even though the group deploying the ransomware was not responsible for the original compromise.

That separation makes attribution and prevention more difficult.

What Do Initial Access Brokers Sell?

IABs can sell different forms of access depending on what they have obtained.

Stolen Credentials

Username and password combinations are one of the most basic forms of access.

Credentials can originate from phishing, previous data breaches, password reuse or infostealer malware.

Infostealers are particularly relevant because they can collect saved passwords, browser information, session cookies and other authentication material. Microsoft has reported that infostealers are feeding a wider criminal economy in which stolen credentials and tokens support downstream compromise. (Microsoft Digital Defense Report)

VPN Access

A compromised VPN account can provide a direct route into an organisation’s network.

If the account has weak authentication or does not use MFA, an attacker may be able to authenticate using the stolen credentials alone.

RDP Access

Remote Desktop Protocol access can also be valuable because it can provide an interactive route into a Windows environment.

Access to a remote system may be sold when an attacker has already compromised an exposed or poorly protected service.

Web Shells and Server Access

An IAB may compromise a public-facing server and establish a way to execute commands remotely.

That access can then be sold to another threat actor.

Network Footholds

The most valuable access can involve an established foothold inside an organisation.

The seller may provide details about the compromised environment, the affected account, available privileges and the type of access obtained.

The buyer is then able to begin its own operation from an already established position.

Unit 42 has documented IAB activity involving compromised servers and techniques designed to establish unauthorised access to targeted organisations. (Palo Alto Networks Unit 42)

Where Do Initial Access Brokers Operate?

IAB activity takes place across criminal communities and marketplaces.

Relevant activity can appear across Tor, Telegram and I2P, as well as criminal forums, marketplaces and private channels.

Tor is commonly associated with hidden services and underground marketplaces.

Telegram provides fast-moving channels and direct communication between buyers and sellers.

I2P is another privacy-focused network that can support criminal activity.

These networks should not be treated as interchangeable, and no single source provides complete visibility into all criminal activity.

A broker may advertise access in one place and communicate privately somewhere else.

Access may also move between communities.

This is one reason external monitoring cannot rely on a single website or network.

The objective is to identify relevant exposure across multiple sources and establish whether the advertised access relates to the organisation being monitored.

How Access Is Obtained

IABs use many different techniques to obtain access.

Some rely on stolen credentials.

Others exploit vulnerabilities in internet-facing systems.

Some use phishing or malicious websites to capture authentication information.

Others may purchase credentials from infostealer operators or obtain access through existing criminal relationships.

Microsoft’s reporting shows that access brokers operate within a broader cybercrime economy where stolen credentials and access are traded as services. (Microsoft Digital Defense Report)

The specific technique matters less to the defender than the result.

The attacker has obtained a valid route into the organisation.

Once that happens, the access may become available to someone else.

This creates a security problem that can be difficult to see from inside the organisation.

An internal team may not know that an employee’s credentials have been advertised for sale.

The account can appear normal.

The user may still be working normally.

The security team may have no reason to suspect that someone outside the organisation is preparing to use the account.

How Access Is Priced and Traded

The value of an access listing depends on what the buyer receives.

A single username and password may be less valuable than access to a privileged account.

A working VPN account may be more attractive if it provides direct access to an internal network.

Access to an organisation with valuable data or high operational importance can attract greater interest.

The exact prices vary across criminal markets and should not be treated as fixed.

What matters is that access has become a tradable commodity.

Microsoft’s Digital Defense Report describes this as access as a service, with brokers selling stolen credentials and footholds that make intrusions easier for other criminals. (Microsoft Digital Defense Report)

The commercial model creates a division of labour.

One criminal finds the access.

Another buys it.

Another may conduct the ransomware deployment.

Another may handle negotiation or data resale.

This makes cybercrime more specialised and allows attackers to focus on specific stages of an operation.

The Link Between IABs and Ransomware

The relationship between IABs and ransomware groups is one of the clearest reasons access brokerage matters.

Ransomware operations need victims.

They also need reliable ways to get into those victims.

An IAB can provide that first step.

Unit 42 has documented ransomware actors purchasing compromised access from initial access brokers. In its analysis of Ransom Cartel, Unit 42 noted that the group relied on this type of service to gain initial access for ransomware deployment. (Palo Alto Networks Unit 42)

Unit 42 has also reported that LockBit operators worked with IABs to save time and increase profit potential. The operators expressed interest in access methods including RDP, VPN and corporate email credentials. (Palo Alto Networks Unit 42)

This relationship explains why an exposed credential can have consequences far beyond account takeover.

The person who steals the credential may not be interested in the organisation itself.

They may simply want to sell the access.

The buyer may have very different intentions.

Why a Compromised Credential Can Become a Ransomware Incident

Imagine an employee’s password appears in a stolen credential dataset.

The employee reused that password for a corporate service.

An attacker tests it.

The login works.

The attacker discovers that MFA is not enabled.

The account provides VPN access.

The attacker establishes a foothold.

The access is then sold to a ransomware affiliate.

The affiliate enters the network, identifies high-value systems, steals data and deploys ransomware.

The original credential exposure may have happened weeks or months before the ransomware incident.

This is why the time between exposure and discovery matters.

If the organisation identifies the compromised credential early, it can reset the password, revoke sessions and investigate the account before an IAB has an opportunity to sell it.

If the organisation discovers the problem only after ransomware is deployed, the opportunity to prevent the intrusion has already passed.

Why Credential Monitoring Matters

Traditional security controls focus heavily on activity occurring inside the organisation.

Endpoint security watches endpoints.

Network security watches traffic.

Identity security watches authentication.

These controls are important, but they may not tell you that an employee credential has already been advertised outside the organisation.

External credential monitoring addresses a different question:

Has information that could be used to access our organisation already escaped?

DarkThreatX monitors 100B+ records and 1M+ new stealer logs per week, with monitoring operating 24/7 and alerts delivered in under five minutes.

The platform reports zero false positives.

Relevant criminal intelligence can appear across Tor, Telegram and I2P, along with forums and marketplaces.

No single source has full coverage of criminal activity, so monitoring across multiple sources is important.

The goal is to identify relevant exposure while defenders still have time to act.

How to Defend Against Initial Access Brokers

Defending against IABs starts with reducing the value of compromised access.

Enforce MFA

MFA adds another authentication requirement when a password is compromised.

It is particularly important for VPN, remote access, administrative and cloud accounts.

Stop Password Reuse

Employees should use unique passwords for corporate services.

A password exposed in an unrelated breach should not provide access to corporate systems.

Monitor Employee Credentials

Use employee credential monitoring to identify compromised employee credentials and investigate them before they become an access opportunity.

Monitor External Exposure

Organisations should monitor relevant criminal sources for credentials, access listings and other information connected to their domains and employees.

Enterprise dark web monitoring can help security teams identify external exposure and investigate potential threats.

Protect Remote Access

VPN, RDP and other remote access services should be tightly controlled.

Restrict unnecessary exposure, require strong authentication and monitor authentication activity for suspicious behaviour.

Rotate Compromised Credentials Quickly

If a credential appears in criminal intelligence, assume it may be known to attackers.

Reset it.

Revoke active sessions where appropriate.

Investigate recent authentication activity.

Do not wait for evidence that someone has already used it.

The IAB Problem Is a Time Problem

The most important point about initial access brokers is not simply that they exist.

It is how quickly access can move through the criminal economy.

A credential can be stolen.

It can be tested.

It can be advertised.

It can be purchased.

It can then be used by another threat actor.

The organisation targeted in that chain may have no visibility into any of those steps.

By the time the final attack begins, the original compromise may be difficult to trace.

This is why reducing the exposure window matters.

If a stolen credential is detected quickly, security teams can invalidate it before it becomes useful to a broker.

If a compromised VPN account is identified before it is sold, the buyer has nothing useful to purchase.

If a suspected access listing is detected, the organisation can investigate before the access becomes an active intrusion.

Conclusion

Initial access brokers have created a specialised market for compromised access.

They obtain credentials, remote access, server footholds and other ways into organisations, then sell those assets to other criminals.

Ransomware groups can use that access to skip the initial compromise stage and move directly into the attack.

That makes IABs an important part of the modern cybercrime supply chain.

The defensive response is not limited to detecting ransomware.

Organisations need to identify the exposure that can happen before ransomware arrives.

That means enforcing MFA, protecting remote access, preventing password reuse, rotating compromised credentials and monitoring criminal sources for exposed access.

DarkThreatX provides continuous monitoring across relevant criminal intelligence sources, including Tor, Telegram and I2P, with 100B+ records monitored, 1M+ new stealer logs per week, 24/7 monitoring, and alerts in under five minutes.

The earlier an organisation knows that its credentials or access are being traded, the more opportunity it has to invalidate them.

An IAB can turn a stolen credential into an attack.

The defender’s objective is to make sure that credential stops working before someone gets the chance to buy it.

Frequently Asked Questions

What is an initial access broker?

An initial access broker is a criminal who compromises an organisation and sells the resulting access to another threat actor. Instead of carrying out the full attack themselves, IABs specialise in obtaining credentials, remote access or network footholds and making those assets available to other criminals. (Palo Alto Networks Unit 42)

What do initial access brokers sell?

IABs can sell stolen credentials, VPN and RDP access, compromised servers, web shells and established network footholds. The exact access varies by victim and compromise. Security researchers have documented IAB activity involving compromised servers, credentials and other forms of network access sold to other threat actors. (Palo Alto Networks Unit 42)

Where do IABs operate?

Initial access brokers operate across criminal forums, marketplaces and communication channels. Relevant activity can appear across Tor, Telegram and I2P, alongside other criminal infrastructure. No single network or monitoring source provides complete visibility into every IAB or criminal marketplace, so monitoring multiple relevant sources is important.

How do you defend against IABs?

Defence starts with reducing the value of compromised access. Enforce MFA, prevent password reuse, protect VPN and RDP services, monitor for exposed employee credentials, rotate compromised secrets and investigate suspicious authentication. External monitoring can identify credentials or access being traded before another criminal purchases and uses them.