What is an initial access broker?
An initial access broker (IAB) is a cybercriminal, or a small group, that specializes in getting into organizations' networks and then sells that access instead of using it. The buyers are usually ransomware affiliates and other extortion crews who would rather pay for a working foothold than spend weeks breaking in themselves. Brokers are one piece of the division of labor in modern cybercrime, where different specialists write malware, gain access, run the intrusion, negotiate with victims and launder the money.
What brokers sell
- Working VPN or remote desktop (RDP) credentials, often on accounts without MFA
- Control of a compromised edge device such as a firewall, VPN appliance or file transfer server
- A web shell planted on an exploited web server
- Logins and session cookies harvested by infostealer malware from employees' browsers
- Remote management tool or cloud console accounts
Listings on criminal forums and in encrypted chat channels describe the victim without naming it: country, industry, annual revenue, number of hosts and the privilege level on offer. Prices vary widely, and domain administrator access at a large company sells for far more than a standard user account at a small business.
A typical sequence
A broker scans the internet for VPN appliances affected by a newly published flaw, exploits hundreds of them and works out which ones belong to companies worth selling. One listing offers, in effect, "EU logistics company, about 2,000 employees, revenue around $300 million, VPN plus local admin on a file server." A ransomware affiliate buys it, signs in with the broker's credentials days or weeks later, moves laterally, steals data and deploys ransomware. From the victim's side the intrusion seems to begin with the affiliate, but the first strange VPN login happened long before.
Detecting and preventing broker access
- Patch internet-facing appliances fast, since brokers race to exploit new edge-device flaws.
- Require phishing-resistant MFA on VPNs, RDP gateways and cloud consoles, and never expose RDP directly to the internet.
- Watch remote access logs for new devices, unexpected countries, impossible travel and sign-ins at odd hours.
- Use compromised credential monitoring and dark web monitoring to find leaked logins, or listings that match your organization.
- After any edge-device vulnerability, hunt for web shells and unknown accounts even once the patch is in.
A broker listing that matches your company suggests someone is probably inside already, so treat it as an incident rather than a curiosity.
Initial access broker vs. related terms
- Ransomware affiliate: buys the access and carries out the attack.
- Ransomware-as-a-service operator: builds the ransomware and leak site and rents them to affiliates.
- Infostealer operator: harvests credentials in bulk, which brokers may buy and test.
- Insider: holds access the organization granted; a broker's access is stolen.
Initial access broker on the CompTIA Security+ exam
In SY0-801, initial access brokers come up as part of the organized crime ecosystem among the threat actors in objective 2.2, and as one of the things dark web monitoring looks for among the threat intelligence sources in objective 2.1. A scenario in which "access to the company's network is advertised for sale" or "stolen VPN credentials are offered on a forum" points to dark web monitoring as the source and organized crime as the actor type. The control answers are MFA on remote access, prompt patching of edge devices and resetting the exposed credentials.