Ransomware is shifting toward access markets and infrastructure

At a glance

What this is: Chainalysis says ransomware in 2025 increasingly operated as a market for access, infrastructure and monetisation, even as on-chain payments fell and victim reports climbed.

Why it matters: IAM, PAM and NHI teams need to treat access brokerage, standing privilege and shared infrastructure as part of ransomware risk, not just incident response after encryption begins.

Context

Ransomware is no longer best understood as a single intrusion followed by extortion. The article describes a broader market in which access brokers, infrastructure providers and monetisation operators make the attack chain more modular, which changes where defenders need to intervene. That matters for IAM because the earliest stage is increasingly the sale or reuse of access rather than the malware event itself.

For identity and security teams, the governance problem is that the control boundary now extends upstream into credential exposure, third-party access and infrastructure anonymity. When attackers can buy access, reuse infrastructure and coordinate timing, the security model cannot rely on post-encryption response alone. The article’s picture is atypical only in scale, not in direction, because the same access-driven pattern is now visible across multiple ransomware ecosystems.

Key questions

Q: What breaks when ransomware actors buy access instead of stealing it themselves?

A: When attackers buy footholds, traditional perimeter indicators arrive too late because the initial compromise has already been converted into authenticated access. That shifts risk to identity controls, especially exposed service accounts, stolen tokens, and overprivileged remote access. Organisations that do not monitor broker-style activity lose the chance to interrupt the campaign before lateral movement and extortion begin.

Q: Why do standing privileges make ransomware incidents harder to contain?

A: Standing privileges give an attacker more authority after the first login, which shortens the time needed to move from access to disruption. When admin rights, service accounts, or vendor entitlements remain broadly usable, a single compromise can affect multiple systems before response teams can narrow the blast radius.

Q: What are the signs that an email-based ransomware campaign is moving beyond initial access?

A: A campaign is likely moving beyond initial access when operators begin reconnaissance, privilege escalation, and lateral movement after the first payload lands. Observable signs include malicious Office documents, macro execution, downloader activity, suspicious backdoor traffic, and follow-on tools such as Cobalt Strike. Short dwell time before encryption is another warning that the threat actor has already progressed deep into the environment.

Q: How should organisations respond when ransomware takes critical systems offline and communication becomes opaque?

A: Organisations should shift immediately into disciplined incident response: isolate affected systems, preserve evidence, verify the scope of encryption, and communicate clearly and regularly to customers, employees, and regulators. Delayed or vague updates deepen trust loss and can worsen operational disruption. A prepared response plan should define escalation paths, approval rights, external communications, and recovery priorities before an incident begins.

Technical breakdown

Why access brokers have become part of the ransomware supply chain

Initial Access Brokers, or IABs, specialise in obtaining and reselling footholds into enterprise environments. In practical terms, they convert credential theft, exposed services and abused accounts into inventory that downstream operators can monetise. That separates access acquisition from extortion execution and makes the ecosystem more scalable. The article’s data point that access-market activity often precedes later ransomware outcomes by roughly 30 days indicates that defenders need to watch for precursor signals, not just the final payload. In IAM terms, the decisive control question becomes whether access is discoverable, attributable and revocable before it reaches an affiliate market.

Practical implication: Monitor for brokerable access patterns and treat exposed accounts as a pre-ransomware condition, not a low-severity issue.

How shared infrastructure reduces detection and attribution

The article shows ransomware actors, criminal groups and state-linked operators using the same bulletproof hosting, residential proxy networks and loader infrastructure. That convergence matters because infrastructure reuse gives attackers operational anonymity, makes takedowns less durable, and blurs the line between financially motivated crime and broader threat activity. For defenders, the technical issue is not only where the payload runs, but how the attacker preserves reach, rotates sources and avoids reputation-based blocking. Shared infrastructure also means one disruption can create pressure across multiple campaigns, but only if it targets the service layer rather than a single actor brand.

Practical implication: Track hosting, proxy and loader infrastructure as shared threat enablers and feed those indicators into detection and disruption workflows.

Why ransomware economics now favour precision over volume

The article describes a split market in which overall payments flattened while median payments rose sharply and smaller, faster targets became more attractive. That reflects a two-tier economy: low-cost access is abundant, while verified or high-privilege access still commands a premium. For identity governance, that means privilege scope, authentication strength and third-party access lifecycle have direct economic value to attackers. The more expensive or constrained the access is for the defender to replace, the more leverage it has for the attacker. The result is a control environment where access quality matters as much as the number of incidents.

Practical implication: Prioritise controls that reduce the market value of stolen access, especially by limiting privilege, shortening credential life and removing reuse.

Threat narrative

Attacker objective: The objective is to monetise enterprise access quickly and repeatedly by turning a foothold into extortion leverage, sometimes before the victim can even detect the initial compromise.

1. Entry begins with access-market acquisition, where attackers or affiliates buy or broker footholds instead of creating them from scratch.
2. Credential and privilege abuse follow when the purchased access is used to move from a foothold to a runnable ransomware position.
3. Impact occurs when the access is monetised through extortion, leak-site pressure or coordinated ransomware deployment.

Breaches seen in the wild

• Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access brokerage is now a governance problem, not just an intrusion problem. When ransomware markets pay for footholds before they pay for encryption, identity and access teams inherit part of the threat surface. That shifts the defensive unit from the incident to the access lifecycle, where inventory, ownership, expiry and revocation determine whether a foothold becomes monetisable.

Ransomware infrastructure sharing weakens actor-centric defense models. When criminals and state-linked operators rely on the same bulletproof hosting and proxy layers, brand-based threat models lose explanatory power. The practical conclusion is that defenders should weight infrastructure and service-layer indicators more heavily than group labels, because the same anonymity stack can support several campaigns at once.

High-value access creates a premium in the underground economy. The article’s access-market data reinforces a named concept we would call access liquidity: the easier it is to convert a credential, session or host into downstream misuse, the more attractive it becomes to brokers and affiliates. That makes privileged identity governance an economic control, not only a compliance one.

Identity governance has to move upstream into the ransomware kill chain. Traditional ransomware response assumes the meaningful battle starts at encryption or exfiltration. In this market, the useful control point is earlier, where access is discovered, traded and staged for use. Practitioners should therefore treat access review, offboarding and privilege minimisation as anti-ransomware controls with measurable operational value.

Disruption efforts are increasingly aimed at the ecosystem, and that is the right direction. The article shows why law enforcement and private-sector takedowns are shifting toward hosting, loaders and proxy services rather than only named groups. For practitioners, the implication is clear: the more the ecosystem fragments, the more important it becomes to connect access intelligence, infrastructure intelligence and identity governance into one programme view.

What this signals

Access liquidity is a useful lens for ransomware planning. The more easily a credential, session or delegated permission can be converted into usable access, the more likely it is to be traded upstream of extortion. That means identity teams should think about resale value as a security property, not just access convenience.

Ransomware defence now depends on seeing the ecosystem, not only the endpoint. Hosting, proxy and loader services create the operational cover that lets access brokers and affiliates scale abuse across many victims, so detection programmes need to join identity telemetry with infrastructure intelligence.

For practitioners

• Map brokerable access paths Identify which external-facing services, privileged accounts and third-party connections could be turned into saleable access if compromised. Prioritise assets where a single session or token can open multiple downstream paths.
• Shorten the lifetime of exposed access Reduce how long credentials, sessions and delegated permissions remain useful by enforcing rapid expiry, offboarding and revocation for accounts that can be resold or reused.
• Review third-party and brokerable identities Audit vendors, contractors and service relationships for accounts that can be abused as initial access inventory, especially where authentication is weak or access is hard to attribute.
• Add infrastructure intelligence to detection Correlate proxy use, hosting patterns and loader infrastructure with identity events so that suspicious access can be investigated before it turns into ransomware staging.
• Treat access-market signals as early warning Feed findings from leak sites, broker chatter and unusual privilege changes into incident triage because access acquisition often precedes extortion by weeks rather than hours.

Key takeaways

• Ransomware has become a market structure in which access, infrastructure and extortion are economically linked.
• The article shows that on-chain payments can fall even while victim reports and median demands rise, which means volume and value are diverging.
• Practitioners should reduce the tradable value of access by tightening privilege, offboarding faster and watching for brokerable access patterns.

Key terms

• Initial access broker: An initial access broker is an attacker or criminal intermediary that acquires footholds, such as stolen credentials, and then passes them to other threat actors. This role turns access into a commodity and increases the likelihood that simple credential exposure will become a broader breach.
• Access Market: An access market is the underground economy where credentials, sessions, footholds and privileged entries are bought and sold. In ransomware ecosystems, it separates intrusion from extortion and makes access itself a commodity with pricing, quality tiers and reuse potential.
• Bullet-Proof Hosting: Bullet-proof hosting is hosting designed to resist takedowns, complaints, and law enforcement pressure. Operators use it to keep malicious sites, command infrastructure, or payment services online for longer periods. In cybercrime ecosystems, this kind of resilience supports ransomware, malware delivery, and other abuse that depends on persistent access.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners who need to connect access governance to the wider security programme.