Initial Access Brokers: How Access Is Sold and Defended

Most ransomware intrusions no longer start with the ransomware crew: they start with someone else who broke in earlier, tested the access and sold it. Initial access brokers (IABs) turn stolen credentials, unpatched VPNs and malware infections into validated footholds, priced by the victim's revenue, sector and the privilege attached. This guide explains how the access trade works according to Europol, the UK NCSC and MITRE ATT&CK, what brokers look for in your estate, and what to do in the first hours after you learn your access is being advertised. It is for threat intelligence analysts, SOC leads and identity teams. The wider criminal supply chain is covered in the Cybercrime Ecosystem Guide; this page goes deeper on the broker stage and does not repeat it.

Key takeaways

Access is a commodity with a price list. Europol's IOCTA 2025 says the sale of access to compromised systems and accounts is "a thriving part of the criminal ecosystem", with price driven by sector, size, revenue, location, access type, persistence and exclusivity.
Most brokered access is opportunistic. The NCSC and National Crime Agency describe brokers taking in large volumes of access and filtering it later for valuable victims, so your exposure to common weaknesses matters more than whether anyone has targeted you.
Credentials are the main stock. VPN, RDP, firewall and cloud logins, infostealer logs and session cookies dominate listings; Europol notes stolen cookies and tokens often stay valid for long periods.
The gap between sale and ransomware can be very short. Microsoft has observed access to ransom, including the broker to affiliate handoff, taking less than an hour in some cases, while other footholds sit unused for months.
An advert about you is an incident, not an intelligence note. Treat a credible listing as confirmed compromise: rotate credentials, revoke sessions, hunt for the broker's backup access and assume more than one buyer.

What brokers sell and how they differ

MITRE ATT&CK models buying access as T1650 Acquire Access, a resource development technique: the buyer skips the work of getting in and focuses on later stages. ATT&CK notes buyers may prioritise systems that lack security monitoring or hold high privileges, and that access to IT contractors, software developers and telecoms can open further victims through T1199 Trusted Relationship or T1195 Supply Chain Compromise. Brokers are not one type.

Broker model	What is sold	Typical source	Examples in public reporting
Bulk credential seller	Unverified lists of usernames and passwords, infostealer logs by subscription	Infostealer malware, breach dumps, credential stuffing	Europol describes infostealer-log channels with weekly to annual subscriptions costing tens to hundreds of USD
Validated access broker	Tested access to a named or described organisation, often with network size and privilege noted	Credentials tested against VPN, RDP, Citrix or cloud portals	NCSC describes testing, setting up backup access and valuing victims from company records
Malware loader distributor	An installed "load" that runs a buyer's payload on infected machines	Phishing, malvertising, fake updates	ATT&CK lists TA577 (QakBot, Pikabot, Latrodectus), Mustard Tempest (SocGholish, also DEV-0206, TA569) and EXOTIC LILY as brokers
Exploit-led mass compromise	Web shells or backdoors on edge devices and web applications	Scanning for newly disclosed vulnerabilities	Europol notes IABs exploit public-facing infrastructure and use exploit kits against unpatched systems
Advanced or private broker	Zero-day exploits, access to large corporations, IT supply chains and critical infrastructure	Own exploitation capability	Europol says these are traded privately, possibly for a share of the buyer's earnings

Listings that mention a Domain Administrator credential, or note that no antivirus or EDR is present, command higher prices, according to Microsoft. The same access can be resold, so several criminal groups may work the same victim at once, which Europol also highlights.

Where brokers get your access

The table maps the main access sources to ATT&CK v20 and to the control that most directly removes them. These are the weaknesses a broker's filter is looking for.

Access source	ATT&CK v20	Control that removes it
VPN, RDP or VDI login with a password only	T1133, T1078	Phishing-resistant MFA on every remote access path, no exceptions for service or break-glass accounts without compensating controls
Infostealer logs from personal or contractor devices	T1555.003, T1539	Managed device requirement for corporate access, token binding where available, short session lifetimes
Replayed session cookies	T1550.004	Conditional access on device compliance, continuous access evaluation, session revocation on risk
Password spraying and credential stuffing	T1110, T1110.004	Breached password screening, lockout and smart throttling, MFA
Voice phishing for VPN credentials	T1566.004	Help desk identity verification, number matching, FIDO2 keys
Unpatched internet-facing systems	T1190, T1505.003	KEV-driven patching of edge devices within days, no exposed management interfaces
Malware loader infection	T1219 (follow-on remote access)	EDR on all endpoints and servers, script and macro restrictions, remote management tool allow listing

The edge device route is covered in the Edge Device Exploitation by Threat Actors Guide, and the infostealer route in the Infostealer Threat Guide and Lumma Stealer Guide.

Where identity fits

Brokers trade identities more than exploits. A listing is usually a working account: a contractor's VPN login, a cloud console user, a stolen session, or a service account whose password sat in a configuration file. Non-human identities are attractive because they rarely have MFA, are excluded from conditional access, and are not monitored for unusual sign-ins. The Mandiant investigation into the 2024 Snowflake campaign found that at least 79.7% of the accounts the attacker used had prior credential exposure, some credentials dated back to November 2020 and had not been rotated, and many infections started on contractor laptops also used for gaming and pirated software. See the Snowflake breach of 2024.

Contractors and third parties: one infected unmanaged laptop can expose several clients at once. See the Contractor Identity Lifecycle Guide and the Third-Party Access Guide.
Service accounts and API keys: inventory them, remove interactive logon rights, and alert on any sign-in from the VPN pool or a new network. See the Service Account Security Guide.
Sessions: password resets do not end a stolen session. Plan revocation of refresh tokens and SSO sessions as part of every credential response. See the Session Hijacking and Cookie Theft Guide.

From sale to ransomware: the handoff

Understanding the handoff explains why detection windows are short and why attribution is so often unclear.

Collection: the broker accumulates access in bulk. The NCSC notes brokers often buy stolen credentials in bulk or scan for vulnerable systems themselves.
Validation and triage: access is tested, backup access is often added, and the victim is sized and valued from public and commercial company records.
Advertising: a listing appears on a forum or market. Europol reports that forums are used mainly for advertising, while negotiation and payment increasingly move to encrypted messaging.
Sale: the NCSC says access sells for thousands of US dollars depending on the victim's value; Europol, citing CrowdStrike, reports the price of advertised access rose by almost 50% in 2024. Lower-level ransomware affiliates are the main buyers, according to Europol.
Hands-on intrusion: the buyer uses the foothold, often as a jump server, without necessarily knowing how it was obtained. CrowdStrike's 2026 Global Threat Report puts average eCrime breakout time at 29 minutes.

Because access, intrusion and extortion are split across different actors, the NCSC says it is often impossible to attribute an incident to a single group. For the business model behind the buyers see the Ransomware-as-a-Service Business Model Guide.

Monitoring for your access on criminal markets

You do not need analysts on criminal forums to benefit from access market intelligence, and in most organisations you should not have them there. Options, in rising order of cost:

Option	What you get	Fits	Trade-off
Free breach notification and government alerts	Notice when credentials for your domains appear in known dumps; national CERT and law enforcement victim notifications	Every organisation as a baseline	Late and incomplete; misses private sales
Identity provider leaked credential detection	Automatic risk flag when a user's password appears in feeds the provider monitors	Organisations on a major cloud IdP	Covers only accounts in that IdP, not local VPN or appliance accounts
Commercial dark web and infostealer monitoring	Alerts on listings that describe you, stealer logs containing your domains or SSO URLs	Mid-size and larger organisations, MSPs	Quality varies; needs triage and a response owner
Dedicated threat intelligence team with vetted access	Context on actor reputation, listing credibility, and early sight of access sales	Large enterprises, critical infrastructure, financial services	Costly; legal and ethical rules on engagement with criminals must be set by counsel

The Dark Web Monitoring Guide and Dark Web Monitoring Buyer's Guide cover selection. Never buy back access or data to "verify" a listing: it funds the trade and may breach sanctions rules.

Decision guidance: a small organisation gets most value from IdP leaked credential detection, enforced MFA on every remote path and an MSP or MDR contract that includes a response to credential alerts. A large organisation should feed commercial stealer-log and listing alerts directly into the identity team's queue with an agreed response time, because an alert that waits for a weekly intelligence report is useless against a 29 minute breakout.

When your access is advertised: first 24 hours

Listings are often vague ("US manufacturer, USD 500m revenue, VPN with domain user"), so start by working out whether it is you, but do not wait for certainty before rotating the obvious credentials.

Assess the listing: match the described revenue, sector, country, access type and privilege against your estate. Record what the source says and its reliability; preserve the alert as evidence.
Identify candidate entry points: list every remote access path that fits (VPN, VDI, RDP gateways, SSO portal, cloud consoles, MSP tooling) and pull authentication logs for the past 90 days.
Reset and revoke: force password resets for accounts seen in stealer logs or used from new devices or networks, revoke their refresh tokens and sessions, and rotate service account and API credentials reachable from the suspected path.
Hunt for backup access: brokers commonly add persistence before selling. Look for new local or domain accounts (Windows events 4720 and 4732), new MFA methods registered, new OAuth app consents, remote management tools, new VPN profiles and web shells on internet-facing servers.
Tighten the perimeter temporarily: restrict remote access to managed devices, block legacy authentication, require re-registration of MFA for affected users, and consider geo or network allow lists for administrative access.
Escalate and share: brief the incident manager and legal; report to the national CERT or law enforcement if policy requires. Assume more than one buyer and keep monitoring for at least 30 days.
Roll back safely: document every temporary restriction with an owner and expiry so emergency controls do not become permanent outages, and lift them only after the hunt is closed.

The Leaked Credential Response Playbook gives the detailed steps for credential rotation.

Detection and measurement

Sign-in anomalies on remote access: first-seen device, impossible travel, logins from hosting providers or residential proxies, and successful logins after many failures (Windows 4625 followed by 4624).
Quiet reconnaissance: brokers test access and leave. A single short session that enumerates shares or the directory, then nothing for days, is a classic broker pattern.
Persistence without payload: new accounts, new MFA methods or remote access tools with no business change ticket.
Exposure signals: stealer logs containing your SSO URL or VPN hostname, and listings matching your profile.

Metrics:

MFA coverage on remote access: percentage of VPN, VDI, RDP gateway and cloud console logins protected by phishing-resistant MFA (target 100%).
Time to rotate exposed credentials: median hours from stealer-log or leak alert to password reset and session revocation.
Unmanaged device access: percentage of corporate sign-ins from devices not managed or not compliant.
Stale credentials: number of accounts, including service accounts, with passwords older than policy allows.
Alert to triage time for listings: hours from a market listing alert to a documented "is it us" decision.

Framework mapping

Framework	References	Relevance
NIST CSF 2.0	ID.RA-02, ID.RA-03, PR.AA-01, PR.AA-03, DE.CM-03, DE.AE-02, RS.AN-03	Threat intelligence intake, threat identification, credential management and authentication, monitoring and analysis
NIST SP 800-53 Rev. 5	PM-16, RA-3, AC-2, IA-5, AC-17, SI-4	Threat awareness, risk assessment, account and authenticator management, remote access, monitoring
CIS Controls v8.1	Control 5, Control 6, Control 13	Account management, access control management, network monitoring and defence
ISO/IEC 27001:2022 Annex A	A.5.7, A.5.17, A.8.16	Threat intelligence, authentication information, monitoring activities
MITRE ATT&CK v20 and D3FEND	T1650, T1078, T1133; D3-CR Credential Revocation, D3-ANCI Authentication Cache Invalidation, D3-LAM Local Account Monitoring	The purchase, the use of valid accounts, and the countermeasures that make sold access worthless

Common failure patterns

Treating a listing as intelligence to file: the alert sits in a report while the buyer is already inside. Listings need an incident owner and a response time.
Resetting passwords but not sessions: stolen cookies and refresh tokens keep working; Europol notes they often stay valid for long periods.
MFA everywhere except the VPN appliance or service accounts: brokers filter for exactly these gaps. The Cisco breach of 2022, which Cisco Talos linked to an initial access broker, began with a synced browser password and MFA fatigue against the VPN.
Ignoring contractor devices: unmanaged contractor laptops carrying credentials for several clients were a recurring infection source in the Snowflake campaign.
Cleaning the payload but not the broker's backup access: removing ransomware or a loader while leaving the extra account or remote tool the broker planted invites a second buyer.
Assuming one attacker: resold access means more than one group may be present; hunting stops too early.

Lessons from incidents

Snowflake 2024: infostealer credentials, some years old, no MFA and no network allow lists gave access to about 165 customer environments. Stale credentials are stock that never expires. See the Snowflake breach.
EXOTIC LILY 2021 to 2022: Google's Threat Analysis Group described a broker sending more than 5,000 emails a day to as many as 650 organisations, using lookalike domains and file-sharing notifications, with ransomware such as Conti deployed later by different actors.
Operation Endgame 2024: Europol coordinated action in May 2024 against droppers including IcedID, Smokeloader, Pikabot, Bumblebee, Trickbot and SystemBC, taking down over 100 servers. Takedowns disrupt supply but brokers rebuild; see the Cybercrime Law Enforcement Takedowns Guide.

Practitioner checklist

Enforce phishing-resistant MFA on every remote access path, including VPN appliances, VDI and cloud consoles.
Require managed, compliant devices for corporate access, including contractors.
Enable leaked credential detection in your identity provider and route alerts to the identity team with a response time.
Subscribe to stealer-log or dark web monitoring that covers your domains, SSO URLs and VPN hostnames, sized to your organisation.
Write a "listing about us" runbook covering assessment, reset and revoke, hunting for backup access and escalation.
Revoke sessions and refresh tokens every time credentials are reset after exposure.
Inventory service accounts and API keys, remove interactive logon and alert on remote access sign-ins by them.
Patch KEV-listed internet-facing vulnerabilities within days and hunt for web shells after any edge exploitation.
Track the five metrics above monthly and report them with ransomware risk.

Initial Access Brokers Guide: How Access Is Sold and How to Respond