An initial access broker (IAB) is a criminal who specializes in getting into organizations and selling that access to others. The broker does not usually carry out the final attack. Instead, the access is sold to buyers such as ransomware affiliates or data thieves.

How it works

• Brokers collect access in bulk, for example stolen VPN or remote desktop logins, stealer logs or systems with unpatched vulnerabilities.
• They test that the access works, sometimes add a backup way in, and sort victims by value.
• They advertise the access on criminal forums with details such as sector, country, revenue and privilege level, but not the company name.
• The buyer then uses the foothold for lateral movement, data theft or encryption.

The UK NCSC describes IABs as a separate layer of the cybercrime ecosystem that filters large volumes of access for the most valuable targets. MITRE ATT&CK lists buying existing access as technique T1650.

Why it matters for dark web monitoring

An access sale is often the last warning sign before a ransomware attack. Spotting an advert that matches a company’s profile, or credentials for its remote access services, gives defenders a chance to reset accounts and close the entry point first.

Sources: NCSC: Ransomware, extortion and the cyber crime ecosystem, MITRE ATT&CK T1650: Acquire Access