An initial access broker is a cybercriminal whose primary role is, well, gaining initial access to networks. Once they have access, IABs don't typically concern themselves with what happens next. 

They'll steal credentials, compromise VPN sessions, steal remote desktop protocol (RDP) login information, deploy web shells, capture cloud access credentials, and then sell whatever they find to the highest bidder on dark web forums and marketplaces. Since their business is access, they usually provide detailed documentation on who that access leads to: the size of the company, its industry, estimated revenue, the level of access stolen, and so on. Buyers can "shop" for access on cybercrime forums, combing through access broker listings like a catalog.

If initial access brokers sell access, you might be wondering how exactly they fit into a ransomware operation. Ransomware actors used to have to find access themselves. That meant spending weeks or months finding vulnerabilities, launching phishing campaigns, establishing a beachhead, pivoting for privilege escalation and persistence, and only then starting on the extortionist tooling required for a ransomware attack. It's time-consuming and costly.

Access brokers changed that. Instead of spending time finding access, ransomware affiliates can simply purchase access and go straight to work, escalating privileges, moving laterally through the environment, and deploying their ransomware payload. As you can imagine, this dramatically accelerates attack timelines.

Put simply: access brokers don't just enable modern ransomware operations—they supercharge them.

To understand the modern ransomware-as-a-service (RaaS) ecosystem, it's important to recognize that it has layers. First, there are the ransomware-as-a-service groups themselves—criminal organizations that create ransomware tooling and lease it out to affiliates, hackers who run attacks using the RaaS group's tools. Affiliates typically split a percentage of any successful ransom payout with the RaaS operation.

Ransomware affiliates can buy access from IABs, giving them a reliable footing in the target network. Suddenly, you've got three layers operating together: developers writing and selling ransomware, brokers selling access to those developers' affiliates, and affiliates running rampant.

Just as any market with demand, the initial accessbroker market has ironed out many wrinkles over the years. Buyers and sellers have established consistent pricing for what access is worth—access to a larger network will cost more than access to a smaller operation. Access with administrator-level privileges will run you more than baseline user access. Certain industries, such as healthcare, finance, and critical infrastructure, command higher prices across the board.

Volume has increased, too, as ransomware affiliates have been able to operate with far fewer skills than would have previously been required. Today, all you need to run a ransomware attack is money and a criminal forum account. IABs have made discovery and access routine.

For starters, a compromise isn't clean just because it doesn't involve ransomware. Attackers selling access to your network might not bother with pricey exfiltration routines and post-exploitation encryption if all they want is money. By the time a ransomware group follows through on its purchased access, your adversary has been in your environment long enough to collect techniques, tactics and procedures (TTPs) about how you operate.

You need to be monitoring for the smaller tells that something is amiss: anomalous authentication, suspicious remote access sessions, unusual patterns of credential abuse, and lateral movements on endpoints. Tools like Huntress Managed ITDR and Huntress Managed EDR are designed to catch those identity and endpoint signals, so you’re not waiting until files start encrypting to realize something is wrong.

Many of the access points leveraged by IABs are practically so standard they're beige.

Stolen credentials—perhaps from a previous infostealer malware attack or a brute-force credential stuffing attack—give attackers access to a valid user's account, especially if that account lacks MFA. RDP services found on the internet are a gift to attackers. Same for unpatched systems: if you're running exposed software with known vulnerabilities, you're already behind the curve. Cybercriminals and IABs actively search for systems like these.

And then there are VPN servers. Access that looks, to an insider, like a legitimate remote work session is incredibly valuable. Credentials or not, if your VPN server is exposed to the internet and unpatched, you could be in trouble.

Patch quickly. If you have internet-facing systems, a slow patch cycle is akin to putting a "hack me" sign on your network. Harden your remote access protocols. Internet-facing RDP is truly never OK. If you must expose it to the internet (you shouldn't), make sure you've enabled MFA and network-level authentication. User credentials alone should never be enough to navigate your environment. 

Monitor for evidence of credential abuse. Unusual login locations, strange off-hours activity, and sudden privilege escalations are just a few of the signals you should watch out for after brokered access hits your network.

 
Huntress Managed EDR, Managed ITDR are designed to detect these types of signals. Get a demo of the Huntress platform, because late detection is no detection.