Initial Access Brokers

Initial Access Brokers

Executive Summary

Initial Access Brokers (IABs) are specialized cybercriminal actors who focus exclusively on gaining unauthorized access to corporate networks and then selling that access to other threat actors — most commonly ransomware affiliates. IABs represent a critical node in the cybercrime supply chain, effectively decoupling the intrusion phase from the monetization phase and enabling a division of labor that increases overall ecosystem efficiency. By purchasing pre-validated network access, ransomware operators and affiliates can skip the time-consuming and technically demanding initial intrusion phase, reducing their time-to-impact from weeks to hours.

The IAB marketplace operates primarily on Russian-language cybercrime forums, with Exploit, XSS, and RAMP being the most active venues. Access listings typically specify the victim's country, industry sector, revenue (a key pricing factor), access type (RDP, VPN, web shell, Active Directory credentials), and level of privilege. Pricing varies dramatically: basic RDP access to a small company might sell for $500-$2,000, while domain admin access to a Fortune 500 company can command $20,000-$50,000 or more. The median price for IAB listings is approximately $1,500-$3,000. Some IABs operate through private channels and maintain exclusive relationships with specific ransomware operations rather than selling on open forums.

The infostealer-to-IAB pipeline has become the dominant supply mechanism for access inventory. IABs systematically purchase or harvest infostealer logs from marketplaces (Russian Market, Telegram channels), filter for corporate VPN credentials (Cisco AnyConnect, Fortinet, Palo Alto GlobalProtect, Pulse Secure/Ivanti), validate access, escalate privileges where possible, and list the access for sale. This pipeline means that an employee's malware infection on a personal device — often via malvertising or a trojanized software download — can directly lead to a ransomware attack on their employer weeks or months later. Separately, IABs exploit vulnerabilities in internet-facing infrastructure (VPN appliances, Citrix, Exchange, firewalls) to harvest access at scale.

Key Actors

| Actor/Handle | Forum Presence | Notable Characteristics | Status | |-------------|---------------|------------------------|--------| | Zebra2104 | Multiple forums | Prolific broker; sold access used by multiple ransomware groups | Active (intermittent) | | Sang_real (Frapochka) | Exploit, XSS | High-volume listings across sectors; established reputation | Active | | JETKITTEN | Exploit | Targets education and healthcare | Active | | Roblette | Exploit, XSS | Specializes in European targets | Active | | montns | RAMP, Exploit | Significant listing volume; medium-enterprise focus | Active | | Bostaurus | Exploit | Specializes in access via VPN exploitation | Active | | Various Telegram-based brokers | Telegram channels | Lower-tier access; often direct from infostealer operators | Active | | Multiple unattributed IABs | Private channels | Operate exclusively through private deals with ransomware groups | Unknown |

Note: IAB handles change frequently. Actors rebrand, retire, and new actors enter the market regularly. The above represents observed active handles but is not exhaustive.

Current Activity

Infostealer Log-to-Access Pipeline Acceleration (2024-2025)

The volume of corporate credentials available via infostealer logs has grown substantially, driven by the proliferation of Lumma, StealC, and other stealer families. IABs have industrialized the process of filtering corporate VPN/SSO credentials from bulk log purchases, validating access, and listing it for sale. Some have developed automated tools to test credentials at scale across VPN endpoints. The time from employee infostealer infection to corporate access listing has compressed, with some operations completing the cycle within days. KELA and Flare research indicates IAB listings have grown year-over-year, with several hundred active listings at any given time.

Vulnerability Exploitation for Mass Access Harvesting

IABs increasingly exploit critical vulnerabilities in edge devices to build access inventory at scale. Exploited products in 2023-2025 include Citrix NetScaler/ADC (CVE-2023-4966 "Citrix Bleed"), Fortinet FortiOS (multiple CVEs), Ivanti Connect Secure (CVE-2024-21887/CVE-2023-46805), Cisco ASA/FTD, ConnectWise ScreenConnect (CVE-2024-1709), and Palo Alto PAN-OS (CVE-2024-3400). Actors exploit these vulnerabilities to deploy webshells or create accounts across hundreds of organizations, then sell individual accesses as listings. This approach provides inventory at near-zero marginal cost per victim.

Ransomware-IAB Relationship Tightening

Evidence from ransomware chat leaks (Conti leaks 2022, Black Basta chat leak early 2025) confirms that ransomware operations maintain regular purchasing relationships with IABs, sometimes with standing arrangements for specific types of access (particular sectors, revenue thresholds, geographic regions). Some ransomware programs have dedicated budget lines for access purchases. Premium ransomware affiliates may negotiate exclusive first-look arrangements with top-tier IABs.

Historical Events

| Date | Event | Impact | |------|-------|--------| | 2019-2020 | IAB market formalization | Dedicated access trading sections established on major forums (Exploit, XSS) | | 2020 | RDP access sales surge during COVID | Remote work expansion massively increased available RDP/VPN attack surface | | Feb 2022 | Conti leaks expose IAB purchases | Internal chat logs showed Conti's systematic purchase of access from IABs | | 2022-2023 | RAMP forum gains prominence | Became significant IAB marketplace after its launch, attracting new sellers | | Late 2023 | Citrix Bleed mass exploitation | CVE-2023-4966 exploited at scale; access to affected orgs appeared on forums within weeks | | Jan 2024 | Ivanti Connect Secure mass exploitation | Multiple zero-days in VPN appliance exploited for broad access harvesting | | Early 2025 | Black Basta chat leaks | Confirmed IAB purchasing patterns and pricing for major ransomware operation | | 2024-2025 | IAB listing volumes increase | Research from KELA, Flashpoint, and Group-IB shows sustained growth in access listings |

TTP Evolution

Access Acquisition Methods:

• 2019-2021: Predominantly RDP brute-forcing, VPN credential stuffing from data breaches, and exploitation of common vulnerabilities (BlueKeep, Exchange ProxyLogon/ProxyShell).
• 2022-2023: Shift toward infostealer log harvesting as primary credential source; increasing exploitation of VPN/edge device vulnerabilities.
• 2024-present: Mature pipeline combining automated infostealer log processing with rapid exploitation of newly disclosed vulnerabilities in edge infrastructure. Some IABs specialize in one method or the other.

Access Types Sold:

• RDP/VPN credentials: Most common; buyer needs to do their own reconnaissance and privilege escalation.
• Web shells: Pre-deployed persistent access; common from vulnerability exploitation campaigns.
• Domain admin/enterprise admin: Premium access where IAB has already escalated privileges; commands highest prices.
• Citrix/Remote Desktop Gateway: Provides access to virtualized environments with broader reach.
• Cloud/SaaS access: Emerging category; M365 Global Admin, AWS root credentials from infostealer logs.
• MSP/RMM access: High value due to downstream access to MSP clients; treated as premium listings.

Pricing Factors: Access pricing correlates with: victim revenue (strongest factor), access type and privilege level, country (US/EU commands premium), sector (finance/insurance/healthcare premium), network size, and whether security tools were observed. Forum reputation and seller track record also affect willingness to pay. Auction formats are sometimes used for high-value access.

Operational Security: Established IABs use forum escrow services to protect both parties. Listings avoid naming victims directly, instead providing country, sector, revenue, number of hosts, and access type. Some use "check" services where potential buyers can verify the access is still valid before completing purchase. Communication for sensitive details moves to encrypted messengers (Tox, Jabber/XMPP).

Ecosystem & Infrastructure Patterns

Forum Marketplace Structure: Major forums (Exploit, XSS, RAMP) have dedicated sections for access trading with established rules, escrow services, and reputation systems. Sellers build reputations through consistent delivery and positive buyer reviews. Some forums require initial deposits or vetting to participate. Listings follow semi-standardized formats specifying access parameters.

Supply Chain Position: IABs sit at the critical junction between initial compromise and monetization. Their upstream suppliers include: infostealer operators (providing raw credential logs), vulnerability researchers (providing exploits), and botnet operators (providing infected machine access). Their downstream customers include: ransomware affiliates (primary buyers), corporate espionage operators, data theft groups, and occasionally state-sponsored actors using criminal infrastructure.

Seasonal and Event-Driven Patterns: Access listings spike following major vulnerability disclosures in edge devices, as IABs race to exploit and list access before victims patch. Listing volumes also correlate with infostealer campaign waves. New ransomware programs entering the market can create demand spikes as affiliates stock up on access.

Quality Assurance: Sophisticated IABs provide "freshness" guarantees — confirming that access is validated within a recent timeframe. Some offer brief replacement guarantees if access becomes invalid shortly after sale. The most professional operations provide detailed information about the victim environment (domain structure, security tools observed, number of hosts) to help buyers assess the opportunity.

Pricing Benchmarks (approximate, based on public research):

| Access Type | Typical Price Range | Notes | |------------|-------------------|-------| | Basic RDP (single host, SMB) | $500-$2,000 | Most commoditized | | VPN credentials (enterprise) | $1,000-$5,000 | Varies by company size | | Domain Admin access | $5,000-$30,000 | Premium; ready for deployment | | Citrix/RDS Gateway | $2,000-$10,000 | Broader network reach | | MSP/RMM access | $5,000-$50,000+ | Multiplier effect on downstream clients | | Fortune 500 / high revenue | $10,000-$50,000+ | Revenue-dependent premium | | Web shell (large org) | $1,000-$5,000 | Requires further escalation | | Cloud admin (M365/AWS) | $1,000-$10,000 | Emerging category |

Tooling

| Tool | Category | Usage | |------|----------|-------| | Russian Market / 2easy | Log Sourcing | Purchasing infostealer logs to extract corporate credentials | | Shodan/Censys | Reconnaissance | Identifying internet-exposed VPN/RDP/Citrix infrastructure | | Exploit frameworks (Metasploit, custom) | Exploitation | Exploiting vulnerabilities in edge devices | | Credential testing tools | Validation | Automated testing of harvested credentials against VPN endpoints | | Brute-force tools (Hydra, custom) | Access | RDP/SSH brute-forcing (declining but still used) | | Forum escrow services | Transaction | Protected payment for access trades | | Tox/Jabber/XMPP | Communication | Encrypted messaging for transaction details | | Cobalt Strike/Sliver | Post-Exploitation | Used by some IABs for privilege escalation before sale | | BloodHound | AD Enumeration | Mapping Active Directory to assess access value | | Cryptocurrency (BTC, XMR) | Payment | Primary payment methods for access purchases |

Intelligence Gaps

• Private deal volume: A significant portion of IAB activity occurs through private channels and direct relationships rather than public forum listings. The ratio of public to private access trading is unknown but likely skews heavily toward private, meaning forum monitoring captures only a fraction of activity.
• Time-to-exploitation: The average elapsed time from an access listing appearing on forums to a ransomware affiliate purchasing and deploying ransomware is not well-characterized. Faster timelines reduce the defensive window.
• IAB-ransomware attribution: Connecting specific ransomware incidents to specific IAB listings/sellers is extremely difficult without insider access, law enforcement data, or ransomware group chat leaks. This limits disruption targeting.
• Cloud access pricing and volume: As corporate environments shift to cloud/SaaS, the IAB market for cloud admin access is emerging but not well-studied compared to traditional network access.
• IAB operator demographics: Beyond a few arrested individuals, the demographics, geographic distribution, and organizational structure of IAB operators remain largely unknown.
• Infostealer log to access conversion rate: What percentage of corporate credentials in infostealer logs are actually viable for network access (not expired, not MFA-blocked, etc.) is poorly quantified.

Sources & References

1. KELA - "IAB Landscape Reports" and access listing tracking — https://www.kelacyber.com/
2. Flashpoint - "Initial Access Broker Intelligence" — https://flashpoint.io/
3. Group-IB - "Hi-Tech Crime Trends: Initial Access Brokers" — https://www.group-ib.com/
4. CrowdStrike - "Access Broker Tracking and ECrime Index" — https://www.crowdstrike.com/
5. Mandiant - "FIN12 and Access Broker Relationships" — https://www.mandiant.com/resources
6. Secureworks - "Initial Access Broker Marketplace Analysis" — https://www.secureworks.com/
7. Digital Shadows (now ReliaQuest) - "IAB Marketplace Monitoring" — https://www.reliaquest.com/
8. CISA - Known Exploited Vulnerabilities Catalog (edge device CVEs) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Change Log

| Date | Change | Source | |------|--------|--------| | 2026-04-05 | Initial creation with baseline intelligence through early 2025 | Training knowledge |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Liberty91LTD
• Source: Liberty91LTD/cti-skills
• License: MIT
• Homepage: https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.