An initial access broker (IAB) is a cybercriminal intermediary that obtains unauthorized access to a computer, account, or network, evaluates how useful that foothold is, and sells or supplies it to another threat actor. The buyer can then skip much of the work of breaking in and move on to activities such as lateral movement, privilege escalation, data theft, or extortion. The access may be a password, a valid session, a remote-service account, a web shell, or a deeper backdoor into an organization.
What an initial access broker does
The defining service is brokering access, not merely collecting passwords. An IAB may gather compromised credentials or footholds in volume, identify which belong to plausible business victims, test whether they still work, estimate the target’s value, and prepare the information for sale. The exact combination of services varies by actor and transaction.
As an Amazon Associate I earn from qualifying purchases.
MITRE ATT&CK records the purchase or other acquisition of an existing foothold as technique T1650, “Acquire Access.” Its framework documentation describes access that can be a planted backdoor or entry through an external remote service. The page was listed as version 1.0, created March 10, 2023, and last modified October 24, 2025.
This makes an IAB different from a person who simply dumps stolen usernames and passwords. A broker tries to make access useful to a downstream operator by adding context: what system can be reached, what privileges appear to be available, whether the connection was checked, and what kind of organization is behind it.
#1 Best Overall
Where the access comes from
Threat reporting identifies several routes by which brokers obtain footholds. They can use credentials and session data stolen by infostealers, phishing, credential reuse or other abuse of legitimate accounts, and exploitation or scanning of vulnerable internet-facing systems. The resulting access may concern a virtual private network (VPN), Remote Desktop Protocol (RDP), a Citrix gateway, a web application, corporate webmail, a web shell, or another external remote service.
These examples are not an exhaustive catalog, and the sources do not establish that every access type is equally common at all times. A credential can provide only a login, while a web shell or backdoor may already give an intruder code execution on a server. A listing’s practical value therefore depends on both the entry mechanism and what the account or host can reach.
How an IAB turns a foothold into a sale
- Collect potential access. The broker acquires credentials, session artifacts, malware logs, or direct access to a vulnerable or already-compromised system.
- Filter for viable victims. Larger collections are searched for organizations that appear to be businesses rather than low-value personal accounts. The National Cyber Security Centre (NCSC) describes brokers using victim identity and business information as part of this filtering.
- Validate the foothold. The broker checks whether a password, session, VPN account, RDP endpoint, or other entry still works. Access can become worthless when a password is reset, a session expires, or a vulnerability is patched, so testing affects both credibility and price.
- Estimate the opportunity. Observed indicators can include the apparent size of the network, the rights attached to an account, reachable devices, and the victim’s industry or revenue. This is an estimate, not a guarantee that the buyer can control every system described.
- Create a listing or make a private offer. A sale may be posted in a criminal marketplace or forum, offered directly to a known buyer, or transferred to an affiliate that already has an operational role in an attack.
- Hand over access and context. The buyer receives whatever credentials, connection instructions, session material, or backdoor details the deal promises. The broker may stop participating after delivery, or may provide limited assistance if the access fails.
What a criminal listing can reveal
Recorded Future’s report dated August 2, 2022 described listings that could include the victim’s country, annual revenue, industry, access type, rights, data sought, and devices visible on the local network. Those fields show why a brokered offer can be more informative than a raw credential dump.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Listing detail | What it helps a buyer judge |
|---|---|
| Access type, such as VPN, RDP, webmail, or web shell | How the buyer may connect and whether the foothold is an account-level entry or a deeper host compromise |
| Privilege or rights | Whether the account appears ordinary, administrative, domain-level, or otherwise useful for expanding access |
| Victim country, industry, or annual revenue | Potential business value, regulatory exposure, and likelihood that the organization can pay a ransom or otherwise be pressured |
| Apparent network size and reachable devices | How broadly an intrusion might spread if the buyer can move beyond the first system |
| Data sought or advertised | Whether the seller is offering a general foothold or information about a particular collection opportunity |
| Validation status and date | How much confidence to place in the claim that the access still functions |
These are comparison dimensions drawn from threat reporting, not a universal listing standard. Sellers can exaggerate, omit important restrictions, or resell the same access. A description of a large network does not prove that the purchaser has unrestricted control of it.
Access types and what they mean
VPN accounts
A compromised VPN account can provide a legitimate-looking route into an organization’s internal environment. Its usefulness depends on network segmentation, the account’s permissions, device checks, multifactor authentication, and monitoring. A VPN login alone does not establish access to every internal server.
RDP and other remote desktop services
RDP can expose an interactive Windows session. If it is internet-accessible and protected by weak or stolen credentials, a buyer may use it as a starting point for discovery and further compromise. The account’s local or domain rights and the host’s security controls determine what happens next.
Web applications and corporate webmail
Application or webmail access can expose business data and may provide opportunities to reset credentials, impersonate employees, or reach connected services. The impact depends on session controls, role permissions, and whether the organization has additional authentication requirements.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Web shells and backdoors
A web shell or planted backdoor is a foothold on a host rather than just a password. It can offer command execution, but the buyer still faces host defenses, segmentation, and the need to discover useful accounts and systems.
Reported prices and the limits of the numbers
Rapid7’s 2025 report analyzed six months of threat intelligence from the Exploit, XSS, and BreachForums forums and reviewed hundreds of posts. Its figures describe that observed sample, not the entire criminal market and not a current universal price list.
Rank #4
| Rapid7 observation | Qualification |
|---|---|
| 71.4% of observed access-broker sales included a level of privilege | Share measured in Rapid7’s 2025 sample |
| Just over $2,700 average sale price | Average for the observed sample, not a guaranteed price for any access |
| Nearly 40% of offerings priced between $500 and $1,000 | Distribution within that sample, not a standard market band |
| VPN, Domain User, and RDP among the most common access types | Frequency reported in the same six-month collection |
Recorded Future’s August 2, 2022 report examined an older and different sample. It said prices depended on factors such as victim details and access type. Its observations should not be merged with Rapid7’s 2025 percentages or average as though both studies measured one continuous market. Prices also fluctuate when access is revoked, a victim is publicly identified, or buyers compete for a particularly valuable target.
Why buyers use brokers
Gaining entry is often the most uncertain early step in an intrusion. Acquiring an existing foothold can let a buyer devote time and tools to later stages instead of phishing employees, scanning the internet, or exploiting a vulnerability personally. MITRE notes that buyers may favor access with high privileges or weak monitoring.
Recorded Future describes downstream use of compromised access for lateral movement, privilege escalation, data theft, and ransomware deployment. Brokered access can enable those operations, but a sale does not prove that ransomware will follow. The purchaser could be seeking espionage, fraud, data theft, extortion, or another criminal objective.
Best Value
- Cybersecurity Hacker Stickers: Premium waterproof vinyl decals for ethical hackers, coders, pentesters and tech enthusiasts for laptops, phones and gear
- Bold Designs: Matrix code, binary rain, Kali Linux, encryption, glitch art, cyberpunk, red/blue team and classic hacker motifs
- Durable and Waterproof: Fade-resistant, scratch-proof vinyl that sticks well indoors or outdoors on laptops, bottles and luggage
- Tech Gift Option: Suitable for programmers, bug bounty hunters, gamers and cybersecurity fans
- Easy Customization: Build your hacker aesthetic with these vinyl stickers for laptop decoration and sticker bombing
Why attribution is difficult
Initial access is one function in a larger criminal supply chain. One actor may steal credentials, another may validate and sell them, an affiliate may conduct the intrusion, and a separate extortion group may negotiate with the victim. An attacker can also buy access from one marketplace and resell it.
The NCSC states that “Attribution of a ransomware (or other cyber crime) incident to a single responsible actor is often impossible because of this business model.” Investigators therefore need to distinguish the party that first obtained access from the operators who used it, even when the same criminal brand appears in public communications.
What defenders should do about IAB activity
Defensive work should focus on preventing or detecting the footholds that brokers trade. CISA’s StopRansomware guidance identifies exposed or poorly secured remote services, exploited VPNs, and compromised credentials as common access paths.
- Require multifactor authentication. Rapid7’s 2025 recommendations place particular emphasis on VPN, RDP, and accounts that reach critical infrastructure.
- Reduce internet exposure. Remove unnecessary public access to RDP, administrative portals, VPN concentrators, and other remote services. Put essential services behind controlled access paths and monitor them.
- Patch and scan continuously. Scan internet-facing assets for vulnerabilities, prioritize exploitable issues, and verify that fixes removed the exposure rather than merely changing an inventory record.
- Control endpoints. CISA recommends centrally managed anti-malware, application allowlisting, or endpoint detection and response (EDR), applied consistently rather than left to individual users.
- Harden identities. Disable abandoned accounts, remove default credentials, review dormant VPN and RDP users, and limit administrative rights to what each role requires.
- Monitor remote access. Alert on unusual geographies, impossible travel, new devices, repeated authentication failures, unexpected RDP use, and logins outside a user’s normal pattern. Correlate identity, VPN, endpoint, and network telemetry.
- Threat-hunt for persistence. Look for new local administrators, scheduled tasks, unauthorized remote-management tools, web shells, suspicious mailbox rules, and changes to authentication settings.
- Exercise the exposure path. Rapid7 recommends testing for abandoned accounts, default credentials, and externally accessible RDP so that an organization finds the route before a broker does.
How to respond when a brokered foothold is suspected
- Contain without destroying evidence. Isolate affected hosts and disable or restrict the suspected account or remote-service path while preserving relevant logs, memory captures, and timestamps.
- Invalidate the access. Reset credentials, revoke active sessions and tokens, rotate exposed keys, and remove unauthorized persistence. For VPN or RDP incidents, review all accounts with similar permissions.
- Determine the blast radius. Identify the first known access, systems reached afterward, privilege changes, new accounts, data access, and signs of lateral movement.
- Check for a second actor. Do not assume the person who obtained entry is the same party that executed commands, stole data, or deployed ransomware. Preserve artifacts that may separate those roles.
- Restore from a trusted state. Rebuild compromised systems when integrity cannot be established, patch the exploited path, and confirm that monitoring covers the replacement environment.
- Notify the appropriate parties. Follow applicable legal, regulatory, insurance, law-enforcement, and customer-notification requirements. Keep the incident record precise about what is confirmed versus inferred.
How to read claims about an “IAB sale”
When a report or forum post describes an offer, ask six questions: What exact access type is involved? What privilege is demonstrated rather than merely claimed? Was the access tested, and when? What victim and network information is supported? Which source and date produced the observation? Does the report describe one listing, a sample, or a broader trend?
This discipline prevents two common errors: treating a broker’s advertisement as proof of unrestricted network control, and treating a dated marketplace sample as a live market statistic. It also helps defenders prioritize exposure without assuming that every compromised credential has the same operational value.
Quick Recap
Key points to remember
- An IAB brokers unauthorized access and may filter, validate, and assess it before resale.
- Access can range from a credential or session to a VPN or RDP foothold, web application account, web shell, or backdoor.
- The buyer uses the acquired entry to concentrate on later intrusion stages, which may include movement, escalation, theft, or extortion.
- Several criminal actors can share one operation, making single-group attribution unreliable.
- Rapid7’s 2025 figures are sample-specific observations, while Recorded Future’s marketplace findings are from August 2022 and should remain dated.
- MFA, remote-service hardening, vulnerability management, endpoint controls, identity hygiene, monitoring, and threat hunting directly reduce the opportunities brokers sell.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
