Stealer-log marketplaces and initial access brokers explained

What is an initial access broker?

An initial access broker (IAB) is a criminal who gets into a company's network or accounts, or buys the means to do so, and then sells that access to someone else instead of using it. The buyer is often a ransomware affiliate. The broker takes a fixed price or a share and never runs the attack itself. The glossary entry has the short version.

Brokers are one link in a chain of specialists. Malware operators infect devices, and the resulting stealer logs hold saved passwords, cookies and tokens (our guide to what infostealer logs contain lists the fields). Brokers sort those logs, test which logins reach a company, and package the ones that work. Buyers then pay for a working door instead of finding one. This article covers the actors and what they sell. For the channels where stolen data changes hands, see how stolen data is sold across forums, markets, channels and leak databases and who trades stolen company data on dark web forums and marketplaces.

What do initial access brokers sell?

Initial access brokers sell working entry points into company environments. Europol's IOCTA 2025 lists credentials for remote services and accounts, such as RDP, VPN, firewalls, network devices and cloud environments, up to established backdoor access to corporate systems. Listings are usually accompanied by details of the compromised entity.

The table below sets out the access types that appear in the sources used here, where they typically come from, and what a defender can check. It is a reading aid built from the sources linked below, not a price list.

KELA, a threat intelligence firm, analyzed forum listings in the fourth quarter of 2020 and reported that RDP and VPN accesses, together with vulnerabilities that allow code execution, make up the majority of offers. It also showed a post offering "70 Citrix accesses from Tier 1 countries". Those are 2020 observations, so treat the mix as an example of how listings look, not a current share.

Where do the accesses come from?

Brokers obtain access by four main routes: credentials collected by infostealers, phishing and malware spam, exploited vulnerabilities in internet-facing systems, and brute force against misconfigured services. Europol and CISA describe all four. The route matters because a stolen VPN login and an exploited edge device leave different traces and need different fixes.

• Stealer logs. Europol writes that sellers of login credentials use infostealers, which are offered as a service on criminal platforms, and that stolen data such as infostealer logs "can be sold or further processed by criminals to extract credentials". In its BlackSuit advisory, CISA reports that, according to trusted third-party sources, actors "may leverage initial access brokers to gain initial access and source traffic by harvesting virtual private network (VPN) credentials from stealer logs". The article on what to do when an employee password is in a stealer log covers the first response, and combolists, stealer logs and database dumps explains how the data types differ.
• Exploited vulnerabilities. Europol says IABs "utilise exploit kits to compromise systems with unpatched known vulnerabilities". CISA's Play advisory notes that multiple ransomware groups, including initial access brokers with ties to Play operators, exploited CVE-2024-57727 in the SimpleHelp remote monitoring and management tool at many US entities after the vulnerabilities were disclosed on 16 January 2025.
• Brute force and misconfiguration. Europol lists brute force attacks used to access misconfigured services. CISA's Akira advisory says the group's access to VPN products can come through stolen login credentials or exploited vulnerabilities, and that compromised VPN credentials are in some cases obtained "potentially by using initial access brokers or brute-forcing VPN endpoints".
• Phishing and malware spam. Europol describes brokers using botnet-based dropper services to run phishing and malspam campaigns that deliver malware, such as an infostealer.

How are initial access listings advertised and priced?

Brokers advertise on cybercrime forums and marketplaces with a short description and an asking price, and often move the sale to private messages or encrypted channels. KELA's Q4 2020 sample had a median asking price of $1,500 and an average of $6,684. Those figures are dated and cover only public forum posts.

Europol says validated listings posted by IABs usually come with details of the compromised entities and are "sometimes auctioned to the highest bidder". Forums serve as advertising space, while negotiation and payment increasingly move to dedicated channels on commercial end-to-end encrypted platforms. Our article on Telegram clouds, where stolen data is packaged and sold covers that channel, and the Nulled and Cracked seizure shows what a forum takedown changes.

What the published numbers say, by publisher:

• KELA counted 242 accesses on sale on three underground forums in Q4 2020, with a cumulative asking price of $1,209,880. 24 percent of offers did not state a price.
• KELA reported that the average price rose from $4,960 in September 2020 to $6,684 in Q4, while the median fell from $2,000 to $1,500. KELA concluded that a typical access still cost about $1,500 to $2,000 and, at that price, usually meant domain admin access to a medium-sized company with hundreds of employees.
• KELA found the most expensive Q4 2020 offers from one seller ranging from $30,000 to $135,000.
• Europol cites CrowdStrike for an increase of almost 50 percent in the price of advertised access in 2024.

KELA also stresses that its sum "does not reflect the higher actual revenue of the initial access market", because many accesses are traded in private conversations. Europol adds that some sellers overstate the value of what they offer, and that listings may be fake or based on outdated leaks. A listing proves that someone claims to hold access. It does not prove the access works.

How does access reach a ransomware affiliate?

A broker passes access to a ransomware affiliate, who logs in, moves through the network, steals data and deploys the encryptor under a ransomware-as-a-service program. Payment is either a flat price or a percentage of the eventual ransom. CISA names broker involvement in its BlackSuit, Akira and Play advisories.

KELA saw some brokers state they were "ready to work for a percentage", which it read as a share of the amount gained in a successful ransomware attack. KELA also observed brokers moving deals into private conversations with middlemen or ransomware affiliates to avoid researchers. Europol describes the same pattern for the most advanced actors, who do not advertise publicly but trade valuable access privately, "possibly in exchange for a percentage of the buyer's earnings".

Two consequences matter for defenders. First, the time between a listing and an attack can be short or long, because the buyer may sit on the access. Second, Europol warns that data may be sold several times, which can result in several actors attacking the same victim. Closing one door does not end the exposure if other copies of the access or the underlying credentials exist.

Can we find out whether access to our company is for sale?

Whether a listing names your company can only be answered by looking at the places where listings are posted. EDG3 is WebThreat's threat intelligence for leaked data. It collects from dark web forums and marketplaces, Telegram and other channels, and leak databases, and for a domain you have authorized it shows what has been posted about your company, where and by whom. Many listings never name the victim, and private deals do not appear at all, so a clean result is information and not a guarantee.

For leadership, CEM answers a narrower question. It finds the executives from your company name and checks their current and past email addresses against breach corpora and leak databases, ranked by what to fix first. It does not read stealer logs or session tokens. Our article on what credential leak monitoring can and cannot tell you explains the limits of each kind of check.

What can a company do about initial access brokers?

A company can reduce the value of what brokers sell in four ways: find and revoke sessions and credentials that appear in listings or stealer logs, patch and restrict internet-facing edge devices, require MFA that resists phishing, and shorten sessions on unmanaged devices. None of these steps requires knowing which broker holds the access.

1. Treat every exposed login as a live incident. Reset the password, revoke active sessions and tokens, and check recent sign-ins for the account. A password reset alone does not end a stolen session, which is why revocation comes first. See what to do when an employee password is in a stealer log.
2. Inventory and patch edge devices. VPN gateways, firewalls, remote-access gateways and RMM tools are the systems the advisories above describe being exploited. Remove management interfaces and RDP from the internet where possible, and apply vendor patches for known exploited vulnerabilities first.
3. Put MFA on every remote entry point. Without it, a stolen VPN password is a working door. CISA's fact sheet on phishing-resistant MFA says that while any MFA is better than none, phishing-resistant MFA is the strongest option, with FIDO2 security keys among the methods it describes.
4. Plan for session theft, because MFA alone does not stop it. Microsoft's incident response team describes attackers who replay a token issued after MFA was completed, which satisfies the MFA check. Its guidance is to allow only known, compliant devices for critical applications, shorten session lifetimes on unmanaged devices, and use phishing-resistant MFA for privileged users.
5. Log and review remote access. Keep VPN, RDP and cloud sign-in logs long enough to investigate. A broker's buyer may use the access days or weeks after the sale.
6. Check what is posted about your company. An EDG3 briefing shows what has been posted about your domain, so the first four steps start from evidence and not guesswork.

For the wider account takeover picture, including how reused passwords turn one leak into many, see the glossary entries on password reuse and credential stuffing.

How WebThreat can help

WebThreat does not run your identity provider, patch your VPN or investigate your network. Your IT and security teams own those steps. Our part is the data that has already left.

• EDG3 is WebThreat's threat intelligence for leaked data. It collects from dark web forums and marketplaces, Telegram and other channels, and leak databases. For a domain you have authorized, it shows what has been posted about your company, where and by whom, and links reposted copies of a leak back to its first post while keeping the provenance of each.
• CEM looks at your leadership team. It finds the executives from your company name and checks their current and past email addresses against breach corpora and leak databases, ranked by what to fix first.

If you want to know what is circulating about your company, book an EDG3 briefing or contact us. The methodology page explains how findings are tied to their sources.

This article is general information, not legal advice, and reflects the sources linked above as of 29 October 2026. The market figures come from the publishers named and are not WebThreat measurements.