Initial access broker
An initial access broker is a criminal who breaks into organizations and sells that access to other attackers, such as ransomware groups, instead of carrying out the final attack. Access is sold as credentials, remote desktop or VPN entry, or web shells.
Current as of · Editorial policy
How it works
The broker is a specialist middleman. The Center for Internet Security describes initial access brokers as threat actors who obtain access to networks and sell it to other threat actors. The most common buyers are criminals after financial gain, but CIS notes that brokers sell to all kinds of actors, including nation-state groups. Google's Threat Analysis Group, writing about a broker tied to the Conti group, called them the opportunistic locksmiths of the security world, and stressed that the broker and the follow-on attacker are separate actors.
CIS lists what is sold: control panel credentials, web shell access to compromised servers, remote desktop connections and VPN credentials. Methods include exploiting VPN vulnerabilities, scanning for exposed remote desktop ports, brute-force attacks and credential stuffing. CIS cites evidence that some brokers work directly for ransomware groups or their affiliates.
How it shows up in executive exposure
Leaked credentials are one input for a broker. A valid password for a VPN or single sign-on page, taken from a breach or a stealer log, is a ready-made product. MITRE ATT&CK notes that valid accounts give an attacker legitimate-looking access and lower the chance of detection.
Access listings are sold in criminal forums and channels. EDG3 watches the dark web forums and Telegram channels where stolen data and access are posted and sold. WebThreat's CEM shows which executives' credentials appear in breach corpora and leak databases, the raw material brokers sell. See how stolen data is sold and who trades stolen company data.
How to reduce the risk
CIS recommends these steps:
- Regular penetration testing and a patching program.
- Account lockout policies.
- Multi-factor authentication.
- Access controls and least privilege.
- Participation in threat intelligence sharing.
How it differs from related terms
A threat actor is any party carrying out hostile activity. An initial access broker is one specific role: it sells the way in and stops there. Account takeover is one way a broker obtains or uses access. Credential stuffing is one of the methods brokers use to get it. Ransomware operators are typically the buyers, not the brokers.
Frequently asked questions
What do initial access brokers sell?
Access to a compromised network, such as VPN or remote desktop credentials, web shell access or control panel credentials.
Who buys from brokers?
Most often criminals after financial gain, including ransomware groups that want to skip the first stage of an intrusion. CIS notes that brokers also sell to nation-state actors.
Sources
- Initial Access Brokers: How They're Changing Cybercrime, Center for Internet Security, accessed
- Exposing initial access broker with ties to Conti, Google Threat Analysis Group, accessed
- Valid Accounts (T1078), MITRE ATT&CK, accessed
Related terms
See your leadership's exposure
CEM finds your executives from your company name, checks them against breach corpora and leak databases, and scores each person from 0 to 100.