Ransomware attacks rarely begin with an attacker typing commands directly into a target’s systems. More often, the attackers arrive through a door that someone else has already opened and put up for sale. That is the role of the Initial Access Broker (IAB): a specialist in the criminal economy who gains entry to corporate networks and sells access, rather than launching an attack themselves.
IABs sit at the heart of the modern ransomware pipeline, operating as an invisible layer between credential theft and full network compromise. The criminals who steal credentials are often not the same criminals who deploy ransomware. Between those two groups, the IAB acts as the intermediary, supplying the first step ransomware operators need to get inside an organization.
Understanding the IAB role makes the risk of stolen credentials concrete. A password found in an infostealer log is not simply an account security problem. It is potential inventory in a criminal marketplace, waiting to be purchased and used against the organization to which it belongs.
What Is an Initial Access Broker?
IABs are not ransomware operators. They do not encrypt systems or demand ransom payments. They are, in effect, suppliers of entry points. Their customers, typically ransomware affiliates operating under a Ransomware-as-a-Service (RaaS) model, purchase the access and carry out the attack.
This division of labor mirrors legitimate business specialization. IABs develop expertise in breaching perimeters and can focus entirely on sourcing access across many targets at once. Ransomware operators, in turn, do not need to invest in reconnaissance or credential acquisition. They buy what they need from a market designed for exactly that purpose.
The result is an efficient, scalable criminal supply chain. IABs operate across multiple dark web forums and private channels, listing available accesses the way a merchant might list stock.
How IABs Obtain Access
IABs source access through several routes, all of which trace back to compromised credentials or exploited perimeters.
The most common supply channel is infostealer logs. When a device is infected with infostealer malware, the resulting log typically contains saved browser credentials, including usernames and passwords for corporate VPNs, remote desktop services, and cloud management portals. An IAB who purchases or acquires these logs can sift them for valid corporate access using automated tools that test credentials against public-facing login systems.
A second source is credential stuffing. IABs build or purchase combolists, large datasets of username-password pairs compiled from past data breaches, and test them systematically against corporate portals. Where password reuse is widespread, a credential from a consumer breach can open a corporate system.
Targeted phishing campaigns make up a third route. An IAB may run spear-phishing operations designed specifically to harvest corporate credentials, or purchase access to a compromised mailbox that enables lateral movement through an organization’s environment.
In each case, the IAB is not looking to exploit the access themselves. They are prospecting for entry points to resell.
How the IAB Marketplace Operates
IAB listings appear primarily on dark web forums and in private criminal Telegram channels accessible by invitation. The listings are structured and businesslike, describing targets in terms ransomware buyers specifically value.
A typical IAB listing includes:
- Company revenue and size: Larger organizations command higher prices, as the potential ransom is proportionally greater.
- Sector: Healthcare, financial services, and manufacturing attract the most buyer interest.
- Access type: VPN credentials, RDP access, a compromised domain administrator account, or a web shell each carry different values depending on the level of privilege granted.
- Country of the target: Some ransomware groups restrict their operations geographically and filter listings accordingly.
Prices reflect the perceived value of what is on offer. A basic RDP login to a small business might sell for a few hundred dollars. Access to a large enterprise with elevated privileges can command tens of thousands. Listings with strong seller reputations sell quickly — some accesses are purchased within hours of being posted.
The broader monetization of stolen data follows similar market logic across criminal channels: data is priced by freshness, specificity, and how directly it enables downstream harm. IAB access listings sit at the top of that value chain, because they do not merely expose data — they open doors.
From IAB Listing to Ransomware Attack: The Timeline
The speed of the IAB pipeline is one of its most important features. From a credential appearing in an infostealer log to a ransomware operator purchasing access can take days. The window for early intervention is narrow.
In practice, the chain moves as follows:
- A device inside an organization is infected, often through a phishing message or a compromised software download.
- The infostealer extracts credentials from the device and uploads them to a criminal server.
- The log is packaged and sold, either directly on a stealer logs marketplace or to an IAB who screens it for corporate access.
- Once a live credential is confirmed, the IAB posts a listing on a criminal forum.
- A ransomware affiliate identifies the listing as a suitable target, purchases the access, establishes a foothold, and begins the reconnaissance and lateral movement needed before deploying the ransomware payload.
Throughout this process, the targeted organization has no indication that its credentials were stolen, listed, or purchased. By the time the ransomware executes, the earliest opportunity to intervene has already passed.
How Cybercheck Helps
The most effective point to break the IAB pipeline is the earliest one: detecting compromised credentials before they can be packaged, listed, and sold as access inventory.
Cybercheck monitors the criminal forums, dark web marketplaces, and Telegram channels where infostealer logs are traded and IAB activity takes place. When employee credentials belonging to a monitored corporate domain appear in these channels, IT and information security teams are notified immediately.
That alert gives your organization the opportunity to revoke compromised passwords and lock down affected accounts before an IAB can verify or sell the access. The intervention happens at the start of the chain, not after the damage is done.
