Initial access brokers are criminals who break into networks and then sell that entry to someone else, usually a ransomware crew. They do not steal data or encrypt files. Their product is the foothold itself: a working login, a remote-access session, a foothold in a corporate network that another group can use.
The name is literal. As Dictionary.com records, "initial" means of or occurring at the beginning — and in this trade the beginning is precisely what is for sale. The broker handles the hardest, riskiest part of an intrusion: getting in. The buyer handles the rest.
This division of labor explains a pattern readers see in breach reporting. A ransomware incident often arrives with no obvious story about how the attackers got in, because the crew that deployed the ransomware did not do the initial break-in. They bought it. Understanding that market matters, because every step a defender removes from the broker's playbook shrinks the supply of footholds for sale.
What exactly does an initial access broker sell?
The merchandise is access, described in listings with varying precision. At the low end, that means stolen credentials: a username and password pair for a corporate virtual private network or a remote desktop service, harvested by infostealer malware from an employee's personal computer. At the higher end, it means a verified live session — proof that the login works right now, sometimes with a screenshot or a short screen recording as evidence.
Listings typically describe the target in enough detail for a buyer to judge the prize: the industry, the company's approximate size, the revenue band, the security products observed on the network, and the type of access on offer. A foothold at a large firm with deep pockets commands more interest than one at a small business. Access that bypasses multi-factor authentication is worth more than access that does not.
Brokers operate as specialists. Some cultivate long-term relationships with particular ransomware groups and sell to them directly. Others list access on criminal forums and marketplaces, where buyers bid or negotiate. The trade is commercial in character: reputation, escrow, and repeat business matter, which is why established brokers are often careful about what they sell and to whom.
Where does the access come from?
Most broker inventory traces back to a handful of reliable supply routes. The largest, by most public accounts from security firms and law-enforcement advisories, is stolen credential data. Infostealers — malware that silently collects saved passwords, session cookies, and authentication tokens from infected machines — feed this trade at scale. Our earlier coverage of infostealers explained describes how that harvesting works and why a single infected laptop can expose an entire corporate session.
The second major route is unpatched software. A known vulnerability in an internet-facing system — a VPN appliance, a file-transfer tool, a remote-management platform — can be exploited repeatedly until the vendor's fix is applied. Brokers scan for vulnerable targets, break in, and hold the access for sale. The N-able N-central authentication bypass covered here earlier is a worked example of the pattern: a vendor-confirmed flaw, actively exploited, that leaves an open door until patched. This connects to our earlier piece, Patch N-able N-central now: vendor confirms active exploitation of authentication bypass flaw.
Third is deception aimed at people. Phishing, voice phishing, and business email compromise campaigns trick an employee into handing over a login or approving a push notification. A fourth route is bought rather than made: brokers purchase already-stolen credentials from other criminals, then verify which pairs still work and package the results. Credential stuffing — replaying old breach passwords against new services — sits close to this trade, because old breaches keep producing working logins years later. For related coverage, see Credential stuffing explained: why old breaches break new accounts.
How does the marketplace work?
Criminal forums host the trade much as legitimate markets host commerce. Sellers build reputations. Buyers leave feedback. Escrow services hold payment until the buyer confirms the access works. Prices are set by supply and demand, and several factors move them.
- Quality of access. A working remote-desktop session with administrative rights is worth more than a single untested password.
- Size and sector of the target. Larger organizations, and organizations in sectors where downtime is costly, attract higher prices.
- Security posture. Access that defeats multi-factor authentication, or that sits in a network with few endpoint defenses, is more valuable.
- Exclusivity. Access sold to one buyer only costs more than access resold to many.
Two features of this market matter for defenders. First, access is often sold more than once unless the listing promises exclusivity, so one stolen login can seed several unrelated intrusions. Second, the interval between compromise and use can be long. A foothold may sit for weeks before a buyer deploys it, which is one reason breach timelines reconstructed after ransomware incidents sometimes stretch back months.
Why does this matter for ransomware?
Ransomware is a business, and businesses buy rather than make what they can purchase more cheaply. Ransomware crews that outsource initial access can focus their effort on what they do best: moving through the network, escalating privileges, stealing data, and deploying encryption. The broker takes the risk of the initial break-in and is paid a share or a flat fee.
This specialization also changes what a breach looks like from the outside. When investigators later trace an intrusion, the entry event and the ransomware deployment may involve different tooling, different infrastructure, and different skill levels — because they involved different people. Our ransomware explainer covers what happens after the foothold is in hand; the broker trade is the step before it.
Law-enforcement agencies, including international operations coordinated through bodies such as Europol, have targeted access brokers and the forums where they operate. Those actions disrupt individual sellers, but the underlying demand persists as long as ransomware remains profitable. The market is not going away by enforcement alone.
What can defenders do to shrink the market?
Every broker route has a countermeasure, and most are unglamorous. The goal is not to make intrusion impossible — nothing does that — but to make footholds scarce, short-lived, and expensive to obtain.
- Apply vendor patches promptly on anything internet-facing. Unpatched appliances and remote-access software are the broker's cheapest inventory. Where a vendor confirms active exploitation, treat the patch as urgent rather than routine.
- Enforce multi-factor authentication on VPNs, email, and remote desktop — and prefer phishing-resistant methods where available. Access that survives MFA is rarer, and rarer means pricier.
- Protect endpoints against infostealers. Browser session cookies and saved passwords are a direct supply line to brokers, so endpoint protection and limiting what credentials browsers store both reduce the harvest.
- Monitor for dormant access. Unusual logins from new locations, service accounts used at odd hours, and remote sessions that linger can indicate a foothold being held for sale or use.
- Train for the human routes. Phishing and voice-phishing campaigns remain a steady source of credentials; our vishing and business email compromise guide covers the patterns to brief staff on.
Small organizations are not priced out of this. Most of these controls are configuration work, not new spending, and each one removes a listing from the market rather than merely slowing an attacker down.
What we still do not know
Public understanding of the access-broker trade comes mainly from security-firm reporting, takedown announcements, and post-incident forensics — not from direct observation of the market itself. Precise market size, typical pricing, and the exact share of ransomware incidents that begin with a purchased foothold are not reliably established in the public record, and any specific figure should be treated with caution unless a named source stands behind it.
What the evidence does establish is the structure: a specialized seller class, a repeatable set of entry routes, and a buyer base of ransomware operators. That structure is the defense problem. Close the routes, detect the dormant footholds, and the listings that remain become both rarer and less useful.