Initial Access Broker

An Initial Access Broker — roughly translated as “initial access dealer” — is a criminal who has specialized in a single task: breaking into someone else’s computer network and then selling that access to someone else. He does not carry out any further attack himself. Instead, he offers the open entry point like a commodity — typically in underground forums on the darknet, meaning hidden areas of the internet that are not accessible via normal browsers. The buyer then decides what to do with the access. Often these are other criminals who want to steal data or deploy extortion software. The broker himself stays in the background.

Why this division of labor makes attacks more dangerous

In the past, an attacker had to master all the steps themselves: breaking in, spreading through the network, encrypting data, demanding ransom. That required a lot of technical knowledge. Specialization has changed that. Today it’s enough to buy access in a forum — similar to ordering a tool rather than building it yourself.

This significantly lowers the barrier to entry. Groups that want to operate ransomware — that is, extortion software that encrypts files and demands a ransom — no longer need their own break-in specialist. They simply buy ready-made access. Security researchers at the company KELA documented over 2,000 such offers in relevant forums in 2022 alone. The average price often ranged between a few hundred and a few thousand dollars — a fraction compared to the potential damage.

The result is a kind of assembly line of cybercrime. Each group does what it does best. This increases both the pace and the efficiency of attacks overall.

How a broker gains access

The most common method is stolen credentials. Usernames and passwords are collected in large quantities from previous data breaches. Many people use the same password for multiple services — the broker tries these combinations automatically against corporate systems. This is called credential stuffing.

A second common method is unpatched security vulnerabilities — that is, weaknesses in software for which the manufacturer has released a fix, but which the affected company has not yet applied. Brokers systematically scan the internet for such outdated systems. VPN access points (virtual private networks that allow employees secure remote access) and remote desktop services, which allow a company computer to be controlled from outside, are particularly frequently affected.

Once the broker has access, he checks how valuable the network is — how large the company is, what data is stored there, how deep he has already penetrated. Then he sets a price and lists the offer. He delivers the buyer credentials or a backdoor into the system, collects payment, and moves on to the next target.

Initial Access Brokers in news and investigations

The term appears regularly in reports following major ransomware attacks. The investigation into the attack on the Colonial Pipeline in the US in 2021 — an attack on a fuel pipeline that led to supply shortages on the East Coast — showed that the attackers most likely got in through a previously compromised VPN account. Such access is typically brokered by Initial Access Brokers.

Law enforcement agencies such as Europol or the FBI explicitly name Initial Access Brokers as a distinct category of perpetrators in their cybercrime threat assessments. Investigations therefore target not only the visible extortionists but also the brokers operating in the background. Without the initial open entry point, the entire subsequent attack chain cannot get underway.

For companies, this means an attack can begin before anyone has even planned a concrete attack. Access to one’s own network may already be up for sale in a forum — without the IT department knowing about it. Services that monitor such forums and warn companies are therefore a growing area within the IT security industry.