The Underground Economy of Access: How IABs Operate
Ransomware groups rarely hack their own way into a network anymore. They buy access. Initial Access Brokers (IABs) specialize in breaching corporate networks and selling that access to the highest bidder.
Types of Access
IABs sell various forms of entry, including:
- RDP/VPN Access: Direct remote access to a compromised server.
- Web Shells: Backdoors on public-facing web servers.
- Citrix/VDI: Compromised virtual desktop infrastructure.
The Market Dynamics
Prices range from $500 for a small business RDP to over $50,000 for domain admin access at a Fortune 500 company. Listings often include revenue figures, industry, and geography to attract specific buyers.
DarkLake indexes these listings across hundreds of forums. By monitoring IAB activity, organizations can identify if they are being sold on the market before the ransomware deployment begins.
Is your organization exposed?
Get a free Dark Web exposure assessment. We'll check for leaked credentials, compromised devices, and assets on the darknet.