A short Telegram post listed about two dozen web domains, mostly education and government sites in one country. It offered them as “web shell access” for sale, with no price and no terms. Our own keyword rule filed it as corporate network access. It was a list of websites that a seller claimed to control (IA-S001).
“Initial access for sale” sounds like a way into a company network, the step that ransomware crews buy. We read 350 posts under that label to see what it covers.
From January to August, an estimated 38.2% were access offers. After 12 September only about 4.9% were. Among the offers we read, footholds on websites and servers dominated. Corporate network offers were rare and repetitive.
The posts come from Blackhole, which collects mostly from Telegram, between 1 January and 27 October 2026. Posts are not offers, and offers are not accesses that worked. An AI coder classified every post against a written codebook. The research methodology gives the full scope.
What Is Inside a Post Labelled as Access Selling?
The classifier label “Initial Access Selling” covers 166,612 posts in the period. We drew 350 at random, stratified by period, and coded each in full (327 distinct texts, because some draws hit the same template).
From January to August, 38.2% of labelled posts were access offers (95% interval 28.1% to 49.5%). Another 11.1% were buyers asking for shells. Most of those offer posts were copies of one or two repeated ads.
Counted once each, offers ran at about 30 a day. The rest of the label was account sales, carding, shared configuration files, chat and posts we could not classify.
A separate AI pass coded 90 posts blind and agreed on offer versus not-offer in 89 (98.9%, kappa 0.96). Across three classes, agreement was 88.9% (kappa 0.75). That measures consistency, not human validation.
After 12 September the offer share fell to 4.9% (2.0% to 11.4%), because other content flooded the label. A companion article tests that step: The September Surge in Access-Labelled Posts
Which Kinds of Access Do the Offers Sell?
Take the 44 offer draws from the cleaned, de-duplicated January to August posts. Twenty-three were web shells and seven were RDP. Four were VPS or cloud accounts, three were admin panels or CMS logins, two were lists mixing several types, and one was cPanel. Two were corporate network offers and two fit no category.
This is an unweighted count of kept draws, and the reason matters. One repeated shell and cPanel bot ad made up about three quarters of offer posts in the 1 August to 11 September window.
Weighting every post would describe that ad, not the trade. The count shows the kinds of access offered. It does not show their share of the market.
These offers read like stock. Selected dated posts offer a named site, a bulk lot of logins or a rental tier. The packaging companion examines how their units, bids and replacement terms define separate products.
Why Did Our Keyword Rule Find Corporate Access Everywhere?
Our first-pass rule looked for words such as domain admin, revenue, bank and gov. It tagged as much as 17% of cleaned posts as corporate access in some months. When we read the hits, it was right in 1 of 39 sampled cases.
The other 38 were mostly shell or cPanel lists on government and education domains, like the opening example, plus buyer requests. A government or education domain suffix can suggest an organization category. It does not establish compromise or identify the type of access being advertised.
Our keyword rule overstated the corporate share in the sampled results because sector and access words also occurred in commodity website lists. We did not use that rule for the final offer estimates.
How Much of the Label Is Corporate Network Access?
Two readings give the answer. In the random sample, 2 of 110 cleaned January to August draws were corporate network offers (1.8%, interval 0.5% to 6.4%). Applied to 18,205 cleaned posts, that implies about 330 posts, with a range of 91 to 1,163.
Separately, we read every candidate we could find: 469 unique texts. They yielded 120 unique corporate offers in ten months, and 138 genuine-offer records before 12 September.
The two readings are consistent. The sample interval is too wide, though, to prove that the search missed little. Treat 120 as a lower bound.
What the 120 listings emphasize is privilege. Rights are stated in 103, ahead of the 76 that state a revenue band, which is always the seller’s own claim. The companion on corporate network access listings reads all of them, field by field.
Could Telegram Coverage Explain the Thin Slice?
Partly, yes. Blackhole is Telegram-dominated, and forum listings reach it mainly through relay channels that repost them. Coverage therefore depends on which relays we collected, and the corporate companion shows how that shapes the listings.
Vendor research studies forum listings directly. Rapid7 found RDP, VPN and RDWeb the most common access types in its 2026 analysis. Intel 471 reported at least 70 possible, circumstantial links between offers and later ransomware victims. Those forums are only partly visible to us.
So a thin corporate slice may measure what our collection sees as much as what sellers sell. Any pattern over time in the 120 offers reflects the same dependence. It is not a market trend.
Three limits remain. Cleaning removed 17 more genuine corporate offers that we did not count. One AI coder classified the corporate fields. Only privilege and access method had a second check, on 10 offers, and privilege matched in just 4.
A second pass agreed on whether a listing was corporate access in 38 of 40 cases (95%; three-class 87.5%, kappa 0.77). Inside the label, commodity web and server access clearly outweighs corporate network access. Closed forums may differ.
What Should a Defender Be Able to Answer About a Feed Entry?
Start with the object: a website, a server or a network. The answer decides who acts. A web shell on a company site is not a breach of its network, but it is a foothold on its infrastructure.
SMTP listings advertise sending quotas, which points to bulk mail rather than network entry. That is our reading, not observed misuse.
Two questions follow from what the listings name:
- Who can reach your firewall, VPN and remote-access admin interfaces? Counting the repeated firewall family once, edge devices and remote access made up 48 of 106 corporate offers, and admin, root or system rights were stated in 59 of 120. A 2026 CISA advisory on Gunra ransomware describes exploitation of internet-facing firewall and VPN devices. Can you say when an admin session last came from an unfamiliar address?
- What sits on your public sites that nobody on your team put there? Web shells, hosting-panel logins and mail credentials were among the commodity types we read. RDP and cloud accounts were the largest groups in the priced sample, which was drawn unevenly. Can you list them for every domain you run?
For triage, a feed entry that names your organization with admin-level device access justifies rotating that device’s credentials and reviewing its logs first. A list of domains with shells justifies a web-root review. Neither is an incident until your own records show one. For background on the role, see the initial access broker glossary entry and our earlier walk-through of a broker listing.
What These Counts Cannot Say
They do not measure how many accesses were sold, how many worked, or how many sellers exist. They set no market price. After 12 September only 13 offer draws exist, so the mix of types in that period cannot be quoted as percentages. Sectors here are generic, geography is by region, and revenue appears only as bands the sellers claimed.
Catalogue, Method and Related Reading
Every code in this article opens a record in the Initial Access evidence catalogue. It holds sample illustrations IA-S001 to IA-S015, corporate listings IA-C001 to IA-C120 and priced commodity posts IA-P001 to IA-P157. The Initial Access research edition brings the chapter together.
For the other end of the ransomware chain, see the ransomware edition of the Cybercrime Report 2026. Mule and SIM buying, which filled much of the post-September label, belongs to the Fraud research edition. Our glossary explains web shells and remote desktop protocol.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
