Initial Access Broker.

What is an initial access broker?

An initial access broker gets a foothold in a network and then hands it on, usually for payment, instead of finishing the attack. The buyer then carries out later stages such as stealing data or locking systems. This page uses the common term, but a single source rarely describes the whole market, so it sticks to what public bodies state.

How do brokers get in?

CISA’s advisory on a ransomware group lists the ways that group has gained entry. Phishing is described as the most common, through malicious PDF attachments and malvertising links. Other routes are remote desktop protocol and exploiting public-facing applications. CISA adds that the actors may use initial access brokers, and that they can harvest virtual private network credentials from stealer logs to source access. The CISA ransomware guide names similar entry points: internet-facing vulnerabilities, compromised credentials, phishing, earlier malware infections, social engineering and third parties such as managed service providers.

Is buying access a known practice?

Yes. MITRE ATT&CK records that one criminal group has purchased access to victim VPNs to reach victim environments. MITRE also notes that adversaries use valid accounts, meaning real stolen logins, to gain initial access and to keep access to remote services such as VPNs, web mail and remote desktop.

Why does it matter?

Splitting an attack into stages means the group that breaks in may not be the group that does the damage. That can make an attack seem to come from nowhere, which is general reasoning. It also suggests a window for defenders, since access that has been obtained but not yet used can still be closed. CISA’s guidance for ransomware focuses on exactly these entry points, which shows how much prevention depends on the first step.

How do you reduce the risk?

• Use phishing-resistant multi-factor authentication for all services, particularly email, VPNs and accounts that reach critical systems, as CISA advises.
• Do not expose services such as remote desktop on the internet.
• Patch internet-facing servers urgently.
• Run a user awareness and training program on phishing and illegitimate websites.
• Audit accounts regularly and remove those no longer needed, as MITRE advises.
• Change default usernames and passwords right after installation.

These steps do not remove every route in, but they cover the entry points that CISA names.

Is an initial access broker the same as a ransomware group?

No. A broker supplies access. A ransomware group uses access to run the attack. In some cases one actor may do both, so the roles can overlap.

Is a broker the same as someone who sells stolen passwords?

Not quite. Stolen passwords are one possible source of access. A broker sells working access to a network, which can come from passwords, a weak remote service or another route.

Related pages in the Knowledge Hub

• Ransomware Intelligence
• Leaked credential monitoring

Sources

• CISA: Names initial access brokers and VPN credentials from stealer logs among the ways a ransomware group gains access, with phishing the most common.
• CISA: Lists common ransomware entry points and mitigations such as phishing-resistant MFA and patching internet-facing servers.