Log in Request a demo

How To Defend

How To Respond To Initial Access Listings.

An initial access listing means someone is selling a way into your network, such as VPN logins, a remote desktop session or a webshell. CISA notes that criminals who get into a network often sell that access to others. Treat it as a live intrusion risk: find which door the listing describes, close it, then hunt for any foothold already in place.

  • Infrastructure
  • Raised by DarkWeb Monitoring
Alert area
Infrastructure
Raised by
DarkWeb Monitoring
First 24 hours
7 steps
Investigation
9 checks
Who acts
SOC analyst, Incident lead, Network engineer and 3 more
Last updated October 17, 2026

What This Alert Means.

This alert means a seller has posted access to what looks like your network. A seller of this kind is called an initial access broker. Brokers get into companies first, then sell the way in to others. CISA's ransomware guide notes that such access is often sold on. The listing may name a VPN, a remote desktop service (RDP, which lets someone control a computer over the network) or a webshell (a small hidden script on a web server that gives remote control).

The listing may be old, or the seller may exaggerate. You still have to act as if it is real. Your goal is to find the door, close it and check whether someone has already walked through.

First 24 Hours.

Work in this order. Each step names who does it.

Do now
  1. SOC analyst Open the alert from the Brandefense dark web monitoring module and record what the listing says: access type, country, sector, size, privilege level and priceThese details help you guess which door it is
  2. Incident lead Start an incident record and name one person to leadA single lead avoids mixed messages
  3. Network engineer List every VPN, remote desktop and remote admin entry point that faces the internetCompare it with the listing and with your asset records
  4. IT admin Force a password reset and end active sessions for accounts on those services, and turn on MFA where it is missingStart with admin and service accounts
  5. SOC analyst Search VPN, RDP and web server logs for unusual sign-ins, new locations and odd hoursRecord every address you see
  6. Security engineer Scan web server folders for new or changed scriptsA webshell is often a recent file in a web directory
  7. Legal Ask whether anyone must be notified and whether to tell your insurer or partnersCheck with your legal counsel before you contact anyone outside

Investigation Checklist.

Use this list to find the door and any foothold. Tick each item and keep notes.

Find the door and the foothold
  • Does the listing match one of your VPN, RDP or web services?Match on country, sector, company size and access type
  • Do any accounts on those services show successful logins after a run of failures?MITRE lists this pattern as a detection idea for external remote services
  • Are there logins from places or devices your staff do not use?Check with the account owner
  • Were any new accounts, groups or scheduled tasks created recently?CISA lists newly created accounts as a hunting target
  • Are there new scripts in web folders, or web server processes starting a command shell?MITRE lists this as a webshell detection idea
  • Do any servers show remote access tools or admin tools that you did not install?Attackers often add these to stay in
  • Are there signs of data being copied out, or of tools used before ransomware?Look for large transfers and backup deletion commands
  • Are the exposed services patched, and do any use default or shared passwords?Check software versions against vendor notices
  • Could the credentials have come from a stealer log or past leak?Check related alerts for the same accounts

Containment And Removal.

You cannot delete the listing, but you can make what it sells useless. CISA's ransomware response checklist covers finding and isolating affected systems, hunting for the attacker, and resetting passwords once the environment is clean. Isolate only what you must, and keep evidence.

  • Your own systems: disable the affected accounts, block unknown sources at the firewall, and take any suspect system off the network, keeping it powered if you need memory evidence.
  • Remote access: remove direct internet exposure of remote desktop, put access behind a VPN or gateway with MFA, and close services you do not need.
  • Webshells: save a copy of the file and logs first, then remove it and fix the weakness that let it in, such as an unpatched web application or weak upload checks.
  • Hosting or forum operator: report the listing through the platform's abuse contact where one exists. Many underground forums have none, so do not expect removal.
  • Vendors: if the access is through a managed service provider or a supplier's account, tell them and ask for their logs.
  • Law enforcement or national CERT: report to your national CERT or police cyber unit. In Turkiye, USOM (usom.gov.tr) handles cyber incident reporting, and its services are moving to www.siberguvenlik.gov.tr.

WarningDo not reset every password in a hurry if you think an attacker is inside. They may see it and act. Plan the reset, hunt first where you can, then reset all affected accounts together.

  1. IdentifyWhich door does the listing describe
  2. CutClose it and end sessions
  3. HuntLook for accounts, tools and shells
  4. ResetCredentials, after cleaning
  5. WatchMonitor for return

Longer-Term Hardening.

The main aim is to make bought access fail. Remote entry points are where to start.

  • MFA on everything remote. CISA recommends phishing-resistant MFA for all services, especially email, VPNs and accounts that reach critical systems.
  • Limit RDP. CISA says threat actors often get in through exposed and poorly secured remote services, and advises closing unused RDP ports, applying MFA and logging RDP login attempts.
  • Reduce what faces the internet. MITRE lists disabling unneeded remote services, MFA, network segmentation and access through VPN concentrators as mitigations for external remote services.
  • Web server hygiene. Limit who can write to web folders, and watch for new files there. MITRE names least privilege as a mitigation for webshells.
  • Prepare in advance. NIST SP 800-61 Rev. 3 gives recommendations to help you prepare for, detect, respond to and recover from incidents.
  • Unique, long passwords for each account, with a password manager.
  • Keep a list of internet-facing assets and check it often against what outsiders can see.

How To Measure That It Worked.

Choose checks that show a closed door and a clean network.

  • Every internet-facing remote access point is listed, protected by MFA and justified.
  • No sign-in from unknown sources after the cut-off time.
  • The hunt ends with a written result, even when nothing is found.
  • No unexplained accounts, tasks or scripts remain.
  • Affected credentials were reset after cleaning, and the date is recorded.
  • Later alerts show no new listings for your organization.

Common Mistakes.

These mistakes give an intruder more time.

  • Assuming the listing is fake. Sellers may exaggerate, but you cannot tell from the outside.
  • Closing the one door named and stopping. The foothold may already be somewhere else.
  • Wiping systems before saving evidence. You lose the proof of what happened.
  • Resetting only the named account. A seller may hold more than one.
  • Turning on MFA but leaving old sessions alive. End the sessions too.
  • Treating it as an IT matter only. Involve legal, leadership and partners early.

Questions.

  • What is an initial access broker?

    An initial access broker is a criminal who breaks into companies and then sells the access, such as VPN logins, remote desktop sessions or webshells, to others. CISA notes that such access is often sold on to other attackers, so treat a listing as an early warning that an attack may follow.

  • What should I do if my company's VPN or RDP access is for sale?

    Find which entry point the listing describes, end sessions and reset credentials on those services, add MFA, and review logs for unusual sign-ins. Then hunt for new accounts, tools and scripts. Do these in a planned order so an intruder is not warned too early.

  • How do I find a webshell on my server?

    Look for new or changed script files in web folders and for web server processes that start a command shell. MITRE lists both as detection ideas. Save a copy of the file and logs before you remove it, and fix the weakness that let it in.

  • Can I get an access listing taken down?

    Usually not. Many underground forums have no abuse contact, so the useful action is to close the access itself. You can still report through any platform channel that exists and to your national CERT. Ask your legal counsel before any contact with the seller.

  • Should I reset all passwords at once?

    Plan it. If an attacker may already be inside, a rushed reset can warn them. CISA's guide places credential resets after the environment is cleaned. Hunt and isolate first, then reset all affected accounts together and end their sessions.

Sources

  1. 1 CISA #StopRansomware Guide
  2. 2 MITRE ATT&CK T1133 External Remote Services
  3. 3 MITRE ATT&CK T1505.003 Web Shell
  4. 4 NIST SP 800-61 Rev. 3 incident response recommendations
  5. 5 USOM National Cyber Incident Response Center

This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.

More Playbooks.

All Playbooks
Infrastructure Actively exploited vulnerabilities An exploited vulnerability alert means a flaw in software you may run has public exploit code or is already being used in attacks. Find every affected system first, starting with those open to the internet. Patch or reduce exposure, and check for signs of compromise both before and after you patch. Open Infrastructure Leaked databases and source code A data leak alert means a database, source code, configuration file or API key that looks like yours has been posted on a paste site or a dark web repository. Treat any secret in it as public. Confirm the material is real, then revoke and replace every key, password and token in it before you work out how it got out. Open Infrastructure Risky misconfigurations A misconfiguration alert means a setting on something you expose to the internet is risky. Examples are an open admin panel, an unneeded open service, weak TLS, missing email protection records, or a subdomain that can be taken over. First decide how fast an attacker could use it, then close or restrict it and recheck from outside. Open

Keep Exploring.

Knowledge Hub
Glossary term Initial Access Initial access is the first step in which an attacker gets into a target network. Open Glossary term Remote Desktop Protocol (RDP) Remote Desktop Protocol, or RDP, is a Windows feature that lets a person open an interactive session on another computer over a network. Open Technique Server Software Component: Web Shell (T1505.003) A web shell is a small script that an attacker places on a web server. Open Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. Open

Browse The Library.