Cybercriminals no longer operate in isolation. Today, the cybercriminal world is a distributed economy, a fully-fledged ecosystem of illegal businesses, where everyone performs their own function. Some develop malware, others deploy ransomware. Still others launder money. Initial access brokers are a key link in this chain. It brings on its side the most labor-intensive and risky part of the job — penetration. As a result, attacks become cheaper, faster, and more accessible. In this piece we will delve into how this market works.
How they decide the price of your company
Listings offering initial access to corporate networks have firmly secured their position in the underground market. I’d also highlight that during the last few years the initial access market itself has been growing steadily, encompassing an increasing number of companies worldwide.
However, if we speak about the price of each listing, it is mainly based on four specific attributes: сountry, industry, revenue and access type.
These attributes are highly valuable for buyers since they can immediately evaluate the potential profit from utilizing the access. For example, a lot posted on an underground forum which contains initial access with domain administrator privileges within a victim’s infrastructure will attract more attention from attackers rather than a domain user access.
Not only do threat actors gain total control over the target infrastructure, enabling everything from stealthy persistence but they also can initiate various illicit actions from mass data exfiltration to the simultaneous deployment of ransomware across all servers and workstations. Therefore, such a listing will cost at least several times more than a similar one with simple user privileges.
A bit different is the situation with politically-motivated cybercriminals who are actively scouring the market for initial access belonging to companies located in the certain regions they are willing to attack on purpose. Mostly the price is not taking the first place here since the threat actors are ready to pay a high price to achieve the specific target.
Regardless of any other parameter, the most expensive lots are those which relate directly to the governmental entities. If the threat actors had gained initial access to the government network they could have subsequently pivoted to the industrial control systems to paralyze operation around the whole country, It should be noted that increasement of the initial access brokers among the market has turned to competition for a buyer. In this case the main goal of a broker is to monetize as many items as possible — they are going to reduce the price until they find their buyer. This allows them to earn both money and the reputation of a trusted seller among the cybercrime community rather than earn nothing.
How a lot look like
One ad is enough to understand the market logic. For example, a broker posted access to a manufacturing company on an underground forum: RDP with local administrator rights, a shell with SYSTEM privileges, and AnyDesk access to an environment containing over 70 hosts and 1,300 domain accounts. The starting price is $3,500, with a “buy it now” price of $5,500. For the buyer, these lines aren’t just a catalog, but a ready-made calculation: how many hosts can be encrypted, which accounts will allow lateral movement, and which security measures will need to be bypassed. Tellingly, the same seller could regularly attach downloaded data to the access listings — ranging from several terabytes to 150 TB of sensitive information. In other words, the broker monetizes not only the entrance to the network, but also what lies behind that door — and that’s why the price of access to a large company’s infrastructure can amount to hundredths of a percent of its annual revenue.
How decisive is trust in the IAB market?
Trust is a very doubtful parameter in the cybercrime community. Since all underground members are hidden under anonymous personalities it is hard for them to trust each other blindly. Even if the user has earned the reputation of a trusted member who provides valid services on an underground forum, other forum members can never tell when the user decides to cheat on a customer and pull an exit scam with received money.
To prevent fraud against forum members, many popular underground platforms set escrow-services which charge a fee for any accepted deal.
However, over the past two years many platforms were seized by law enforcement agencies, moving beyond simply blocking domains to fully seizing infrastructure and arresting key figures. This has significantly disrupted the established model of trust within the underground community, including initial access brokers who usually provide their services on the forums. Fearing compromise — or that a platform may be under law enforcement control — users are migrating en masse from major forums to alternative platforms, private messengers or simply isolate themselves within their own infrastructure and ready-made community of a tight circle of trusted associates.
Is there any chance to protect
The most common initial access vectors are publicly exposed RDP servers and corporate VPN gateways that are not protected by multifactor authentication (MFA). In the first half of 2026, VPN was the stated access type in 29% of listings, RDP in 14%, and web panel access in 11%.
One of the most actively used methods among the cybercriminals is to obtain compromised user credentials from a stealer type of malware, which allows them to harvest logon information, cookie and sensitive data from infected devices. Only in the first half of 2026, there were detected more than 17 million device compromises with well-known stealer malware. Of course not every stealer log could contain credentials belonging to an employee, but even if it would be only one compromised employee account among 100 stolen credentials — it poses a real security risk to a company.
To prevent credential-stealing malware, every company should follow a number of recommendations. First and foremost, users should be prohibited from registering for third-party services using corporate credentials. Employees should also limit their use of personal devices to access the corporate network, including via VPN. Furthermore, employees should be prohibited from installing applications or downloading files from unofficial sources, as well as from clicking suspicious links. It’s important to limit employee access to sensitive data and the privileges granted to them, reduce the number of users with high privileges within the infrastructure, and remove all inactive users. Finally, employees should be required to disable autofill for credentials in browsers.
To scope the majority of threats incoming from initial access brokers, every company should take into account as many TTPs representing the full range of the most active IAB’ capabilities as possible.
Researching the underground market allows us to identify the techniques used by threat actors and compare their activities to the MITRE ATT&CK matrix. The following TTPs cover the activity of some recently analyzed IABs. For instance, the Resource Development tactic includes the Develop Capabilities: Malware (T1587.001) technique — part of the IAB appears to be involved in the development and exploitation of malware for harvesting credentials or exploiting authentication vulnerabilities. The most prominent Initial Access block includes External Remote Services (T1133): many brokers indicate that access was provided via RDP and VPN, as well as Valid Accounts: Domain Accounts (T1078.002) — claimed access to domain user and administrator accounts. Some actors report exploitation of public applications (T1190) via CVE for remote code execution. Credential Access includes Brute Force (T1110): a number of access sellers claim that some access was obtained through brute force. Finally, Discovery highlights Software Discovery: Security Software Discovery (T1518.001) — in ads, brokers list security solutions installed on compromised devices, which helps buyers assess the risks of detection.
Staying up to date with current cybercrime trends allows every company to re-build the defence mechanisms in order to prevent the continuously changing threat landscape.
More, I’d recommend following those recommendations:
Ensure that security tools cover as much of the IT infrastructure as possible.
Apply software updates promptly and regularly to remediate known vulnerabilities, prioritizing critical issues.
Give highest priority to publicly accessible services and the operating systems on which they run, followed by domain controllers, backup systems, centralized management systems, and similar infrastructure.
Regularly back up important data following global best practices.
Enforce MFA for all user accounts, service accounts, and API gateways across the infrastructure without exception. This measure reduces the risk of threat actors gaining access with compromised or brute-forced credentials.
Use EDR or XDR solutions along with antivirus software to protect endpoints and the infrastructure.
Respond to and analyze all alerts from these solutions promptly to prevent unauthorized access or malicious behavior.
Implement DDoS protection solutions.
Proactively block traffic to and from potentially malicious hosts.
Enforce a strong password policy for local and domain accounts, both in the office and for remote work.
Use unique local administrator passwords on every host. If a single machine is compromised, this prevents the entire affected segment from having to be treated as compromised.
Design the network architecture so that individual segments can be isolated and both inbound and outbound traffic can be controlled.
When assigning access rights, follow the principle of least privilege, paying particular attention to service accounts and to accounts used for automated tasks and remote access.
Restrict network access to the specific tasks assigned to each account. For example, grant a contractor access only to the server they need rather than to the entire network segment or network.
Allow remote access only from trusted IP addresses or after the connecting device has been successfully identified. If neither measure is feasible, implement GeoIP filtering.
Prohibit direct RDP access to workstations from outside the internal network.
Identify indicators of initial access, persistence, and lateral movement across the network. Although threat actor techniques are often relatively unsophisticated, regular proactive threat hunting can also help detect more advanced attacks.
Detect known indicators of compromise and check infrastructure against them on a regular basis.
IAB Market in the next 5 years
Currently, the initial access market remains active and popular among attackers targeting corporate infrastructure. However, given the current trend of underground platforms shutting down and the growing distrust of popular forums among the underground community, it’s possible that many attackers will shift their focus from streaming individual lots to mass sales of accesses, based on the principle of “1,000 accesses for a few dollars,” and conducting shady business on the darknet. This is due to the fact that, firstly, such sales are more difficult to track, as the original seller doesn’t differentiate between individual accesses, but sells a ready-made set for subsequent analysis to other attackers. Secondly, with mass sales, the sales market expands through automated underground markets operating on the e-commerce principles but do not disclose details of the lot being sold, unlike underground forums. Thus, the buyer can purchase the lot automatically. Third, as fraud within the community itself grows, individual attackers are emerging who impersonate well-known sellers, further undermining trust within individual platforms.
It’s also worth emphasizing that gaining high-level access is becoming more expensive, including due to the implementation of security mechanisms in existing business solutions, as well as the reinforcement of internal incident response teams or the deployment of solutions from security vendors. Consequently, the cost of basic access can increase significantly, but it doesn’t guarantee its successful exploitation by attackers.
Unfortunately, there remain a large number of users worldwide who neglect information security rules. Therefore, due to human mistakes, the probability of preventing a corporate service compromise will never be zero. This will lead to attempts to further monetize compromised credentials, including through their sale in the underground.
____________
About the Author
Lada Kryukova is Head of the Underground Research Unit in the Threat Intelligence Department at F6.
Lada Kryukova is an experienced cybersecurity specialist with more than seven years of experience in underground research.
In 2019, she graduated from the National Research Nuclear University MEPhI, Institute of Intelligent Cybernetic Systems (ICIS). That same year, she joined the Group-IB Threat Intelligence team as an analyst. In 2023, Kryukova moved to F.A.C.C.T., and a year later, in 2024, she joined F6 as Head of the Underground Research Unit.
Beyond her operational work, Kryukova is a speaker at cybersecurity conferences, a co-author of industry studies, and a regular contributor to leading media outlets, providing expert commentary and insights.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
