Initial access broker : Description Wikipedia, the free encyclopedia

Initial access broker

Hacker selling access to hacked computers

Initial access brokers (or IABs) are cyber threat actors who specialize in gaining unauthorized access to computer networks and systems and then selling that access to other threat actors such as ransomware. IABs are parts of ransomware as a service economy, also called "cybercrime as a service economy".^[1]^[2]

Description

IABs use a variety of methods to gain initial access, including exploiting vulnerabilities in remote access services like RDP and VPNs, bruteforcing login credentials, and leveraging malware that steals account information. Access are often sold on auctions in underground criminal forums or directly provided to ransomware affiliate groups to expedite attacks.^[3]^[4]

IABs seek access to virtual private networks, remote desktop protocol, Web applications, and email servers. Email services will be used to commit spear phishing and business email compromise (BEC).^[5]

In 2020, the average price for a network access is $5,400. The median price is $1,000.^[1]

By providing initial access, IABs allow other cyber criminals like ransomware groups to more quickly infiltrate networks and launch attacks without wasting time to gain entry themselves. This access as a service model - in analogy to the software as a service model - provides scalability and efficiency to cybercriminal operations. Ransomware in particular has benefited from collaboration with IABs.^[3]

References

^ ^a ^b David, Efrat (2021-08-02). "All Access Pass: Five Trends with Initial Access Brokers". KELA Cyber Threat Intelligence. Retrieved 2024-01-15.
^ "Actions to Take to Defeat Initial Access Brokers". www.darkreading.com. Retrieved 2024-02-06.
^ ^a ^b "Initial Access Brokers How They're Changing Cybercrime". CIS. Retrieved 2024-01-15.
^ "The Initial Access Broker Economy: A Deep Dive into Dark Web Hacking Forums". BleepingComputer. Retrieved 2024-02-06.
^ "Actions to Take to Defeat Initial Access Brokers". www.darkreading.com. Retrieved 2024-02-06.

2020	BlueLeaks Twitter account hijacking European Medicines Agency data breach Nintendo data leak United States federal government data breach EasyJet data breach Vastaamo data breach
2021	Microsoft Exchange Server breach Ivanti Pulse Connect Secure data breach Colonial Pipeline ransomware attack Health Service Executive ransomware attack Waikato District Health Board ransomware attack JBS S.A. ransomware attack Kaseya VSA ransomware attack Transnet ransomware attack Epik data breach FBI email hack National Rifle Association ransomware attack Banco de Oro hack
2022	Ukraine cyberattacks Red Cross data breach Anonymous and the Russian invasion of Ukraine Viasat hack DDoS attacks on Romania Costa Rican ransomware attack LastPass vault theft Shanghai police database leak Grand Theft Auto VI content leak
2023	Munster Technological University ransomware attack Evide data breach MOVEit data breach Insomniac Games data breach Polish railway cyberattack British Library cyberattack
2024	XZ Utils backdoor