In imagination a black hat “breaks the company”. In part of the ransomware chain someone else already sold the entry.
An initial access broker (IAB) is a role in the criminal ecosystem: they obtain or buy access to environments (often RDP, VPN, mailboxes, panels) and resell it — to ransomware groups, fraud crews, or whoever will do the rest.
This piece is for defence and IR. It does not teach buying or selling access. It describes the model so you understand why a “small firm with no enemies” still ends up on a list.
Why access is a commodity
A zero-day exploit is expensive and noisy. More convenient options include:
- a breached password on internet-facing RDP,
- a VPN account left after an employee left,
- a mailbox that can reset other accounts,
- a panel left “for testing” on the internet.
The broker does not need to be in your industry. They need working access and a buyer.
For the victim the effect looks similar: foreign sign-in, then lateral movement, then — sometimes — ransomware. The difference is that the “break-in” may have lived longer than you think before encryption started.
What that means in practice
- The first alert is not always the end. It may be the middle of a chain where access lived for weeks.
- Changing one password does not close the case if the broker has a second account or a session — see session theft.
- Public RDP / weak VPN is not only “theoretical risk”. It is a product format on the black market.
- A small firm is attractive because it has data, invoices, mail and often weaker monitoring than an enterprise.
Signs someone may have “entered earlier”
None of the points below alone equals an IAB. Together they justify triage:
- sign-ins outside the usual geography / at 03:00 with no explanation,
- new local or domain accounts,
- unusual VPN sessions,
- antivirus or logging turned off,
- remote tools nobody ordered,
- mail used to reset passwords at suppliers.
When you see that, do not start with “we recover everything in 15 minutes”. Start with facts: the IR checklist, then the ransomware first hour if encryption is already visible. The ransomware decision card helps with the call order.
What lowers the value of your environment as a product
- close needless exposure (exposure worksheet),
- MFA on VPN, mail and admin panels,
- separate admin accounts and fast revocation when people leave,
- sign-in logs and the ability to answer “since when”,
- backup with a real boundary and a restore test — because entry can still happen.
This is not a romantic war against “hacker geniuses”. It is lowering the price someone would pay to sell access to you.
Boundaries
I do not describe forums, payments or how to acquire access. I do not list tools for trading access. If someone offers you “entry to company X” — that is a crime, not “grey-hat research”.
Suspected foreign access: report the event or describe scope for a security assessment before “we will wait and see if it goes away”.