Intelligence
What is Initial access broker?
A criminal who breaks into organisations or collects working logins and then sells that access to other criminals, often ransomware groups.
An initial access broker, or IAB, specialises in getting into organisations and selling that access instead of using it. The product might be VPN credentials, a remote desktop login, a web shell or a foothold from an infostealer infection.
Brokers advertise on cybercrime forums and private channels, usually describing the victim by country, sector, revenue and access level rather than by name. Monitoring these listings can give a company warning that its access is for sale.