thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Initial Access Broker (IAB)

A cybercriminal who compromises networks and sells that access to other criminals such as ransomware affiliates.

Definition

Initial access brokers obtain footholds through stolen credentials, exposed RDP or VPN, phishing or exploited vulnerabilities, then advertise them on underground forums priced by victim size and privilege level. Their existence separates intrusion from monetization in the cybercrime economy. Monitoring dark web forums can reveal that an organization's access is for sale.

Example

A forum post selling domain-admin VPN access to a manufacturing firm is the work of an initial access broker.

Exam tip

IABs explain why ransomware deployment may occur weeks after the original compromise by a different actor.

Related terms