Updated May 2026, by the Ransomnews Research Team.
Every modern ransomware attack starts with a foothold someone else built. The market that supplies those footholds, the initial access broker, or IAB, is now a stable, specialised tier of the cybercrime economy, and understanding its mechanics is the difference between defending against vague “the attackers got in somehow” narratives and defending against an actual pricing function with known levers.
This piece is an explainer, not a how-to. We walk through how IABs source access, how they price it, what a 2026 listing actually contains, and what defenders should adjust to make their organisation a worse buy.
What an IAB actually sells
An IAB sells arrival: working access to a corporate environment, packaged so the buyer can act without doing reconnaissance. The unit of inventory is the access itself, not stolen data. Most listings in 2026 fall into one of five categories:
- VPN credentials, Cisco AnyConnect, Fortinet, Palo Alto, Citrix Netscaler. Sourced from infostealer logs (see our stealer-log coverage). Median listing in 2026: $1,500–$5,000 for SMB; $20,000–$100,000+ for Fortune-1000 footprints.
- RDP / SSH, bare-IP exposure or jump-host access. Cheaper because of higher detection risk; usually $200–$2,000.
- Single sign-on cookies, session tokens for Microsoft 365, Okta, Google Workspace, often paired with the original infostealer machine fingerprint. The fastest-growing category in 2025–2026 because they bypass MFA.
- Web-shell access, typically a perimeter-application compromise (Confluence, Exchange, ManageEngine). Listed by CVE and patch status.
- Domain-admin credentials, the premium tier. Comes with an internal-network sketch and verifiable proof. $50,000+ for a properly-scoped enterprise.
Where the access actually comes from
Three sources dominate the supply side in 2026:
- Infostealer logs. Lumma, Vidar, Stealc, Redline successor families dump browser-saved passwords and session cookies; an IAB filters those for corporate-domain hits and resells them as identified access. Our infostealer family overview goes deeper.
- Mass exploitation campaigns. When a perimeter CVE drops (MOVEit 2023, ConnectWise 2024, Ivanti Connect Secure repeatedly through 2024–2025), IABs scan the internet and stockpile the access. The listings appear weeks or months after the first compromise.
- Phishing kits with credential capture. Lower-volume but higher-quality access, because the credentials are often captured live and fresh rather than from a months-old log.
How a 2026 listing is structured
A typical IAB listing on a Russian-speaking forum reads like a real-estate posting. It will not name the victim. It will name everything the victim cares about:
- Country and industry sector (e.g., “US, manufacturing”).
- Annual revenue band, often pulled from ZoomInfo, Dun & Bradstreet, or Crunchbase.
- Number of employees and approximate device count.
- Access type and scope (domain admin vs. user, plus an internal-network description).
- Domain name length and approximate redaction (a real listing often shows “comp***.com”, enough to verify, not enough to dox the buyer).
- Trust escrow: forum reputation score, percent of past listings with successful escrow conclusion, whether the seller offers proof-of-life screenshots.
Listings are typically auctioned over 24–72 hours with a stated buyout price. Sales closings are escrowed by the forum (an admin holds funds, releases on buyer confirmation of working access). The buyer’s identity is opaque to the seller and vice versa.
The pricing function
Five drivers move price:
- Revenue. Listings with revenue >$1B sell for 5–10x equivalent SMB listings. The buyer is bidding on ransom potential.
- Sector. Healthcare, manufacturing, finance, and government command higher prices because the buyer can extract higher ransoms.
- Scope. “User-level” access is cheap; “domain admin” is multi-x. “Domain admin + verified backup access” is multi-x again.
- Recency. Fresh access (under 7 days from initial compromise) prices higher than aged stock, the longer it sits, the more likely something’s been rotated, patched, or detected.
- Reputation. Sellers with hundreds of successful past escrows command 1.5–2x premiums over new accounts.
Who buys
Three buyer archetypes dominate the 2026 IAB market:
- Ransomware affiliates. The largest buyer pool. Affiliates running on RaaS platforms, see our Threat Groups archive for the operators they work with, buy access, deploy the encryptor, split proceeds with the operator.
- Data-extortion crews. Newer model: skip encryption, exfiltrate data only, threaten publication. Lower technical bar, often pays better against organisations that have invested in backups but not in DLP.
- State-affiliated actors, intermittently. Russian and Iranian intelligence-adjacent operators have been observed buying IAB access during periods of heightened tasking, then re-selling or releasing it after exfiltration.
What this means for defenders
Three controls measurably move you down the IAB price ladder, meaning your organisation becomes a less attractive listing:
- Phishing-resistant MFA on every administrative account. SSO cookie listings depend on captured session tokens, but a hardware-key step-up or device-bound passkey on admin actions invalidates almost all session-replay attacks. See our password-manager picks for the practical kit.
- Short session lifetimes for VPN and SSO. 12-hour and 24-hour sessions are 2026 norms; cut yours to 4 hours for privileged accounts. Cookies-as-inventory have a half-life equal to your session lifetime.
- EDR with browser-credential-store telemetry. Infostealers leave a distinctive process tree when they read browser credential stores; modern EDR catches it if you have visibility into endpoints. See our antivirus and EDR picks.
You can also actively monitor IAB listings adjacent to your organisation. Specialist services (Hudson Rock, KELA, Flashpoint) sell exposure feeds that flag mentions of your domain, ASN, or sector. Cheaper alternative: a curated set of public-forum threads, reviewed weekly, focused on your sector and country. The signal-to-noise is bad but the cost is zero.
A note on legal exposure
Reading public listings is not the same as buying access. The legal line is the transaction, and even non-transacting reconnaissance can become a problem in some jurisdictions (UK Computer Misuse Act, EU NIS2 reporting expectations). If you’re standing up an IAB-monitoring practice, get written internal authorisation, document scope, and route through professional services who carry the legal cover for this kind of work.
Further reading
- CISA #StopRansomware Guide, official defender-side guidance, updated regularly.
- MITRE ATT&CK T1133, External Remote Services, the technique that most IAB-supplied access falls under.
- Our Ransomtracker dashboard, every group profiled in our Threat Groups archive uses IAB access, often heavily.
The IAB market is the most legible part of the modern cybercrime economy. Treat it as a market, with prices, drivers, and elasticities, and your defensive priorities follow naturally. Your goal is not to disappear from it; that’s not realistic. Your goal is to be a worse buy than the company next door.