Initial Access Broker (IAB).

A cybercrime specialist who obtains unauthorised access to corporate networks and sells that access to other criminals, especially ransomware affiliates. It belongs to the Defense & Operations category of cybersecurity.

A cybercrime specialist who obtains unauthorised access to corporate networks and sells that access to other criminals, especially ransomware affiliates.

Initial Access Brokers (IABs) form a distinct layer of the cybercrime economy. They specialise in obtaining footholds in organisations via phishing, infostealer logs, valid VPN or RDP credentials, web-shell deployment, or exploitation of public vulnerabilities (Citrix, Fortinet, Pulse Secure, Ivanti, Microsoft Exchange). Access is then listed on Russian-speaking forums such as Exploit and XSS, on Telegram channels, or sold privately. Listings include the victim's industry, revenue, country, and access type, with prices from a few hundred to tens of thousands of dollars. Their main buyers are ransomware affiliates, business-email-compromise crews, and crypto-theft groups. IABs dramatically accelerate intrusions and explain why patching and credential hygiene are so important.

Defences for Initial Access Broker (IAB) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: IAB, Access broker.