Many breaches begin with valid credentials, exposed remote services, phishing, or exploitation of internet-facing systems. Increasingly, attackers try to turn intrusion into something that looks like a normal login.
Someone gains a foothold, then sells it. The buyer may use the access almost immediately or hold it for later. Microsoft has observed access-broker handoffs progressing to ransomware in less than an hour in some cases. (Microsoft)
What Is Initial Access?
Initial access is the first foothold inside an environment. Not full control, not necessarily admin rights. Just a way in: a VPN login, email credentials, a cloud console, RDP or SSH access, or an admin panel.
Once it exists, an attacker does not break in. They log in. That is what makes it worth buying.
How Does the Access Market Work?
Access is traded on private forums, invite-only marketplaces, and closed messaging groups. Listings are typically anonymised, describing the product rather than the victim: sector, region, size, access type, and whether MFA is in place. Something like "VPN access, mid-size fintech, EU."
Advertised access can range from hundreds of dollars to tens of thousands, with exceptional high-value listings going much higher. Price depends on factors such as access level, target value, industry, and environment. Flare observed listings from $150 to more than $120,000 in one dataset. (flare.io)
Who Are the Access Brokers?
The seller is often not the attacker you hear about.
Initial access brokers specialise in getting in, through phishing, info-stealer malware, credential harvesting, or scanning at scale. Some brokers focus on obtaining and maintaining access, then sell or transfer it rather than carrying out the final extortion themselves. Microsoft has documented brokers selling compromised RDP and other privileged access directly to ransomware operators.
This division of labour is why attacks scale.
How Do Attackers Gain Access?
Stolen credentials. A major route into organisations. They can come from phishing, infostealers, password reuse, previous breaches, or underground credential markets. Google observed compromised legitimate credentials in 21% of 2025 ransomware intrusions where an initial-access vector was identified. (Google Cloud)
Exposed remote services. Attackers scan continuously for RDP, SSH, database ports, and admin interfaces.
Cloud misconfiguration. Over-permissioned IAM roles, exposed APIs, and leaked keys lead to console access, then to storage and more credentials.
Third-party access. Compromised vendor, MSP, or partner access can provide a trusted path into another organisation and may therefore be valuable to attackers.
What Happens After Access Is Sold?
Buyers include ransomware groups, data theft crews, espionage actors, and fraud operations. The early steps look similar: validate the access, explore, escalate privileges, weaken security controls, establish persistence. Follow-on activity can begin within minutes or remain quiet for much longer, depending on the buyer and objective.
Why Does It Matter?
Valid-account access can be harder to distinguish from legitimate activity, particularly when monitoring focuses mainly on malware or exploit signatures. Identity, device, and behavioural monitoring can still detect unusual use.
Consequences arrive later: domain compromise, cloud account takeover, data theft, ransomware. Access can be resold or transferred between brokers and other threat actors, increasing the number of actors who may eventually use the same compromised environment. Flare documents IABs reselling access to ransomware groups, nation-state actors, and other brokers. (flare.io)
Common Mistakes
- Leaving forgotten systems exposed. Old VPN endpoints and unused admin panels are targets because nobody watches them.
- Treating vendor accounts as lower risk. They are trusted paths inward.
- Assuming MFA closes every route. Phishing-resistant MFA can make password-based access far harder to use, but attackers may still trade stolen sessions, tokens, or access where MFA is weak or absent.
- Focusing detection on the final attack. By the time ransomware or extortion begins, useful initial-access signals may already be old, or the intrusion may have progressed very quickly.
How to Reduce the Risk
- Enforce phishing-resistant MFA on VPN, email, cloud, and admin accounts
- Remove remote services from internet exposure where they need not be
- Review cloud IAM permissions and rotate long-lived keys
- Monitor authentication logs for unfamiliar locations and impossible travel
- Restrict and review vendor access regularly
What Should Security Testing Cover?
Ask your testers to establish:
- What is externally exposed that no inventory records
- Whether known-leaked credentials still work anywhere
- What one valid account reaches before hitting another control
- Whether unusual authentication raises an alert anyone acts on
How OraSec Can Help
OraSec approaches this from both directions. Signal monitors darknet sources for access and credentials referencing your organisation, while Pentia provides continuous penetration testing that finds exposed entry points before a broker does.
Conclusion
Attackers do not always hack their way in. Sometimes they buy the keys from someone who did.
A programme built around the final attack watches the last step in a chain that began somewhere else.
FAQs
How would we know if our access was listed? Darknet monitoring can flag advertised access, though private sales may never appear.
Which access types are most valuable? Privileged access, broad network reach, valuable targets, and weak security controls generally increase a listing's value. Microsoft notes that listings advertising highly privileged credentials or environments without effective EDR can command more value. (Microsoft)
