Initial access brokers (IABs) are specialized cybercriminals who gain entry to corporate networks and sell that access to other threat actors, including ransomware groups. IABs often source their footholds from infostealer logs containing VPN credentials, RDP passwords, and valid SSO session cookies.
The IAB market turned initial access into a commodity with standardized pricing, escrow services, and reputation systems. Infostealer lookup services accelerated this trade by letting buyers search for corporate access by domain rather than purchasing bulk logs and parsing them manually.
Read how lookup services reshaped the market in the new era of initial access and how infostealers feed ransomware in the missing link between infostealers and ransomware.