What Initial Access Brokers Do and How They Fuel Cybercrime
Summary
Initial access brokers break into organizations, validate and sell access to other attackers, enabling attacks such as ransomware and data theft. The article explains common entry methods and ways businesses can reduce risk.
Key points
- Initial access brokers gain unauthorized access, assess its value, and sell footholds or credentials to other cybercriminals.
- Common entry methods include stolen credentials, infostealer malware, vulnerable or exposed systems, and phishing or social engineering.
- Buyers may use the access for follow-on attacks, including ransomware, business email compromise, or data theft.
- Access handoffs and delays can make it difficult to determine who first gained access, who sold it, or when it changed hands.
- Recommended defenses include enabling MFA, restricting and monitoring remote access, promptly patching internet-facing systems, training users, and monitoring for suspicious identity activity.
Article Details
- Topic
- Initial access brokers (IABs), their role in the cybercrime supply chain, common access methods, and ways businesses can reduce the risk.