Rapid7 Report Finds Initial Access Brokers Prioritizing High-Value Targets
Report discovered via Awesome Annual Security Reports.
Summary
Rapid7 analyzed initial-access listings across five cybercrime forums, finding higher asking prices, more high-value targets and growing emphasis on privileged access. RDP, VPN and RDWeb remained common; some figures rely on broker claims.
Key points
- The report examined 2025 initial-access listings across Exploit, XSS, BreachForums, DarkForums and RAMP.
- DarkForums (221 threads) and RAMP (208) accounted for 81% of the observed listings; the report found less activity on older forums.
- Average asking price was $113,275, up about 4,055% from the prior year. Average alleged victim revenue was $3.242 billion, but Rapid7 cautioned that brokers supplied those revenue estimates and they may be inaccurate.
- RDP, VPN and RDWeb were the most commonly advertised access types, at 21.2%, 12.8% and 11.2%, respectively.
- Domain User access made up 42.9% of observed privilege listings, followed by Domain Admin at 32.1% and Local Admin at 12.5%; no Local User listings were observed.
- Government was the most frequently listed target sector (14.2%), followed by Retail (13.1%) and IT (10.8%); U.S. organizations accounted for 30.9% of listings.
- Rapid7 also observed a RAMP listing offering an exploit for CVE-2025-61882 in Oracle E-Business Suite. The report says Cl0p exploited the flaw as a zero-day to steal financial and HR data for extortion.
Article Details
- Publisher
- Rapid7 Labs
- Report Period
- H2 2025; monitoring is described as covering January–December 2025
- Scope
- Initial access broker listings, access types, pricing, and target geographies and industries across Exploit, XSS, BreachForums, DarkForums, and RAMP
- Key Statistics
- Reported sale-thread counts: DarkForums 221, RAMP 208, Exploit 53, Breached 30, and XSS 18; DarkForums and RAMP together accounted for 81% of observed threads.
- Average alleged victim organization revenue was $3.242 billion and average offering base price was $113,275; victim revenue figures were broker-provided and may be inaccurate.
- Average offering base price increased by approximately 4,055% compared with the previous year.
- Most frequently offered access types were RDP (21.2%, 91 offers), VPN (12.8%, 55 offers), and RDWeb (11.2%, 48 offers).
- Government accounted for 14.2% of observed offerings, Retail 13.1%, and Information Technology 10.8%.
- Recommendations
- Monitor for anomalous logins, unexpected privilege escalations, access outside normal business hours, and activity from unfamiliar locations.
- Enforce least privilege, tightly control administrative rights, and harden remote access services with MFA.
- Accelerate intrusion detection and prioritize rapid identification and containment of breaches.
MITRE ATT&CK
T1133 · External Remote ServicesRemote access offerings for sale included RDP, VPN, and RDWeb access to enterprise environments.T1190 · Exploit Public-Facing ApplicationThe report describes CVE-2025-61882 as allowing unauthenticated attackers to execute arbitrary code via HTTP against Oracle E-Business Suite.
CVE
People
Threat Actors
Big-BroA RAMP user selling access points; the report says this user is likely the same person as DarkForums user BigBro.BigBroA highly active DarkForums user who sold Fortinet access points, according to the report.Cl0pThe report says the Cl0p criminal organization exploited CVE-2025-61882 as a zero-day to exfiltrate financial and human resources data for extortion attempts.IntelBrokerThe report identifies IntelBroker as a prominent figure in the IAB community and says the person behind the name was apprehended and charged.lacrimA RAMP user whose threads, together with those of Big-Bro, accounted for most of the analyzed RAMP threads; the report describes the user's Albanian background as alleged.
Vendors
Products
Countries
Braziltop, with a large margin from the following countries (the United Kingdom, India, and Brazil).Indiatop, with a large margin from the following countries (the United Kingdom, India, and Brazil).United Kingdomtop, with a large margin from the following countries (the United Kingdom, India, and Brazil).United Stateslistings concern networks in the United States, totaling 155 unique listings.