Access Broker Economy: When network access is sold on the dark web

Ransomware attacks rarely start with the ransomware. They start with a compromised account, an open VPN vulnerability or stolen credentials – and often with someone who resells exactly that access on the dark web.

Initial Access Brokers – an industry of their own

The dark web has developed a functioning division of labour. Initial Access Brokers (IABs) are specialised actors who concentrate on a single task: obtaining access to corporate networks and reselling that access.

Their offering is precisely catalogued. It includes VPN credentials with details of company name, industry and annual revenue, RDP access to specific servers, compromised admin accounts with known privilege levels, and active sessions to Citrix or VMware environments. Buyers – including ransomware groups, espionage actors and extortionists – know exactly what they are getting before they even complete the purchase.

Prices depend on the value of the target. Access to a mid-sized European industrial company with high revenue fetches considerably more than access to a small service provider. The market runs on supply and demand.

Why this division of labour is dangerous

For affected companies, this model means a structural shift: the actual breach – the moment someone gains unauthorised access – is not the same as the moment the damage becomes visible.

By the time ransomware is deployed, the initial access may be weeks old. During that time the original attacker has explored the network, documented credentials, prepared the listing and found the buyer. The ransomware actor walks into an environment that has already been opened up.

Classic reaction patterns come too late here: anyone who only reacts once files are being encrypted has already missed the decisive window.

What the dark web says about your company

IAB listings are often surprisingly extensive. Alongside the access route and company name, they frequently include the number of reachable systems, the privilege level of compromised accounts and the security software in use. Some even hint at which EDR solutions are already present and would need to be bypassed in a follow-up attack.

This information does not come from database leaks. It was actively extracted from the network before the listing was created. An IAB entry means: someone was already inside.

Where blacklens.io comes in

Dark Web Monitoring in blacklens.io starts with the raw material brokers often build their access from: credentials and session cookies from infostealer logs and combolists. It also captures initial access broker offers in underground forums and marketplaces. It reports compromised identities with a password, session cookie or personal data, as well as compromised devices, and automatically classifies whether employees or customers are affected.

For each finding, the team sees which account is affected and whether the data came from infostealer malware or a combolist. For a compromised device, it also sees the hostname, operating system, installed antivirus products and infection date. Expired session cookies are archived automatically.

This is exactly where it differs from classic, reactive incident response. A finding like this does not necessarily mean someone has already been inside the network. It shows that credentials or sessions have leaked that a broker could turn into saleable access. Resetting the passwords and ending the affected sessions takes that raw material away – ideally before anyone has used it.