Access Brokers and the Identity Economy: How Cybercrime Monetised Stolen Credentials

## Your Credentials Are Already for Sale. Do You Know It?

Before most ransomware attacks begin, someone already bought a door into your network. Not through a zero-day. Not through a sophisticated exploit chain. Through a set of valid credentials, purchased from a specialist criminal operator who found them, verified them, and listed them for sale — often weeks before you notice anything wrong.

This is the access broker economy. It is mature, structured, and operating at industrial scale. Understanding it is not optional for anyone responsible for defending enterprise environments in 2026. For real-time monitoring of these trends, refer to our News and Threat Reports.

Deep Dive: How Access Brokers Monetise Stolen Credentials

What Is an Access Broker?

An access broker is a cybercriminal specialist who focuses exclusively on obtaining and selling initial access to corporate networks — not on monetising that access themselves. They are the wholesale layer of the cybercrime supply chain.

The model works because specialisation increases efficiency. Ransomware groups are optimised for extortion. Initial access requires different skills: phishing at scale, credential stuffing, exploiting exposed services, and verifying that access is live, privileged, and valuable before selling.

Access brokers occupy the gap between initial compromise and monetisation — and they do it better than ransomware operators would if they tried to do it themselves.

How the Access Broker Market Works

What gets listed:

● RDP access — Remote Desktop Protocol exposed to the internet remains the single most common product. A verified RDP session with domain administrator credentials to a mid-market company sells for $500-$5,000.

● VPN credentials — Valid VPN accounts to corporate environments, often harvested from phishing campaigns or credential databases.

● Cloud console access — AWS, Azure, and GCP console access, particularly accounts with administrative or billing permissions.

● Web shell access — Persistent access installed on internet-facing web servers, surviving password resets.

● Initial access via malware — Networks already infected with information stealers or remote access trojans, sold as active compromises.

How access is priced:

• Organisation size — larger organisations command premium pricing
• Privilege level — domain administrator access vs standard user
• Industry — healthcare, financial services, and critical infrastructure premium-priced
• Geography — specific countries or regions trade at different prices
• Revenue — known revenue figures increase price proportionally

Where it is sold:

• Dark web forums (RAMP, Exploit, XSS — the major Russian-language forums)
• Private Telegram channels for established buyers
• Direct broker-to-affiliate relationships for repeat business

Initial Access Techniques

Access brokers use several primary techniques to build inventory:

Credential stuffing at scale

Billions of username/password combinations from previous breaches are available for minimal cost. Brokers automate testing these credentials against corporate VPN portals, webmail, and remote access systems. Organisations without MFA are systematically enumerated.

Phishing infrastructure

Sophisticated phishing campaigns using lookalike domains, real-time MFA token harvesting (adversary-in-the-middle proxies like Evilginx), and pretexting designed to harvest session tokens rather than just passwords — bypassing MFA entirely. One of the best ways to counter this is through a robust Zero Trust Architecture.

Exploitation of internet-exposed services

Brokers conduct systematic scanning for vulnerable internet-facing services — unpatched VPN appliances (Fortinet, Pulse Secure, Citrix have been particularly targeted), Exchange servers, and remote management interfaces. Exploitation is often automated at scale.

Information stealer malware

Redline, Raccoon, and Vidar infostealers harvest credentials, session cookies, and browser-stored passwords from infected endpoints. The output is sold in bulk — "logs" containing hundreds of credentials per infection — to brokers who verify and resell the valuable ones.

How Ransomware Groups Use Access Brokers

The relationship between access brokers and ransomware groups (or their affiliates) is the backbone of the modern ransomware economy:

1. Broker obtains and verifies access The broker confirms the access is live, assesses the environment (domain controller count, backup systems, revenue estimates), and lists it with detailed specifications.

2. Ransomware affiliate purchases access Affiliates working under a Ransomware-as-a-Service model purchase access listings that match their target criteria — specific revenue thresholds, industries, or geographies.

3. Affiliate conducts pre-ransomware operations Lateral movement, privilege escalation, data exfiltration for double extortion, disabling backups. This phase can last weeks.

4. Ransomware deployment and extortion The affiliate deploys ransomware, demands payment, and splits the ransom with the RaaS operator under a commission structure (typically 70-80% to affiliate, 20-30% to operator).

The access broker who sold the initial door typically receives their payment — a flat fee — before the ransomware ever executes.

Detection: Finding Access Broker Activity in Your Environment

External monitoring signals:

• Your corporate credentials appearing in breach databases or dark web forums — automated monitoring services (Recorded Future, Flare, SpyCloud) surface these before brokers verify and sell
• Your internet-facing services being scanned — unusual source patterns against VPN portals and RDP indicate enumeration
• Domain lookalikes registered — infrastructure being prepared for phishing campaigns targeting your organisation

Internal detection signals:

• Authentication from unusual geographies or at unusual times for known accounts
• VPN connections from residential or anonymising infrastructure (data centre IP ranges, Tor exit nodes)
• Successful authentication after multiple failures — credential stuffing with working credentials
• New devices authenticating with valid credentials of inactive or offboarded accounts
• Service accounts authenticating interactively — a strong indicator of credential misuse

Response: When Your Credentials Are Listed

If threat intelligence surfaces your credentials or access being sold:

1. Immediate credential rotation for all accounts matching the listed access type
2. Force re-authentication across all active sessions for affected account types
3. Review authentication logs for the past 30-90 days for the affected accounts
4. Verify backup integrity and offline backup status — assume the buyer may have already accessed the environment
5. Engage threat intelligence to understand what specifically was listed and what was verified about your environment
6. Incident response posture — treat a confirmed listing as a potential active compromise until proven otherwise

Conclusion

Access brokers are not a new threat. They are an established, professionalised market that funds the majority of ransomware operations globally. The defenders who understand how this market works — how access is obtained, verified, priced, and sold — are significantly better positioned to detect and disrupt the attack chain before ransomware is the problem they are solving.

Your credentials are a commodity. Treat them accordingly.

Monitor for exposure. Enforce phishing-resistant MFA. Detect anomalous authentication. And assume that if your environment has been tested from the outside, someone has already noted what they found.

Frequently Asked Questions

---

Comparative Reference: Access Broker Pricing & Attack Chain

Sources: Secureworks, KELA, Mandiant M-Trends 2025