Also known as: IAB · access broker
An initial access broker (IAB) is a criminal specialist who breaches organisations and then sells that access to other attackers, such as ransomware affiliates, rather than monetising the intrusion themselves.
IABs represent the maturation of cybercrime into a supply chain with specialised roles. A broker might compromise hundreds of organisations through exposed VPN appliances or credential stuffing, catalogue them by revenue and sector, and auction access to the highest bidder.
For defenders, this decouples the breach from the damage: an organisation may be compromised weeks or months before anything visibly happens, because the access sat in a broker's inventory waiting for a buyer.
Ransomware-as-a-Service
Ransomware-as-a-service (RaaS) is a criminal business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out the actual intrusions and share a percentage of ransom proceeds with the operators.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Dwell Time
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.