Initial Access Broker (IAB)

Qakbot, which the FBI took down in August 2023, opened up networks that groups such as Conti, REvil and Black Basta then encrypted. The access broker does the same job on its own account. An Initial Access Broker handles a single stage of the attack chain, getting into corporate networks, and then resells that access on underground forums to other actors, notably ransomware affiliates. What it sells may be valid credentials, remote-desktop access, an exploitable vulnerability or an already active session. This specialization shows the division of labor in the cybercriminal economy, where intrusion and monetization have become two separate trades. For cyber underwriting, a market for initial access shifts part of the risk analysis toward the insured's authentication hygiene, the exposure of its remote services and how fast it patches vulnerabilities. There is one methodological difficulty. Access may be resold several months before it is exploited, so a time lag opens between the initial compromise and the reported loss, and the triggering event becomes harder to date under an insurance contract.