Threat Profile: Initial Access Brokers (IAB)

1. The Cybercrime Supply Chain

The emergence of IABs represents the ultimate industrialization of cybercrime. Threat actors no longer need to be full-stack operators.

The Role: The IAB forces the door open, verifies the key works, assesses the value of the target, and sells the access.
The Value Add: They transform raw data (e.g., an unparsed list of stolen cookies or an IP address vulnerable to a zero-day) into Qualified Access. IAB listings on underground forums typically detail the victim’s industry, geographic region, annual revenue, the type of access provided (e.g., VPN, RDP, Domain Admin), and the number of accessible hosts.
The Economy: Access prices range from a few hundred dollars for standard RDP access on a small business, to tens of thousands of dollars for Enterprise Admin credentials in a Fortune 500 company. Buyers are typically high-tier RaaS affiliates, such as those deploying Akira or Qilin payloads.

2. Attack Vectors and TTPs

IABs are highly opportunistic. They scan the internet at massive scale and leverage automation to secure footholds.

Edge Appliance Exploitation

When a critical vulnerability (N-day or Zero-day) is disclosed for perimeter devices like Ivanti Connect Secure or Fortinet gateways, IABs are the first to mass-exploit them. They drop webshells to secure access before the victim’s IT team can apply the patch.

Infostealer Ecosystem

IABs actively purchase logs from Infostealer botnets (e.g., Lumma, RedLine). They parse these logs for valid session cookies and credentials granting access to corporate VPNs, RDP endpoints, or Microsoft 365 environments.

Password Spraying & Brute Force

Targeting exposed external services (RDP, SSH, OWA) with automated Password Spraying campaigns, searching for accounts with weak passwords and no Multi-Factor Authentication (MFA) enforced.

3. The DFIR Golden Window (“Left of Boom”)

Detecting an IAB is the ideal scenario for a defender. It means the perimeter has been breached, but the catastrophic event (Ransomware deployment) has not yet occurred.

There is an operational delay—ranging from a few hours to several weeks—between the moment the IAB secures the network and the moment a RaaS affiliate buys the access and drops the encryptor. This is the Golden Window for Incident Responders to eject the intruder.

Hunting for Weak Signals

IABs want to ensure their access is valid and determine the target’s value without making too much noise.

The “Check-in” Logon: A successful Event 4624 (Type 10 - RDP) or VPN logon from an unknown IP address, followed by a very brief session (often under 5 minutes). The IAB is simply checking if the key still works.
Lightweight Reconnaissance: The execution of native LOLBAS commands such as whoami /all, quser, or netdom query fsmo. The IAB uses these to write the description for their dark web listing (e.g., “Access level: Domain Admin”).
Backdoor Account Creation: The stealthy addition of a generic user account (e.g., backup_admin) to the local Administrators group to ensure persistence if the original compromised account is disabled.

4. Detection and Threat Hunting

To catch IABs during the Golden Window, SOC analysts must correlate remote access logs with immediate reconnaissance or persistence behaviors.

KQL (RDP Reconnaissance Check-in)
Sigma (Backdoor Account Creation)

// Detects a remote interactive logon (RDP) immediately followed by
// standard IAB reconnaissance commands within a 5-minute window.
let RemoteLogons = SecurityEvent
| where EventID == 4624 and LogonType == 10
| project LogonTime = TimeGenerated, Computer, TargetUserName, IpAddress, TargetLogonId;

DeviceProcessEvents
| where FileName in~ ("whoami.exe", "quser.exe", "net.exe", "systeminfo.exe", "ipconfig.exe")
| join kind=inner (RemoteLogons) on $left.DeviceName == $right.Computer and $left.InitiatingProcessAccountName == $right.TargetUserName
// Ensure the recon command happened shortly after the RDP logon
| where TimeGenerated between (LogonTime .. (LogonTime + 5m))
| project TimeGenerated, LogonTime, DeviceName, TargetUserName, IpAddress, FileName, ProcessCommandLine
| sort by TimeGenerated desc

title: Suspicious Local Administrator Account Creation
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: stable
description: Detects the creation of a new user account (Event 4720) and its immediate addition to the local Administrators group (Event 4732), a classic IAB persistence tactic.
logsource:
    product: windows
    service: security
detection:
    selection_create:
        EventID: 4720
    selection_group:
        EventID: 4732
        TargetUserName: 'Administrators'
    # In a SIEM, correlate these two events occurring within minutes by the same SubjectUserName
    condition: selection_create or selection_group
level: high
tags:
    - attack.persistence
    - attack.t1136.001

5. CTI & Dark Web Monitoring

Proactive defense relies on Cyber Threat Intelligence (CTI). Organizations should monitor dark web marketplaces (e.g., Exploit.in, XSS.is) and Initial Access broker channels.

If an IAB posts a listing that matches your organization’s profile—for example: “Access for sale: French Manufacturing Company, Revenue $500M, VPN access (Ivanti)“—it must trigger an immediate, high-priority audit of your edge appliance logs and active sessions, even before any internal alerts fire.

Sources & References

CIS Center for Internet Security: Initial Access Brokers: How They’re Changing Cybercrime
Flare: Initial Access Brokers Glossary
Arctic Wolf: What are Initial Access Brokers?
Related Playbook: Ransomware Investigation
Related Artifact: LOLBAS Reconnaissance Execution
Related Artifact: Event 7045/4698 (Persistence & Account Creation)