Initial Access Broker Market Summary

Listings often include details about the country, sector, revenue, access type, and level of access without revealing the companies’ identities. While not all transactions are public, these forums provide insights into the initial access market, dominated by Russian speakers and governed by supply-and-demand principles.

Conclusions Drawn

Initial access to corporate networks is a significant revenue stream in cybercriminal forums. The “Accesses” sections reveal market trends, offering insights into access trading dynamics. Listings provide details on the country, sector, revenue, access type, and level of access without disclosing company identities. CYJAX tracks and analyses these listings daily to monitor the threat landscape, focusing on trends in access types, privilege levels, antivirus software, and initial access brokers. Prices for listings vary based on country, industry sector, access type, and privilege level.

Best Practices to Avoid Being a Victim

Organisations should implement strong policies and procedures to protect against brute force attacks, regularly update devices and software, and ensure internal devices are not externally accessible. Mitigating social engineering risks through employee training, email filtering, and manual analysis of communications is also crucial.

Monitoring and Future Analysis

CYJAX monitors and analyses IAB listings on cybercriminal forums to identify trends and alert potential victims. In Q2, CYJAX will conduct a comparative analysis to observe changes in market trends and determine if the market is more influenced by supply than demand.