Business logic of IAB: why an attacker sell access to the network
Why would an attacker sell access instead of using it yourself? The answer is in the specialization economy. Ransomware supply chain works on the model of labor division: the original access broker makes Initial Access (T1078 Valid Accounts, T1190 Exploit Public-Facting Application), and ransomware operators are engaged in encryption, exfiling and negotiation. Each link is scaled independently.
According to CrowdStrike Global Threat Report 2025, 75% of the incurs in 2024 used valid accounts. The average time of the lateral movement after access is 62 minutes, the record is 51 seconds. Compromise of the corporate network and its sale of IAB is the input point of the conveyor, not its finale.
Full chain of attack:
1. IAB gets access - phishing, VPN/RDP, stealer-log, brete-force
2. IAB fixed - web shell, backdoor accounts, Cobat Strike beacon
3. IAB verifies access - evaluates privileges, domain size, industry
4. IAB publishes an ad - Exploit, RAMP, DarkForums with a description of the lot
5. Buyer (Affiliate RaaS) acquires access to cryptocurrency
6. The buyer deploys post-exploitation, encrypts data, begins extortion
At the time of writing, Akira and Play are actively publishing victims each of the victims each year, from law firms in New Hampshire to infrastructure companies in the United States. The range of access purchases to DLS is measured for days. According to Mandiant M-Trends 2025, exploits remain the most common channel vector of initial access (38%), and the median time of the attacker on the network before detection is 11 days. During these 11 days, the purchased access turns into an encrypted infrastructure.
Original access market: forums, prices and IAB darkweb
Monitoring of underground forums is part of the daily work of CTI-analyst. Five sites form the core of the IAB market: Exploit, XSS, BreachForums, DarkForums and RAMP. According to the TI community, the distribution of access activity is shifting towards new sites - DarkForums and RAMP, while historically dominant Exploit and XSS lose share.
And here’s what it follows: if your darkweb threat monitoring covers only “classic” forums – you see less than a fifth of the lots with access to the customer infrastructure. The rest passes by.
What to sell: types of access and privilege
Characteristic trend: the sale of Local User privileges has completely disappeared from the sample. The original access market has shifted from volume to quality - buyers want access that allows a quick escalation and an lateral movement, not a "entry point without rights." Logically, why pay for an account that would have to climb to DA for another hour?
Pricing and Targeted Industries
The average price of the ad varies greatly depending on the site and the target organization. On the Exploit and XSS, the typical range is historically lower – from a few hundred to several thousand dollars per lot, while DarkForums feature large targets with prices of orders of magnitude higher. The most targeted industries: Government (14.2%), Retail (13.1%), IT (10.8%). For the public sector, the most common type of lot is admin panel access, the main sale is DarkForums.
Credential harvesting and operation: IAB techniques via MITRE ATT&CK
Threat intelligence IAB-activities fits into two key techniques of MITRE ATT&CK:
T1078 - Valid Accounts (Initial Access, Persistence, Privilege Escalation, Defense Evasion). IAB uses compromised account data to log through a VPN or RDP. According to the IBM X-Force Thread Intelligence Index 2025, real-time data attacks rose 71% over the year. The main source is stealer logs: infostealers (Redline, Raccoon, Lumma) took 32% among all types of malware in 2024, overtaking ransomware. According to Verizon DBIR 2025, 38% of data leaks are associated with account theft (not to be confused with 38% of exploits as a channel of initial access for Mandiant M-Trends 2025 are different metrics).
T1190 - Exploit Public-Facting Application (Initial Access). Exploitation of vulnerabilities in VPN gateways, Exchange, Confluence, Citrix. According to the Mandiant M-Trends 2025, exploits is the number one vector (38%), ahead of phishing and compromise prior. At the same time, according to IBM X-Force, the average time between the publication of CVE and its elimination in organizations is 29 months. Twenty-nine. The window of opportunity for IAB is not a slit, but a gate.
CVE-2021-40444 and Exotic Lily - an example of IAB-operations
CVE-2021-40444 - Remote code execution vulnerability in MSHTML. CVSS 8.8 (HIGH), CVSS vector:3.1/AV:N/AC:L/L/RIS/R:C/C/I:C/I::H/A:L. In the NVD is classified as CWE-22 (Path Traversal) - operation used path traversal in the processing of the CAB-archive to host an INF file that leads to RCE through ActiveX-control in MSHTML. Many versions of Windows with an MSHTML component have been affected, including Windows 10 (1507-2004), Windows Server and others (the full list of Microsoft Security Update Guide). Vulnerability included in CISA KEV Catalogue (Known Exploited Vulnerabilities) as actively operated, addendment date - 2021-11-03.
According to Microsoft MSTIC, operation CVE-2021-40444 tracked by the actor DEV-0413 in September 2021: phishing mailings with malicious Office documents containing an ActiveX element using the browser-drive engine. The victim had to open the file. Both cases are examples of IAB-operations: mass gaining initial access with subsequent monetization.
Place in kill chain and restrictions IAB-technics
IAB works strictly on the stages of Initial Access and Persistence. Everything that is next (Lateral Movement, Exfiltration, Impact) is the area of the buyer. The task of the IAB is to create reliable, verified access and disappear. After gaining access, the typical set: web shells on the perimeter, hidden local accounts, C2 via Cobalt Strike or Brute Ratel.
Infrastructure Hacking: IAB Artifacts
On every IR case associated with ransomware, retrospective analysis begins with the question: when exactly did the IAB get access? According to Mandiant M-Trends 2025, the median time before detection is 11 days, although in a number of cases the gap reaches months. Detection of unauthorized access at the IAB stage is the only chance to prevent encryption cheap.
What to Look for: Key Artifacts
VPN logs. Abnormal connections: new geolocation, non-working watch, traveltridge (two logins from different countries in a short interval). D3FEND describes this approach as the User Geolocation Logon Pattern AnalysisD3-UGLPA) VPN is the second most popular type of access for IAB (~13% lots), so this is the first checkpoint.
RDP-sessions. Unexpected connections to servers, especially through RDWeb (~11% ads). Event ID 4624 (a type of login 10 - RemoteInteractive) from IP outside the corporate network. RDP is the leader in the number of ads (~20%), and the most likely impromptu artifact.
Accounts. Reactivation of sleeping accounts, creation of local administrators. D3FEND recommends Domain Account Monitoring (D3-DAM) and Local Account Monitoring (D3-LAM) On Windows Utility cmdkey.exe (LOLBAS: Credentials, connected to T1078) is used to manage stored accounts - start cmdkey /list on critical servers and check whether new records have appeared. A simple action that no one does regularly.
MFA-events. Registering a new device or authentication method for an existing user. In the SigmaHQ repository there is a rule azure_tap_added.yml - Temporary Access Pass adaptation to Azure AD (T1078 tag). In total, T1078 in SigmaHQ - 115 rules.
Perimeter applications. Web shells on IIS/Apache/Nginx. Transition from 401 to 200 on sensitive endpoints. SigmaHQ contains 151 rule by tag T1190.
Detect of anomalous VPN connections: Sigma and SIEM
Example of Sigma-rules to detect a VPN login from an atypical geofence:
YAML:
title: VPN Login from Unusual Geolocation
logsource:
category: authentication
product: vpn
detection:
login:
EventType: 'VPN_Login'
known_geo:
SourceCountry|contains: ['RU','KZ']
condition: login and not known_geo
level: medium
tags:
- attack.initial_access
- attack.t1078
The rule is a concept for demonstrating an approach. Adapt to a specific VPN vendor (Cisco AnyConnect, Palo Alto GlobalProtect, FortiClitence) and a list of permissible geozones. For Splunk, similar logic:
Code:
index=vpn sourcetype=vpn_auth action=success
| stats dc(src_country) as countries values(src_country) as geo by user
| where countries > 1
| sort -countries
For Elastic use terms Aggregation by Field source.geo.country_iso_code with filter event.outcome: success. Specific implementation depends on the normalization of the fields with a VPN connector.
Darkweb Threat Monitoring: What to Look for on Forums
If you have access to the TI-platform with the background forums (MISP, OpenCTI, commercial solutions) configure the alerta to: company name and domain names in ads for access; employee email addresses in stealer dumps; IP ranges in RDP/VPN listings. According to Have I Been Pwned, only one Expressoit.In combo list is 593 427 119 unique email addresses. Stealer-logs with login pairsassword corporate accounting is the main supply channel for credential harvesting.
Why would an attacker sell access instead of using it yourself? The answer is in the specialization economy. Ransomware supply chain works on the model of labor division: the original access broker makes Initial Access (T1078 Valid Accounts, T1190 Exploit Public-Facting Application), and ransomware operators are engaged in encryption, exfiling and negotiation. Each link is scaled independently.
According to CrowdStrike Global Threat Report 2025, 75% of the incurs in 2024 used valid accounts. The average time of the lateral movement after access is 62 minutes, the record is 51 seconds. Compromise of the corporate network and its sale of IAB is the input point of the conveyor, not its finale.
Full chain of attack:
1. IAB gets access - phishing, VPN/RDP, stealer-log, brete-force
2. IAB fixed - web shell, backdoor accounts, Cobat Strike beacon
3. IAB verifies access - evaluates privileges, domain size, industry
4. IAB publishes an ad - Exploit, RAMP, DarkForums with a description of the lot
5. Buyer (Affiliate RaaS) acquires access to cryptocurrency
6. The buyer deploys post-exploitation, encrypts data, begins extortion
At the time of writing, Akira and Play are actively publishing victims each of the victims each year, from law firms in New Hampshire to infrastructure companies in the United States. The range of access purchases to DLS is measured for days. According to Mandiant M-Trends 2025, exploits remain the most common channel vector of initial access (38%), and the median time of the attacker on the network before detection is 11 days. During these 11 days, the purchased access turns into an encrypted infrastructure.
Original access market: forums, prices and IAB darkweb
Monitoring of underground forums is part of the daily work of CTI-analyst. Five sites form the core of the IAB market: Exploit, XSS, BreachForums, DarkForums and RAMP. According to the TI community, the distribution of access activity is shifting towards new sites - DarkForums and RAMP, while historically dominant Exploit and XSS lose share.
And here’s what it follows: if your darkweb threat monitoring covers only “classic” forums – you see less than a fifth of the lots with access to the customer infrastructure. The rest passes by.
What to sell: types of access and privilege
Characteristic trend: the sale of Local User privileges has completely disappeared from the sample. The original access market has shifted from volume to quality - buyers want access that allows a quick escalation and an lateral movement, not a "entry point without rights." Logically, why pay for an account that would have to climb to DA for another hour?
Pricing and Targeted Industries
The average price of the ad varies greatly depending on the site and the target organization. On the Exploit and XSS, the typical range is historically lower – from a few hundred to several thousand dollars per lot, while DarkForums feature large targets with prices of orders of magnitude higher. The most targeted industries: Government (14.2%), Retail (13.1%), IT (10.8%). For the public sector, the most common type of lot is admin panel access, the main sale is DarkForums.
Credential harvesting and operation: IAB techniques via MITRE ATT&CK
Threat intelligence IAB-activities fits into two key techniques of MITRE ATT&CK:
T1078 - Valid Accounts (Initial Access, Persistence, Privilege Escalation, Defense Evasion). IAB uses compromised account data to log through a VPN or RDP. According to the IBM X-Force Thread Intelligence Index 2025, real-time data attacks rose 71% over the year. The main source is stealer logs: infostealers (Redline, Raccoon, Lumma) took 32% among all types of malware in 2024, overtaking ransomware. According to Verizon DBIR 2025, 38% of data leaks are associated with account theft (not to be confused with 38% of exploits as a channel of initial access for Mandiant M-Trends 2025 are different metrics).
T1190 - Exploit Public-Facting Application (Initial Access). Exploitation of vulnerabilities in VPN gateways, Exchange, Confluence, Citrix. According to the Mandiant M-Trends 2025, exploits is the number one vector (38%), ahead of phishing and compromise prior. At the same time, according to IBM X-Force, the average time between the publication of CVE and its elimination in organizations is 29 months. Twenty-nine. The window of opportunity for IAB is not a slit, but a gate.
CVE-2021-40444 and Exotic Lily - an example of IAB-operations
CVE-2021-40444 - Remote code execution vulnerability in MSHTML. CVSS 8.8 (HIGH), CVSS vector:3.1/AV:N/AC:L/L/RIS/R:C/C/I:C/I::H/A:L. In the NVD is classified as CWE-22 (Path Traversal) - operation used path traversal in the processing of the CAB-archive to host an INF file that leads to RCE through ActiveX-control in MSHTML. Many versions of Windows with an MSHTML component have been affected, including Windows 10 (1507-2004), Windows Server and others (the full list of Microsoft Security Update Guide). Vulnerability included in CISA KEV Catalogue (Known Exploited Vulnerabilities) as actively operated, addendment date - 2021-11-03.
According to Microsoft MSTIC, operation CVE-2021-40444 tracked by the actor DEV-0413 in September 2021: phishing mailings with malicious Office documents containing an ActiveX element using the browser-drive engine. The victim had to open the file. Both cases are examples of IAB-operations: mass gaining initial access with subsequent monetization.
Place in kill chain and restrictions IAB-technics
IAB works strictly on the stages of Initial Access and Persistence. Everything that is next (Lateral Movement, Exfiltration, Impact) is the area of the buyer. The task of the IAB is to create reliable, verified access and disappear. After gaining access, the typical set: web shells on the perimeter, hidden local accounts, C2 via Cobalt Strike or Brute Ratel.
Infrastructure Hacking: IAB Artifacts
On every IR case associated with ransomware, retrospective analysis begins with the question: when exactly did the IAB get access? According to Mandiant M-Trends 2025, the median time before detection is 11 days, although in a number of cases the gap reaches months. Detection of unauthorized access at the IAB stage is the only chance to prevent encryption cheap.
What to Look for: Key Artifacts
VPN logs. Abnormal connections: new geolocation, non-working watch, traveltridge (two logins from different countries in a short interval). D3FEND describes this approach as the User Geolocation Logon Pattern AnalysisD3-UGLPA) VPN is the second most popular type of access for IAB (~13% lots), so this is the first checkpoint.
RDP-sessions. Unexpected connections to servers, especially through RDWeb (~11% ads). Event ID 4624 (a type of login 10 - RemoteInteractive) from IP outside the corporate network. RDP is the leader in the number of ads (~20%), and the most likely impromptu artifact.
Accounts. Reactivation of sleeping accounts, creation of local administrators. D3FEND recommends Domain Account Monitoring (D3-DAM) and Local Account Monitoring (D3-LAM) On Windows Utility cmdkey.exe (LOLBAS: Credentials, connected to T1078) is used to manage stored accounts - start cmdkey /list on critical servers and check whether new records have appeared. A simple action that no one does regularly.
MFA-events. Registering a new device or authentication method for an existing user. In the SigmaHQ repository there is a rule azure_tap_added.yml - Temporary Access Pass adaptation to Azure AD (T1078 tag). In total, T1078 in SigmaHQ - 115 rules.
Perimeter applications. Web shells on IIS/Apache/Nginx. Transition from 401 to 200 on sensitive endpoints. SigmaHQ contains 151 rule by tag T1190.
Detect of anomalous VPN connections: Sigma and SIEM
Example of Sigma-rules to detect a VPN login from an atypical geofence:
YAML:
title: VPN Login from Unusual Geolocation
logsource:
category: authentication
product: vpn
detection:
login:
EventType: 'VPN_Login'
known_geo:
SourceCountry|contains: ['RU','KZ']
condition: login and not known_geo
level: medium
tags:
- attack.initial_access
- attack.t1078
The rule is a concept for demonstrating an approach. Adapt to a specific VPN vendor (Cisco AnyConnect, Palo Alto GlobalProtect, FortiClitence) and a list of permissible geozones. For Splunk, similar logic:
Code:
index=vpn sourcetype=vpn_auth action=success
| stats dc(src_country) as countries values(src_country) as geo by user
| where countries > 1
| sort -countries
For Elastic use terms Aggregation by Field source.geo.country_iso_code with filter event.outcome: success. Specific implementation depends on the normalization of the fields with a VPN connector.
Darkweb Threat Monitoring: What to Look for on Forums
If you have access to the TI-platform with the background forums (MISP, OpenCTI, commercial solutions) configure the alerta to: company name and domain names in ads for access; employee email addresses in stealer dumps; IP ranges in RDP/VPN listings. According to Have I Been Pwned, only one Expressoit.In combo list is 593 427 119 unique email addresses. Stealer-logs with login pairsassword corporate accounting is the main supply channel for credential harvesting.
