The cybercrime ecosystem has matured. We no longer see lone attackers handling the entire intrusion lifecycle, from the initial phishing email to data encryption. In 2026, the malicious supply chain is dominated by a key figure: the Initial Access Broker (IAB).
The IAB Economy
Initial Access Brokers are specialists in compromising corporate networks. Their goal is not to steal or encrypt data, but to gain a persistent foothold (such as VPN credentials, RDP access, or web shells) and sell it to the highest bidder on underground dark web forums.
Our recent research across more than 50 emerging forums shows that initial access prices vary wildly, from a few hundred dollars to tens of thousands, depending on factors such as:
- Privileges: Whether the access includes Domain Admin rights.
- Victim Revenue: Companies with revenues exceeding $500 million are premium targets.
- Sector: Financial, healthcare, and industrial entities command the highest prices.
How they operate on forums
In the dark web forums we continuously monitor, IAB offerings follow a standardized format. They don't reveal the exact name of the victim to prevent other actors from "burning" the access or Threat Intelligence teams from alerting the organization.
"Selling RDP access to a manufacturing company in Spain. Revenue: $100M+. Privileges: Local Admin. Antivirus disabled. Price: $2,000 in BTC."
Collaboration with Ransomware groups
The Ransomware-as-a-Service (RaaS) model is the main customer of IABs. Ransomware affiliates buy these accesses to skip the weeks of work required to breach the perimeter. Once inside, they move laterally, exfiltrate data, and deploy the cryptographic payload.
We've observed a growing trend: top-tier ransomware groups sponsoring IABs on exclusive forums, guaranteeing them recurring purchases in exchange for exclusive access to high-value networks.
The importance of early detection
When an IAB posts an offer, there is a critical time window (often between 24 and 72 hours) before a ransomware affiliate buys the access and launches a devastating attack.
This is where proactive monitoring changes the game. Our Dark Web Monitoring module continuously analyzes these communications and extracts metadata. By cross-referencing indicators (such as sector, region, and revenue) with our clients' profiles, and correlating it with compromised credentials or recent stealer logs, Notmining can identify if an organization is being auctioned off and provide actionable intelligence to close the breach before the final intrusion.