Key takeaway: Specialisation made intrusion cheaper and faster. The gap between breach and impact is where detection has its only realistic opportunity.
Division of Labour
Ransomware operations were once end-to-end: one group found a way in, moved laterally, exfiltrated and deployed the payload. That model has largely been replaced by a market.
Initial access brokers do one thing — obtain a foothold — and sell it. Listings specify the sector, revenue band, country, access type and privilege level. Prices run from a few hundred to tens of thousands of dollars depending on the target’s apparent value.
A ransomware affiliate then buys access matching their preferences and proceeds directly to lateral movement. They never performed reconnaissance and may know nothing about how entry was achieved.
What This Changes Defensively
The most important consequence is a delay. Access is frequently sold days or weeks after it is obtained, and the buyer takes further time to act.
That interval is the defensive window. An organisation that detects the initial foothold — a dormant VPN session, an unused valid credential, a small persistent implant — stops the attack before the destructive phase. One that only detects encryption has no window at all.
| Stage | Typical actor | Detection opportunity |
|---|---|---|
| Credential harvest | Broker | Impossible-travel, new-device sign-in |
| Foothold established | Broker | Anomalous process, new persistence |
| Dormant period | Nobody | Idle valid session, unused access |
| Access sold | Market | None |
| Lateral movement | Affiliate | Credential dumping, admin discovery |
| Exfiltration | Affiliate | Large outbound transfer |
| Encryption | Affiliate | Too late |
How Access Is Typically Obtained
Brokers concentrate on scalable methods rather than bespoke exploitation.
Exposed remote access is the largest single category — RDP and VPN endpoints with weak or reused credentials and no phishing-resistant second factor. Credential stuffing against these gates requires no sophistication and works at population scale.
Unpatched edge devices are the second. VPN concentrators, firewalls and file transfer appliances sit at the perimeter, are reachable from the internet, and frequently lag on patching because they are treated as infrastructure rather than as software. Brokers scan for known vulnerabilities within hours of disclosure.
Information-stealing malware on employee machines supplies the rest, harvesting saved browser credentials and, importantly, session cookies that bypass multi-factor authentication entirely.
Prioritising Accordingly
The exposure surface brokers actually target is narrow, which makes prioritisation straightforward.
Enumerate everything internet-reachable and confirm each has phishing-resistant authentication. Patch edge appliances on a compressed timeline — days rather than the monthly cycle applied to internal systems. Monitor for valid credentials used from unusual locations or devices, since that is the signal a broker’s foothold produces. And treat session token theft as a real threat by binding sessions to device posture where possible.
The Bottom Line
Assume your perimeter breach and your ransomware event are separate acts by separate parties, separated by weeks. Invest detection effort in the foothold and dormancy stages, and prioritise edge device patching and phishing-resistant authentication on internet-facing access above everything else.
