Initial Access Broker (IAB)
A specialist who breaks into organizations and sells the access (VPN, RDP, domain admin) instead of using it. The wholesale layer between opportunistic infection and targeted ransomware.
Why it matters to you
The listing appears days or weeks before the ransomware does. Catching your name in an IAB post is the cheapest incident response you will ever run.
Where we meet it
We index broker listings across the forums where they run, and follow them onto Jabber when a buyer appears. The move from advertisement to escrow is the moment a possibility becomes a schedule.
Connected terms
Access listing
The IAB's ad format: industry, country, revenue, access level and price. Everything except the victim's name, which is disclosed to serious buyers in private.
Garant
A forum-appointed escrow who holds payment until the goods check out. Criminal marketplaces run on reputation systems and dispute arbitration: trust infrastructure for people who trust no one.
DLS / leak site
A ransomware group's "dedicated leak site": victim announcements, countdown timers and proof packs, published to convert embarrassment into payment.
Ransomware-as-a-Service (RaaS)
Ransomware sold as a product: the operator builds the encryptor, the panel and the leak site, affiliates bring the victims, and the ransom splits between them. The reason a small crew can run an enterprise-grade extortion campaign.
Read elsewhere
Where this term stops being vocabulary
Dragnet is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the trade
Access listing
The IAB's ad format: industry, country, revenue, access level and price. Everything except the victim's name, which is disclosed to serious buyers in private.
Bot shop
A marketplace that sells the output of one infected machine as a single unit: its cookies, saved passwords, browser fingerprint and time zone, packaged so a buyer can load the lot into an antidetect browser and resume the victim's sessions.
Carding
The trade in stolen payment card data and the craft of turning it into goods: testing cards, choosing merchants, shipping to reshippers. An economy with its own schools, slang and reputations.
Cashout
The last mile: turning stolen access, cards or balances into money the criminal keeps. Gift cards, crypto, mule accounts, reshipping, each with its own fee and its own specialists.