메뉴
Use when the user asks about initial access brokers (IABs), the access-listing market, ransomware-feeding-IAB pipelines, specific broker handles, or how access is priced and packaged. Self-updating knowledge cell.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
Use as the default entry point for any CTI request that doesn't name a specific skill. Activates when a user asks to investigate an indicator, profile a threat actor, write an assessment, enrich IOCs, or build detection rules. Routes to the right investigation or analysis skill, then auto-applies rigor skills (source rating, TLP, confidence, likelihood) on the output.
Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.
Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.
Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
| name | initial-access-brokers |
| description | Use when the user asks about initial access brokers (IABs), the access-listing market, ransomware-feeding-IAB pipelines, specific broker handles, or how access is priced and packaged. Self-updating knowledge cell. |
| user-invocable | true |
| metadata | {"category":"knowledge-cell","created":"2026-04-05T00:00:00.000Z","last_updated":"2026-04-05T00:00:00.000Z","update_count":0,"confidence":"moderate"} |
Initial Access Brokers (IABs) are specialized cybercriminal actors who focus exclusively on gaining unauthorized access to corporate networks and then selling that access to other threat actors — most commonly ransomware affiliates. IABs represent a critical node in the cybercrime supply chain, effectively decoupling the intrusion phase from the monetization phase and enabling a division of labor that increases overall ecosystem efficiency. By purchasing pre-validated network access, ransomware operators and affiliates can skip the time-consuming and technically demanding initial intrusion phase, reducing their time-to-impact from weeks to hours.
The IAB marketplace operates primarily on Russian-language cybercrime forums, with Exploit, XSS, and RAMP being the most active venues. Access listings typically specify the victim's country, industry sector, revenue (a key pricing factor), access type (RDP, VPN, web shell, Active Directory credentials), and level of privilege. Pricing varies dramatically: basic RDP access to a small company might sell for $500-$2,000, while domain admin access to a Fortune 500 company can command $20,000-$50,000 or more. The median price for IAB listings is approximately $1,500-$3,000. Some IABs operate through private channels and maintain exclusive relationships with specific ransomware operations rather than selling on open forums.
The infostealer-to-IAB pipeline has become the dominant supply mechanism for access inventory. IABs systematically purchase or harvest infostealer logs from marketplaces (Russian Market, Telegram channels), filter for corporate VPN credentials (Cisco AnyConnect, Fortinet, Palo Alto GlobalProtect, Pulse Secure/Ivanti), validate access, escalate privileges where possible, and list the access for sale. This pipeline means that an employee's malware infection on a personal device — often via malvertising or a trojanized software download — can directly lead to a ransomware attack on their employer weeks or months later. Separately, IABs exploit vulnerabilities in internet-facing infrastructure (VPN appliances, Citrix, Exchange, firewalls) to harvest access at scale.
| Actor/Handle | Forum Presence | Notable Characteristics | Status |
|---|---|---|---|
| Zebra2104 | Multiple forums | Prolific broker; sold access used by multiple ransomware groups | Active (intermittent) |
| Sang_real (Frapochka) | Exploit, XSS | High-volume listings across sectors; established reputation | Active |
| JETKITTEN | Exploit | Targets education and healthcare | Active |
| Roblette | Exploit, XSS | Specializes in European targets | Active |
| montns | RAMP, Exploit | Significant listing volume; medium-enterprise focus | Active |
| Bostaurus | Exploit | Specializes in access via VPN exploitation | Active |
| Various Telegram-based brokers | Telegram channels | Lower-tier access; often direct from infostealer operators | Active |
| Multiple unattributed IABs | Private channels | Operate exclusively through private deals with ransomware groups | Unknown |
Note: IAB handles change frequently. Actors rebrand, retire, and new actors enter the market regularly. The above represents observed active handles but is not exhaustive.
The volume of corporate credentials available via infostealer logs has grown substantially, driven by the proliferation of Lumma, StealC, and other stealer families. IABs have industrialized the process of filtering corporate VPN/SSO credentials from bulk log purchases, validating access, and listing it for sale. Some have developed automated tools to test credentials at scale across VPN endpoints. The time from employee infostealer infection to corporate access listing has compressed, with some operations completing the cycle within days. KELA and Flare research indicates IAB listings have grown year-over-year, with several hundred active listings at any given time.
IABs increasingly exploit critical vulnerabilities in edge devices to build access inventory at scale. Exploited products in 2023-2025 include Citrix NetScaler/ADC (CVE-2023-4966 "Citrix Bleed"), Fortinet FortiOS (multiple CVEs), Ivanti Connect Secure (CVE-2024-21887/CVE-2023-46805), Cisco ASA/FTD, ConnectWise ScreenConnect (CVE-2024-1709), and Palo Alto PAN-OS (CVE-2024-3400). Actors exploit these vulnerabilities to deploy webshells or create accounts across hundreds of organizations, then sell individual accesses as listings. This approach provides inventory at near-zero marginal cost per victim.
Evidence from ransomware chat leaks (Conti leaks 2022, Black Basta chat leak early 2025) confirms that ransomware operations maintain regular purchasing relationships with IABs, sometimes with standing arrangements for specific types of access (particular sectors, revenue thresholds, geographic regions). Some ransomware programs have dedicated budget lines for access purchases. Premium ransomware affiliates may negotiate exclusive first-look arrangements with top-tier IABs.
| Date | Event | Impact |
|---|---|---|
| 2019-2020 | IAB market formalization | Dedicated access trading sections established on major forums (Exploit, XSS) |
| 2020 | RDP access sales surge during COVID | Remote work expansion massively increased available RDP/VPN attack surface |
| Feb 2022 | Conti leaks expose IAB purchases | Internal chat logs showed Conti's systematic purchase of access from IABs |
| 2022-2023 | RAMP forum gains prominence | Became significant IAB marketplace after its launch, attracting new sellers |
| Late 2023 | Citrix Bleed mass exploitation | CVE-2023-4966 exploited at scale; access to affected orgs appeared on forums within weeks |
| Jan 2024 | Ivanti Connect Secure mass exploitation | Multiple zero-days in VPN appliance exploited for broad access harvesting |
| Early 2025 | Black Basta chat leaks | Confirmed IAB purchasing patterns and pricing for major ransomware operation |
| 2024-2025 | IAB listing volumes increase | Research from KELA, Flashpoint, and Group-IB shows sustained growth in access listings |
Access Acquisition Methods:
Access Types Sold:
Pricing Factors: Access pricing correlates with: victim revenue (strongest factor), access type and privilege level, country (US/EU commands premium), sector (finance/insurance/healthcare premium), network size, and whether security tools were observed. Forum reputation and seller track record also affect willingness to pay. Auction formats are sometimes used for high-value access.
Operational Security: Established IABs use forum escrow services to protect both parties. Listings avoid naming victims directly, instead providing country, sector, revenue, number of hosts, and access type. Some use "check" services where potential buyers can verify the access is still valid before completing purchase. Communication for sensitive details moves to encrypted messengers (Tox, Jabber/XMPP).
Forum Marketplace Structure: Major forums (Exploit, XSS, RAMP) have dedicated sections for access trading with established rules, escrow services, and reputation systems. Sellers build reputations through consistent delivery and positive buyer reviews. Some forums require initial deposits or vetting to participate. Listings follow semi-standardized formats specifying access parameters.
Supply Chain Position: IABs sit at the critical junction between initial compromise and monetization. Their upstream suppliers include: infostealer operators (providing raw credential logs), vulnerability researchers (providing exploits), and botnet operators (providing infected machine access). Their downstream customers include: ransomware affiliates (primary buyers), corporate espionage operators, data theft groups, and occasionally state-sponsored actors using criminal infrastructure.
Seasonal and Event-Driven Patterns: Access listings spike following major vulnerability disclosures in edge devices, as IABs race to exploit and list access before victims patch. Listing volumes also correlate with infostealer campaign waves. New ransomware programs entering the market can create demand spikes as affiliates stock up on access.
Quality Assurance: Sophisticated IABs provide "freshness" guarantees — confirming that access is validated within a recent timeframe. Some offer brief replacement guarantees if access becomes invalid shortly after sale. The most professional operations provide detailed information about the victim environment (domain structure, security tools observed, number of hosts) to help buyers assess the opportunity.
Pricing Benchmarks (approximate, based on public research):
| Access Type | Typical Price Range | Notes |
|---|---|---|
| Basic RDP (single host, SMB) | $500-$2,000 | Most commoditized |
| VPN credentials (enterprise) | $1,000-$5,000 | Varies by company size |
| Domain Admin access | $5,000-$30,000 | Premium; ready for deployment |
| Citrix/RDS Gateway | $2,000-$10,000 | Broader network reach |
| MSP/RMM access | $5,000-$50,000+ | Multiplier effect on downstream clients |
| Fortune 500 / high revenue | $10,000-$50,000+ | Revenue-dependent premium |
| Web shell (large org) | $1,000-$5,000 | Requires further escalation |
| Cloud admin (M365/AWS) | $1,000-$10,000 | Emerging category |
| Tool | Category | Usage |
|---|---|---|
| Russian Market / 2easy | Log Sourcing | Purchasing infostealer logs to extract corporate credentials |
| Shodan/Censys | Reconnaissance | Identifying internet-exposed VPN/RDP/Citrix infrastructure |
| Exploit frameworks (Metasploit, custom) | Exploitation | Exploiting vulnerabilities in edge devices |
| Credential testing tools | Validation | Automated testing of harvested credentials against VPN endpoints |
| Brute-force tools (Hydra, custom) | Access | RDP/SSH brute-forcing (declining but still used) |
| Forum escrow services | Transaction | Protected payment for access trades |
| Tox/Jabber/XMPP | Communication | Encrypted messaging for transaction details |
| Cobalt Strike/Sliver | Post-Exploitation | Used by some IABs for privilege escalation before sale |
| BloodHound | AD Enumeration | Mapping Active Directory to assess access value |
| Cryptocurrency (BTC, XMR) | Payment | Primary payment methods for access purchases |
| Date | Change | Source |
|---|---|---|
| 2026-04-05 | Initial creation with baseline intelligence through early 2025 | Training knowledge |
