A recent Huntress investigation started with what looked like a fairly familiar problem.
An exposed Remote Desktop Protocol (RDP) server had been targeted by a brute-force attack. Attackers were repeatedly attempting to guess passwords and gain access to the system.
At first glance, it looked like the sort of activity security teams see every day.
The investigation soon raised a bigger question.
Was this simply a failed attack, or was someone trying to gain access that could later be sold to another criminal group?
That question shines a light on one of the less well-known parts of modern cyber crime: Initial Access Brokers.
Most business owners have heard of ransomware gangs. Far fewer have heard of the people who help them get through the front door.
The cyber criminals who sell the keys
An Initial Access Broker (IAB) is a cyber criminal who specialises in breaking into organisations and then selling that access to someone else.
They do not necessarily deploy ransomware.
They do not necessarily steal data.
Their job is to find a way in, prove the access works and then sell it to the highest bidder.
According to Check Point Exposure Management’s 2025 Initial Access Brokers Report, these brokers have become an important part of the ransomware economy, helping ransomware groups, data thieves and other threat actors bypass one of the hardest parts of an attack: gaining an initial foothold inside an organisation.
Think of it like a burglary.
One criminal steals a key and quietly sells it.
Another turns up later and empties the building.
Why small businesses should care
Many organisations still assume cyber criminals are only interested in large enterprises.
The evidence suggests otherwise.
Check Point’s research found a growing focus on smaller organisations, with businesses in the $5 million to $50 million revenue bracket accounting for more than 60% of the access listings observed during 2024.
That should sound familiar.
Most schools, care providers, charities and small businesses fall into exactly the type of organisation attackers expect to have fewer security resources than large enterprises.
Attackers are not necessarily looking for the biggest target. They are looking for the easiest route to a profitable outcome.
How do Initial Access Brokers get in?
The methods are often far less dramatic than people imagine.
The Check Point report found that Remote Desktop Protocol (RDP) and VPN access remain among the most common types of access being sold on criminal forums. VPN access more than doubled during 2024.
Common entry points include:
- Weak or reused passwords
- Remote Desktop services exposed to the internet
- VPN appliances with known vulnerabilities
- Missing security patches
- Stolen credentials
- Phishing attacks
- Misconfigured cloud services
Many organisations have at least one of these risks without realising it.
Often the weakness exists because systems have evolved over time rather than through negligence.
An old VPN account remains active.
A contractor account is never removed.
A server is forgotten during a migration project.
An administrator assumes somebody else is responsible for patching a firewall.
Cyber criminals only need one opening.
Access can be surprisingly cheap
One of the more uncomfortable findings from the report is the price.
Most access listings were advertised for less than $3,000, with many listed for less than $1,000.
That means access to a real business can cost less than a new laptop.
For the victim, the consequences can be significantly more expensive.
Downtime.
Lost productivity.
Incident response costs.
Recovery work.
Legal advice.
Insurance complications.
Reputational damage.
The economics work heavily in favour of the attacker.
Why antivirus alone is not enough
Many organisations still think cyber security begins and ends with antivirus.
Unfortunately, Initial Access Brokers demonstrate why that approach falls short.
If an attacker successfully signs in using legitimate credentials, traditional antivirus would see nothing unusual at all.
The criminal is not dropping malware.
They are logging in.
This is why identity security has become so important.
Questions worth asking include:
- Is MFA enabled everywhere it should be?
- Are administrator accounts properly controlled?
- Are old accounts removed promptly?
- Who is monitoring unusual sign-in activity?
- Would anyone notice a suspicious login at 2am?
The answers often reveal more about your security posture than the antivirus product installed on a laptop.
What organisations should do now
You do not need a huge cyber security budget to reduce the risk.
Start with the basics.
Review remote access
If RDP is not required, disable it.
If it is required, ensure it is protected by MFA, restricted by firewall rules and monitored.
Review VPN accounts and remove anyone who no longer needs access.
Patch internet-facing systems quickly
VPNs, firewalls, remote access systems and public-facing applications should be prioritised whenever critical security updates are released.
These are some of the first systems attackers look at.
Strengthen identity security
Enable MFA.
Reduce administrator privileges.
Remove dormant accounts.
Review sign-in logs regularly.
Consider identity threat detection and response tools that look for suspicious behaviour rather than just malware.
Test your backups
Backups matter most on the day you need them.
Test restoration procedures regularly and ensure critical systems can be recovered within an acceptable timeframe.
Invest in monitoring
Many ransomware attacks happen outside normal working hours.
If nobody is watching, attackers can spend days exploring a network before launching an attack.
24/7 monitoring and managed detection services can significantly reduce the time attackers remain undetected.
The Black Swan view
Modern ransomware attacks rarely involve a lone hacker sitting in a dark room.
There is often an entire criminal supply chain behind them.
One group steals credentials.
Another gains access.
Another sells it.
Another deploys ransomware.
Another negotiates payment.
Initial Access Brokers sit near the start of that chain.
The good news is that many of the controls that disrupt them are well understood.
Strong authentication.
Good patch management.
Controlled remote access.
Effective monitoring.
Tested backups.
None of those measures are particularly exciting.
They are, however, the controls that make it much harder for someone to quietly sell the keys to your business.
If you’re unsure whether your remote access, Microsoft 365 environment, endpoint protection or backups would stand up to a modern ransomware attack, Black Swan Cyber Security Solutions can help you identify the gaps before somebody else does.
