Initial access broker

A criminal who breaks into organizations, verifies that the access works, and sells it, for example VPN credentials, remote desktop logins or web shells, to ransomware groups and other buyers. The access usually comes from stolen credentials or unpatched internet-facing systems, so prompt patching and alerts on unusual logins can close the door before the access is resold.

Further reading: www.ncsc.gov.uk

All terms