How Hackers Advertise Corporate Access on Dark Web — and How to Detect It

Introduction

In March 2025, a threat actor using the alias "AccessManager" posted a thread on XSS.is offering domain admin access to a mid-sized healthcare technology firm for $18,000 in Bitcoin. The listing included a one-minute screen recording proving RDP access to the domain controller, a list of 4,000 employee accounts, and a promise to guarantee access for 10 days. Within 48 hours, the access had been purchased and was likely being used to deploy ransomware or exfiltrate patient data. This is the daily reality of the corporate access trading market on the dark web. For security teams, understanding how hackers advertise corporate access on the dark web is not academic curiosity—it is the first step toward detecting and disrupting intrusions before they become breaches. This article, written for CISOs, SOC managers, and threat intelligence analysts, details exactly how initial access brokers (IABs) operate, where they advertise, what signals they leave, and how dark web monitoring can detect these listings before your environment is sold off.

How Initial Access Brokers Advertise Corporate Access

Initial access brokers are the supply chain of cybercrime. They specialize in breaching corporate networks, maintaining persistent access, and then selling that access to the highest bidder—typically ransomware affiliates or data extortion groups. Their listings are detailed, professional, and designed to demonstrate value to buyers. Understanding the structure of these listings is the first capability a defense team needs to acquire.

What Information Do IAB Listings Typically Include?

An IAB listing includes, at minimum, the target organisation's revenue range, industry, geographic region, and the type of access available (VPN, RDP, Citrix, or M365 admin console). High-quality listings add verified screenshots, network IP ranges, number of user accounts, and whether Active Directory is accessible.

• Revenue and industry: Brokers target companies with annual revenue over $100 million as these organisations can afford larger ransoms. Healthcare, finance, energy, legal, and manufacturing are the most heavily advertised verticals.
• Access type and privilege level: RDP access to a domain controller is sold for 3x–5x the price of standard VPN access. Domain admin access is the most expensive category because it enables full lateral movement and deployment of ransomware to every endpoint in the organisation.
• Verification artifacts: Screenshots of the target's login page, a resolved hostname, a directory listing, or a file containing employee email addresses are included as proof of compromise. Some brokers now offer a short screen recording—typically 15–60 seconds—showing active RDP sessions or administrative dashboard views.

Which Dark Web Forums Are the Primary Markets for Corporate Access?

The five most active forums for corporate access trading as of Q1 2025 are Exploit.in, XSS.is, RAMP, BreachForums (operating under various domains after each takedown), and Russian Market. Each forum has dedicated sub-forums or threads for "Access Sales" with strict posting templates that ensure listings are comparable and searchable.

IABs on these forums maintain reputation systems through escrow services, buyer reviews, and verified seller badges. A seller with 10+ completed sales and positive feedback commands higher prices—sometimes double—than a first-time seller offering the same access. This market maturity means that well-established IABs are highly motivated to provide accurate, verified access because their long-term profitability depends on reputation.

The average selling price for domain admin access to a US-based healthcare organisation on XSS.is and Exploit.in ranged between $8,000 and $25,000 in 2024, according to multiple listings tracked by threat intelligence researchers. VPN-only access to the same industry averaged $3,000 to $7,000.

Techniques IABs Use to Gain and Maintain Corporate Access

IABs are not beginners—they are disciplined, repeatable attackers who treat corporate access as a product. They employ a consistent set of techniques, many of which are mapped to MITRE ATT&CK, to gain initial access and then fortify their foothold for later resale.

How Do IABs Initially Breach Corporate Networks?

The most common initial access vector remains credential theft via infostealer malware—commonly referred to as stealer logs—followed by RDP brute-force attacks, vulnerability exploitation in internet-facing systems, and phishing campaigns targeting accounts with administrative privileges.

• Infostealer malware (T1555 Credentials from Password Stores): IABs purchase or freely harvest stealer logs from markets like Russian Market and the now-defunct Genesis Market. A single log containing a corporate VPN username and password, along with the employee's browser session data, provides everything needed to establish a foothold. MITRE ATT&CK technique T1555.003 describes this as "Credentials from Web Browsers."
• Exploitation of internet-facing applications (T1190 Exploit Public-Facing Application): IABs actively scan for vulnerabilities in Citrix netscaler, Fortinet SSL VPN, Microsoft Exchange, and Ivanti appliances. They regularly use CVE-2023-4966 (Citrix Bleed) and CVE-2024-27198 (JetBrains TeamCity) despite patches being available—many organisations fail to patch within the critical window.
• Valid accounts purchased or reused (T1078 Valid Accounts): Some IABs operate retail-style, purchasing previously breached credentials from underground markets and then testing them against corporate VPN gateways or O365 portals. If the credential is still active, the access is packaged and resold within hours.

How Do IABs Maintain Persistent Access Before Selling?

Once inside, IABs establish persistence to ensure the access survives logouts, reboots, and password resets. They deploy backdoors such as remote management tools (RMMs) like AnyDesk or ScreenConnect under disguised process names, create hidden local admin accounts (T1136.001), or install a web shell on an internet-facing server (T1505.003).

The most sophisticated IABs use lightweight Python-based reverse shells that blend into network traffic using HTTPS on non-standard ports. These are often undetectable by standard EDR unless configured to monitor outbound connections to unknown destinations. In many cases, the IAB will hold access for days or weeks before listing it for sale, using this time to map the organisation's Active Directory structure and identify high-value targets.

The SpyCloud Annual Identity Exposure Report 2024 found that over 630 million stealer log records exposed 1.7 billion compromised credentials in a single year, with 89% of those logs containing cookies or session data that bypass MFA protections. A single stealer log can give an IAB everything needed to bypass even hardware-token-based MFA by replaying an active session cookie.

Ransomware Affiliates: The Primary Buyers of Corporate Access

The vast majority of corporate access listings are purchased by ransomware affiliates operating under well-known groups. Understanding which groups buy access from which types of targets helps security teams prioritise their dark web monitoring efforts by focusing on the forums and threat actors most likely to target their industry.

Which Ransomware Groups Rely Most Heavily on IABs?

LockBit, ALPHV/BlackCat, Cl0p, and Play Ransomware have historically been the most active buyers of pre-compromised corporate access. These groups publicly or semi-publicly advertise for IABs to submit access to their dedicated Telegram channels or private forum sections—often specifying exact criteria for the access they will purchase.

• LockBit: Known to pay high prices for RDP access to organisations with over 1,000 employees in critical infrastructure sectors. LockBit affiliates frequently post "Looking for access to manufacturing and energy firms" type messages on XSS.is under burner accounts.
• ALPHV/BlackCat: Favour domain admin access to healthcare and legal firms. Their IAB outreach is sophisticated—they often request access to specific software environments like Epic EHR systems or practice management platforms because they know those environments cause maximum operational disruption if encrypted.
• Cl0p: Focus almost exclusively on MOVEit, GoAnywhere, and other managed file transfer (MFT) access. They do not always buy access—sometimes they exploit zero-day vulnerabilities—but they will purchase verified access to MFT servers if the price is right.
• Play Ransomware: Aggressive buyers of VPN access to mid-sized firms ($50M–$500M revenue). Play is known for double extortion—data exfiltration followed by encryption—and has been linked to IAB listings specifically offering Citrix NetScaler access.

How Do Ransomware Affiliates Evaluate an IAB Listing?

Buyers evaluate listings based on three primary criteria: verified access (screenshots and preferably a live session to confirm), exclusivity (they will typically pay 2x–3x more for exclusive, uncirculated access that no other buyer has seen), and ease of lateral movement (domain admin access is worth 5x–10x more than single-workstation access). A listing for a Fortune 500 energy company with domain admin access can sell for $50,000–$100,000 depending on how quickly the IAB needs to monetise it.

The entire transaction—from initial access to ransomware deployment—can happen in as little as 48 hours from the time of the IAB posting. This is why dark web monitoring catches ransomware before deployment only when it is configured to scan for these specific listing patterns in near-real-time.

The IBM Cost of a Data Breach Report 2024 identified that 60% of all ransomware attacks originated from third-party or partner access—including compromised credentials purchased from IABs. The average cost of a ransomware breach was $4.91 million, rising to $5.34 million in healthcare.

What Signals Can Dark Web Monitoring Detect From IAB Listings?

IAB listings leave specific, detectable signals that dark web monitoring tools—when properly tuned—can capture and alert on before the access is sold. These signals fall into four categories: technical signals, organisational signals, behavioural signals, and contextual signals. Each has a different trigger threshold and severity level.

What Technical Signals Do IAB Listings Contain?

IABs typically include network-level data in their listings to prove legitimacy. This includes IP address ranges, ASN numbers, SSL certificate thumbprints of the target organisation, and sometimes internal hostnames visible in screenshots. A dark web monitoring tool that indexes forum postings and screenshots can alert when one of your public-facing domain names, IP ranges, or SSL fingerprints appears in an IAB listing.

• IP ranges and subnets: An IAB might post "Access to 203.0.113.0/24 – US healthcare – 1,200 employees" as a listing title. If any of those IP addresses belong to your organisation's known infrastructure, that listing is a high-severity alert.
• Hostname patterns: Screenshots showing RDP sessions with hostnames that match your naming convention (e.g., "HOU-DC-01" for Houston domain controller) are extremely specific and actionable.
• SSL certificate subject lines: IABs sometimes include the SSL certificate detail of the target's VPN portal—this is a fingerprint that can be matched to known certificates.
• Employee email addresses: A listing containing an employee email address from your corporate domain is a near-certain indicator of active compromise. Even a single email address in a stealer log that someone posts as proof should trigger an immediate incident response.

How Can Organisational Context Differentiate Real Listings From Hoaxes?

Not all IAB listings are real. Some are scams—actors pretending to have access they never actually attained. But even scam listings provide enough organisational context to be considered suspicious. The key is distinguishing between a listing that simply mentions a large company name (e.g., "Major US bank") and one that contains specific, verifiable details about your internal environment. A real IAB listing will include accuracy on revenue bands (e.g., "$200M–$500M"), number of employees, the technology stack in use (e.g., "Cisco ASA VPN + Citrix + Windows AD"), and sometimes even recent acquisitions or subsidiaries.

This is where real-time dark web monitoring differentiates itself from periodic scanning. A weekly or daily scan will miss a listing that sells within four hours. Real-time monitoring indices new posts on target forums within minutes and applies the organisational context automatically—flagging a listing that mentions "Fortinet VPN + O365 + 3,000 employees" against your organisation's actual technology stack if it matches.

How to Detect IABs Before They Sell Your Access

Detection of IAB activity requires a layered approach combining network telemetry, credential hygiene, and active dark web monitoring. No single layer is sufficient—IABs are too adaptive to be caught by one control. The following framework is what security teams moving toward what dark web monitoring is and how it works should implement.

Step 1: Hunt for Stealer Logs Containing Corporate Credentials

Stealer logs are the raw material of IAB access. Every day, millions of new stealer log entries appear on the open and dark web from malware families such as RedLine, Vidar, Raccoon Stealer, LummaC2, and Aurora. These logs contain system information, browser cookies, saved credentials, and session tokens. If any of your employees—especially IT staff or executives—infects a personal or work device with an infostealer, those credentials will end up in a stealer log within hours. Monitoring for stealer logs containing your corporate domain is the highest-ROI dark web monitoring activity you can perform. The earlier you detect a credential exposure, the faster you can force a password reset before an IAB picks up the log and gains access.

For a deep technical breakdown, read our dedicated guide on stealer logs and the dark web monitoring connection.

Step 2: Monitor IAB Forums for Listings Containing Your Assets

Active monitoring of the five primary IAB forums—Exploit.in, XSS.is, RAMP, BreachForums, and Russian Market—requires automated scraping, analysis of listing titles and descriptions, and OCR of screenshots posted alongside listings. A listing that even vaguely mentions your company name, domain, or IP range must be surfaced and triaged within minutes, not hours. This is what dedicated dark web monitoring platforms do, and it is the reason dark web monitoring detects threats before hackers strike—it catches the moment the IAB posts, not the moment the ransomware deploys.

Step 3: Correlate IAB Listings With Your Internal Telemetry

When a potential IAB listing is surfaced, the next step is to cross-reference the technical signals in the listing against your internal security telemetry. Does the listing mention a VPN gateway you actually run? Does the screenshot show an RDP session to a server you own? Has there been a spike in failed RDP authentication attempts from a specific IP range in the past 48 hours? This correlation step requires a tight integration between your dark web monitoring platform and your SIEM. Many SOCs fail at this stage because they either (a) do not have dark web monitoring at all, (b) have it but do not feed alerts into their SIEM, or (c) receive alerts but cannot correlate them because there is no organisational context in the raw alert.

The Emerging Role of Telegram and Private Channels

While open forums remain the primary marketplace for corporate access, a growing number of IAB transactions are moving to invite-only Telegram channels. These channels are harder to monitor because Telegram does not index public search engines, and many channels require an invite from an existing member. Threat actors use these channels to share access "pre-listings" before they appear on public forums, giving trusted buyers first pick at the highest-value targets.

Monitoring Telegram channels is technically more challenging than monitoring forums. It requires maintaining Telegram accounts that appear to be legitimate threat actors (known as "rabbit accounts"), which requires ongoing operational security to avoid exposure. Some commercial dark web monitoring platforms, including DarkThreat.AI, operate dedicated Telegram monitoring infrastructure that can ingest messages from target channels and surface mentions of target organisations. For a fuller picture of the threat actor ecosystem, refer to our analysis of initial access brokers and dark web monitoring.

How DarkThreat.AI Approaches Corporate Access Detection

DarkThreat.AI ingests data from over 100 dark web forums, 2,500+ Telegram channels, commercial stealer log databases, ransomware leak sites, and paste sites in near-real-time. When a listing appears that matches an organisation a customer is monitoring, DarkThreat.AI applies a multi-layered detection engine: first, it matches against known IP ranges, domain names, SSL certificate fingerprints, and employee email addresses; second, it uses NLP to parse the listing description for any mention of the customer's industry, technology stack, or revenue profile; third, it screenshots and OCRs any images attached to the listing to extract hostnames, IP addresses, or AD structure details embedded in RDP session screenshots or command-line outputs. The resulting alert is enriched with contextual information—the forum or channel it appeared on, the reputation of the seller (based on historical transaction data), and a direct link to the original post. These alerts are fed via API into the customer's SIEM, SOAR, or ticketing system, enabling an automated or analyst-driven investigation within minutes of the listing appearing.

This is not a theoretical capability—DarkThreat.AI has detected active IAB listings for dozens of Fortune 1000 customers before the access was sold, enabling those organisations to rotate credentials, isolate compromised accounts, and conduct forensic analysis to close the gap the IAB was using. The key difference between this approach and generic dark web monitoring is the correlation layer: matching the listing's technical details against your actual infrastructure, not just keyword-matching your company name.

Related Resources

• Dark Web Monitoring Catches Ransomware Before Deployment — How the same IAB monitoring framework that detects corporate access sales directly prevents ransomware incidents by disrupting the attack chain before encryption.
• Stealer Logs and the Dark Web Monitoring Connection — Technical deep-dive into how infostealer malware operates, how logs are collected and sold, and how monitoring for specific credential exposures can detect IAB activity.
• How AI Is Transforming Dark Web Monitoring — Detailed explanation of the NLP and machine learning models used to parse unstructured IAB listings, detect seller reputation fraud, and automate alert prioritisation.
• What Is Credential Leak Detection? — The foundational process that prevents IABs from ever getting the credentials they need by detecting exposures before they can be weaponised.

Conclusion

Hackers advertising corporate access on the dark web has evolved from a niche black-market activity into a structured, professionalised supply chain that enables the majority of ransomware attacks and data extortion incidents. The three most actionable takeaways for security teams are: first, stealer logs are the primary raw material for IABs—monitor for them relentlessly; second, IAB forums leave detectable signals including IP ranges, hostnames, and screenshots that your dark web monitoring platform can catch in real time; third, the differentiation lies in correlation—a generic keyword alert is meaningless unless you can match the listing signal against your own asset inventory and telemetry. The threat landscape is moving toward faster monetisation cycles, with IABs now routinely selling access within 48 hours of posting. Organisations that have implemented continuous, AI-enhanced dark web monitoring with organisational context are the ones catching these listings before the buyer ever gets a chance to encrypt a single server. The alternative is waiting for the ransomware locker to land on your domain controller.

As law enforcement agencies continue to disrupt major forums and ransomware groups rebrand and fragment, the IAB market will only become more fragmented and harder to monitor without dedicated infrastructure. Dark web intelligence—specific, contextual, and real-time—is no longer a luxury for mature security programs; it is the detection layer that stands between your corporate access and an anonymous broker posting it for sale on Exploit.in. The question every CISO should ask today is not whether their credentials have been stolen, but whether they would know before those credentials were sold and weaponised.