Follow the Access · 10 — The Access Broker: The Wholesaler of Other People's Networks

Follow the Access — Case 10. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Nine cases have pointed here. The brute-force crew of Case 02 resold its logins to someone; the phish of Case 04 harvested credentials that flowed onward; the infostealer of Case 09 packaged identities that were bought and sold. Each time, the register named a buyer without describing him, because he deserved a case of his own. This is that case. The initial access broker is the specialist who does not break in to do anything — he breaks in, or buys the break-in from someone who did, and then he sells it. He is the wholesaler of other people's networks, the middleman of the entire criminal economy, and understanding him is understanding why cybercrime works the way it does.

The register has made an economic claim from its first case: that access is a commodity, produced by some and consumed by others, with a market between them. The access broker is where that claim stops being an analogy and becomes literal. He runs a business whose only product is access — footholds into organizations, listed and priced and sold like any other good. He does not care what the buyer does with the access he sells; his skill is not intrusion or extortion but market-making: sourcing footholds, verifying they are real, pricing them by the wealth of the victim behind them, and matching each to the buyer who will pay the most. He is a broker in the ordinary commercial sense, and the thing he brokers is the ability to be inside a company that does not know he was ever there.

So the disposition is RESOLD, and for the access broker it is not one possible fate among six — it is the whole of what he is. Every other actor in this register uses access as a means to some crime; the broker uses it as a good to be sold, and nothing else. This is the case about the market at the center of everything, and about how the simple act of selling access, rather than using it, is what turned a craft into an industry.

1. The Position in the Middle

Begin with where the broker sits, because his entire significance is positional — he is defined not by what he does to a victim but by where he stands in the chain between other criminals. Picture the supply chain the register has been assembling. At the top are the producers: the brute-force crews sweeping for weak passwords, the phishers harvesting credentials, the infostealer operators emptying endpoints, the exploit runners firing n-days at unpatched servers. These actors are good at one thing — manufacturing footholds, in bulk, at scale. They are not good at, or interested in, what comes next: the patient hands-on-keyboard work of turning a foothold into a ransom, the negotiation, the laundering. They produce access and have no efficient way to monetize it.

At the bottom are the operators: the ransomware affiliates, the extortionists, the fraudsters. These actors are good at monetization — at taking a foothold and turning it into money through extortion or theft. But they are not good at, or interested in, mass intrusion; every hour a ransomware affiliate spends brute-forcing logins is an hour not spent on the lucrative work of extortion, and the skills are different anyway. The operators want access, specifically access into the kind of target they can profitably extort, and they would rather buy it than make it.

The access broker is the actor who connects these two populations, and in connecting them he lets each specialize. He buys footholds from the producers, or produces them himself, and sells them to the operators. He curates: he verifies that a foothold is real and still works, assesses what kind of target it opens, and prices it accordingly. He is the wholesaler, the distributor, the market-maker — the joint between the people who are good at getting in and the people who are good at cashing in. And that joint is not incidental; it is the thing that makes the whole machine efficient. Without the broker, every ransomware crew would have to run its own intrusion operation and every intrusion crew would have to run its own extortion racket, and both would be worse at their jobs. With the broker, each can do only what it does best, and buy or sell the rest. He is the middle of the economy, and the middle is where the leverage is.

2. Access as a Listed Good

Now make the commodity concrete, because the phrase "access is a commodity" only lands when you see what a listing actually looks like. On the broker markets, a foothold is not a vague offer — it is a product with a specification, described in the terms a buyer needs to make a purchasing decision. A typical listing names the victim's country and industry, its approximate revenue and number of employees, the type of access on offer (VPN, RDP, a web shell, domain credentials), the level of privilege (user, administrator, domain administrator), and often an assessment of the victim's security posture and whether it carries cyber-insurance. It reads, in structure, like a listing in any wholesale catalogue — here is the product, here are its specifications, here is the price.

And the price follows a clear logic: access is priced by the value of the victim behind the door, not by the effort of obtaining it. This is the crucial economic insight of the vector. A foothold into a small, poor firm lists cheaply, because whatever the buyer does with it will yield little. Domain-administrator access into a large, wealthy, poorly-defended enterprise — especially one with cyber-insurance, which signals ability to pay a ransom — commands thousands to tens of thousands of dollars, because the buyer downstream can convert that foothold into a ransom worth hundreds of thousands or millions. The broker is, in effect, pricing the option on a future extortion: what he sells is the right to attempt to monetize a specific victim, and that right is worth a fraction of the monetization it enables. The same foothold, obtained by the same technique, is worth a hundred times more if it opens a rich target than a poor one, because the price tracks the prize, not the labor. Access is valued exactly as a commodity should be — by what the market will pay for what it delivers.

The consequence for the victim is chilling in its impersonality. To be listed on a broker market is to be reduced to a line item: a country, an industry, a revenue figure, a privilege level, a price. The organization is not hated, not targeted for who it is — it is inventory, assessed dispassionately for its ransom potential and sold to whoever bids. Somewhere, a company that believes itself secure, that has had no visible incident, is described in a listing by attributes it would recognize as its own, priced according to how much a stranger estimates it could be extorted for, and sold — before it has any idea it was ever breached. The broker turned the company into a product, and the product changed hands in a market the company will never see.

3. A Real Market, With Real Institutions

Pause on the machinery, because what makes the access trade so effective is not the listings but the institutions around them, and those institutions are startlingly legitimate in form. A market in stolen access could not function on trust alone — a buyer handing over thousands of dollars for a foothold he cannot verify until after payment would be an easy mark for fraud, and a market full of fraud collapses. So the criminal economy built the trust infrastructure that any market needs, and it is recognizably the same infrastructure that legitimate commerce uses.

There are reputation systems: brokers accumulate track records, and a seller with a long history of delivering real, working access as described can charge more and sell faster than an unknown one, exactly as a rated seller does on a legitimate marketplace. There are escrow services: a trusted third party holds the buyer's payment until the access is verified to be real and as described, releasing it to the seller only when the buyer confirms, so that neither side can easily cheat the other. There are administrators who arbitrate disputes: when a buyer claims the access he purchased was dead or misrepresented, a forum authority adjudicates and can penalize a dishonest seller. There are even, in some markets, standardized listing formats and categories. This is not a back alley of one-off deals; it is a structured marketplace with the governance that turns risky individual transactions into reliable commerce.

That institutional maturity is what makes access-as-a-commodity viable, and it is worth dwelling on because it is the deepest reason the vector is so durable. A ransomware affiliate can build a business model around buying access precisely because the market is trustworthy enough that a purchased foothold is very likely real and as described — buying access is a reliable strategy, not a gamble, and a reliable strategy is one people build businesses on. The honeypot beneath these words shows the empirical shadow of this organized economy: its intelligence graph holds over 212,000 relationship edges across the attacker population and identifies 57 distinct campaigns, and the edges — shared operators, shared tooling, coordinated activity — are the observable footprint of an economy organized by specialization and exchange rather than by isolated individuals. You cannot see the broker's forum in the honeypot, but you can see the structure it implies: attackers acting not as lone wolves but as nodes in a web of shared resources and coordinated roles, which is exactly what a functioning criminal market looks like from the outside.

4. RESOLD — The Actor Who Only Sells

Now the disposition, and it is the cleanest in the register, because for the access broker RESOLD is not one outcome among possibilities — it is a definition. Every other actor the register has followed uses access as a means to some further crime: the miner mines, the ransomware affiliate ransoms, the infostealer operator harvests. The access broker does none of these. He is defined precisely by not using what he obtains. His product is the access itself, and his transaction is complete the moment he sells it; what the buyer does afterward is the buyer's business, in which the broker has no part and takes no further interest.

This purity is what makes the broker the register's clearest illustration of access-as-a-commodity. In Case 02, the brute-force crew resold, but resale was a sideline to its real activity of mass credential production — it sold because it could not use everything it made. The broker inverts that: selling is not the sideline but the entire enterprise, and any production he does is in service of having something to sell. He is the actor for whom the foothold is never, at any point, a means to a crime he will commit — it is only ever a good he will sell to someone who will commit one. If you wanted to prove that access has become a true commodity, decoupled from any particular use, the access broker is the proof, because he is the actor who profits from access while committing none of the crimes access enables. He has monetized the door without ever walking through it.

And this is why the disposition RESOLD, applied to the broker, carries a weight the earlier resale cases did not. When the register marks a foothold RESOLD elsewhere, it means the access changed hands on the way to some other fate. When it marks the broker RESOLD, it means resale is the fate — the terminal disposition of the broker's own activity, the thing he exists to accomplish. He is the one actor in the register whose relationship to access begins and ends with the market. Everyone else is trying to do something with the door. The broker is only ever trying to sell it, and in a mature criminal economy, selling the door is a business as good as any crime you could commit with it — better, because it carries less risk and scales without limit.

5. Why the Broker Made Everything Worse

The register owes an accounting of harm, and here it must be structural rather than about any single victim, because the access broker's deepest damage is not what he does to one organization but what he does to the whole economy: he industrialized it. Before specialization, cybercrime was a craft — each crew did everything, from finding a target to breaking in to monetizing, and each was mediocre at most of it because no one can be expert at everything. The access broker broke that constraint by making it possible to buy and sell the middle of the process, and in doing so he let every other actor become a specialist.

Consider what specialization did to productivity. A ransomware crew, freed from having to break in, can pour all its expertise into extortion — better negotiation, better pressure, better laundering — and simply buy the footholds it needs, choosing exactly the kind of victim it is best at monetizing. A foothold producer, freed from having to monetize, can pour all its expertise into intrusion — better scanning, better exploits, better credential harvesting — and simply sell what it makes to the broker. Each stage of the pipeline, run by a specialist who does only that stage, becomes more efficient than a generalist could ever be, exactly as the division of labor makes a factory more productive than a workshop of craftsmen. The access broker is the market that makes the division possible, and the division is what turned cybercrime from a craft practiced by a few skilled crews into an industry with a supply chain, a labor market, and an output measured in the tens of billions.

This is the case's hardest truth, and it is why the broker matters more than his individual transactions suggest. He is not a more dangerous attacker than the ransomware affiliate or the nation-state; he may never personally harm anyone. But he is the enabler whose existence makes all the other attackers more effective, the joint that lets the machine run faster, the market whose liquidity turned a collection of isolated crimes into a functioning economy. Remove any single ransomware crew and another takes its place; remove the ability to buy and sell access, and every crew would have to be good at everything again, and the whole industry would slow. The broker's harm is the harm of infrastructure — diffuse, indirect, and enormous, because he is not a criminal so much as the market in which crime is organized. And a market, once it exists and works, is far harder to kill than any of the actors within it.

6. The counter-narrative, steelmanned

The strongest objection to this case is that the access broker is a description masquerading as a discovery — that "criminals sell access to each other" is obvious, adds nothing to the specific vectors already covered, and dresses up a marketing category as a threat.

The argument runs like this. Every prior case already mentioned that the foothold gets sold; devoting a whole case to "the person who buys it" is redundant, a restatement of the supply chain rather than an analysis of any actual attack. The broker, the objection continues, has no technique of his own — he does not brute-force, phish, or exploit anything; he is a role, an economic abstraction, not a vector, and a register of how systems are breached should study the breaching, not the reselling. Worse, the argument adds, the whole "access is a commodity" framing is the kind of tidy economic metaphor that flatters the analyst more than it helps the defender: knowing that a market exists does not tell a defender how to close a single door. On this view the access-broker case is a lecture in criminal economics wearing the costume of a threat dossier.

The register accepts that the broker has no technique of his own and insists that this is precisely why he needs a case. Yes, every prior case noted that access gets sold — and that recurring note is exactly the evidence that something structural sits behind all of them, deserving to be named and examined rather than mentioned nine times and never explained. The broker is not a redundant restatement of the vectors; he is the reason the vectors compose into an industry instead of remaining a scatter of unrelated crimes. A register that catalogued every door and never described the market that prices and trades what lies behind them would be describing the trees and missing that they form an economy. On the "no technique, not a vector" point: the register follows access from the login prompt to the foothold's fate, and RESOLD is one of the six fates it exists to document — the broker is not a breaching technique but a disposition, and omitting the actor who embodies the RESOLD disposition would leave a hole in the register's own structure. And on the defender objection: understanding the market is directly actionable, as Section 7 shows — it tells the defender that closing the producer doors starves the broker of inventory, that market monitoring can catch access sold about you before it is used, and that you should assume you may already be listed. The economics is not a flourish; it is the map that shows why the individual defenses matter and where the leverage is. The broker earns his case because he is the answer to the question the first nine cases kept raising and never resolved: sold to whom, and why does it matter? To whom: the market. Why it matters: the market is what makes all the rest an industry.

7. Disposition — RESOLD

Case 10 followed the initial access broker — the wholesaler of other people's networks, the specialist who does not use the footholds he obtains but sells them, standing in the middle of the criminal economy between the producers who manufacture access and the operators who monetize it. He is where the register's central claim becomes literal: access is a commodity with a functioning market, and the broker is the market-maker. On his listings a foothold is a product with a specification — the victim's country, industry, revenue, and access privilege — priced by the value of the victim behind the door, and sold through the machinery of a real marketplace with reputation, escrow, and arbitration. CrowdStrike documents the role as central and surging; the honeypot's 212,000-edge entity graph is its empirical shadow, showing attackers organized by shared infrastructure and specialized exchange.

The disposition — the foothold's fate — is RESOLD, and for the broker it is not one outcome but the whole of what he is. He neither mines nor ransoms nor harvests; he sells the access on and takes no further part, the one actor in the register whose relationship to the door begins and ends with the market. He monetized the door without ever walking through it, which makes him the purest proof that access has become a true commodity, decoupled from any particular crime.

His deepest harm is structural: by letting everyone else specialize, he industrialized the whole economy — the joint that turned cybercrime from a craft into an industry, exactly as the division of labor turns a workshop into a factory. He may never harm a single victim himself, and he makes every other attacker more effective, which is why he matters more than his transactions suggest and why he is far harder to kill than any actor within his market. The defense is to starve him: close the producer doors of the earlier cases so he has nothing to sell about you, watch the market for listings that match you, assume you may already be for sale if you have been breached, and enforce the least-privilege posture that makes a purchased foothold reach little. The vectors do not lie: the door was opened by one hand, priced by a second, and sold to a third who would ransom what lay behind it — a company reduced to a line item and traded before it knew it was breached. We do not judge. We record. We let people judge — and then, if they are wise, deny the wholesaler his stock.

Follow the Access continues. Case 10 disposition: RESOLD. Confidence: HIGH — the initial-access-broker role and its sharp growth are documented in CrowdStrike's Global Threat Report; the market structure (listings priced by victim value, reputation, escrow, arbitration) is well-documented in public criminal-forum reporting; and the honeypot's own 212K-edge entity graph and 57-campaign clustering corroborate the specialized, shared-infrastructure organization the market implies. The broker connects directly to the producer cases (02, 04, 09 and the exploit cases) and the operator case (03). The economic analysis of specialization and industrialization is structural reasoning grounded in the documented division of labor. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the market that priced the door, and the company sold across it in the dark.