Initial Access Brokers on Telegram: How Your Network Gets Priced and Sold
By ScruteX Team Published
Before a ransomware gang encrypts your servers, someone else already broke in and sold the access. That someone is an initial access broker. In 2026, most of them work on Telegram.
This post explains how the IAB market operates today, what your network is worth on a Telegram channel, who buys it, and how to find out when you are the product.
What is an initial access broker?
An initial access broker (IAB) is a cybercriminal who breaks into corporate networks and resells that access to other attackers. The IAB does not deploy ransomware. They do not steal data themselves. They specialise in the first stage of an intrusion, valid credentials, an exposed RDP, a working VPN session, and sell what comes next to whoever pays.
The model has existed since around 2017, but the volume changed sharply after 2022. Three shifts pushed it into the mainstream:
- Ransomware groups stopped running their own intrusions and started outsourcing access to specialists.
- Russian-speaking forums like Exploit and XSS became riskier to use after law enforcement disruptions in 2022 and 2023.
- Telegram emerged as the replacement venue, faster to use, harder to seize, and trusted by both sides of the trade.
By Q1 2026, threat researchers at Group-IB, KELA, and Flashpoint have all reported that over half of new IAB listings now appear first on Telegram channels before reaching closed forums. That shift is what makes this problem something a security team can monitor in real time, if they know where to look.
Why IABs moved from forums to Telegram
The old IAB ecosystem ran on closed Russian-language forums. Registration needed a vouching member, payment in cryptocurrency, and a reputation history. That worked, but it was slow and gated.
Telegram removed every one of those frictions:
- Channels and supergroups host thousands of subscribers without registration vetting.
- Voice notes, video, and screenshots all sit inside one product.
- Bots automate listing posts, price filters, and escrow payments.
- Telegram's hosting sits outside reach of most takedown requests.
- Moderation is light, and channel shutdowns are slow.
When RaidForums was seized in 2022 and BreachForums followed in 2023, the community needed a new home. Instead of standing up another centralised forum, the diaspora went to Telegram. That migration is now the default.
The result: a working corporate VPN credential can be listed within minutes of being stolen, priced by a bot, and sold to a ransomware affiliate the same day.
How your network gets priced: the IAB pricing model in 2026
IAB pricing is not random. It follows a model that any sales team would recognise. Brokers tier listings by access type, revenue band, sector, geography, and security posture. The buyer wants to know two things: how much money can I extract, and how much friction will I hit.
Typical 2026 listing parameters include:
- Annual revenue (often pulled from ZoomInfo or LinkedIn estimates)
- Country and sector
- Number of employees
- Type of access (VPN, RDP, Citrix, ConnectWise, AnyDesk, valid AD admin)
- Endpoint protection vendor (a Defender-only target costs more than one with EDR)
- Domain admin or local admin level
Based on threat reports published through 2025 and early 2026, public price bands look roughly like this:
- Small business, generic VPN access, no admin: $500 to $2,000
- Mid-market, VPN with local admin, US or EU: $3,000 to $10,000
- Enterprise, domain admin or RMM tool access: $20,000 to $80,000
- High-value targets with active exfiltration channels: above $100,000
These numbers come from KELA's annual ransomware ecosystem report, Group-IB's High-Tech Crime Trends, and Flashpoint's IAB tracking. Treat them as bands, not quotes. The market moves with supply.
One pattern matters more than the price: the time between listing and ransomware deployment has compressed. In 2022, the average lag was around 60 days. In 2025-2026, threat reports place it closer to 30 days, with several documented cases under 7 days. That window is your detection budget.
The 48-hour window: why speed matters more than coverage
Scrutex tracks something the team calls the 48-hour window. The data is consistent across our monitoring: when a credential or access listing surfaces on Telegram, the first 48 hours determine whether it gets bought, weaponised, and used inside the victim's environment. Listings that go unnoticed past day two almost always lead to a follow-on incident within the month.
This is the operational reality of IAB monitoring in 2026. Coverage of every channel is meaningless if your alert reaches the SOC three days after the post went live. Freshness beats breadth.
What attackers actually sell: the access types you should care about
Not all IAB listings are equal. Some access types map directly to high-impact compromise paths. These are the categories you should configure monitoring around first.
VPN credentials. The most common listing. Often harvested through infostealers like Lumma, Vidar, RedLine, and StealC, which dump browser-saved passwords from infected endpoints. A single infected contractor laptop can produce a corporate VPN listing within hours. Maps to MITRE ATT&CK T1078 (Valid Accounts) and T1133 (External Remote Services).
RDP and Citrix sessions. Older but still active. Brokers scan large IP ranges, brute force weak passwords, and sell working sessions. Maps to T1021.001 (Remote Desktop Protocol).
Active Directory admin. Premium tier. Domain admin or enterprise admin credentials remove most of the work for the buyer. Often the result of a Kerberoasting or NTLM relay attack inside the IAB's own dwell time, then sold on rather than escalated.
RMM tool access. ConnectWise, Kaseya, NinjaOne, Atera. Highly prized because the buyer inherits push-deployment capability across every managed endpoint. The Kaseya VSA incident in 2021 is the public example of why this access type commands premium prices.
Cloud admin (Azure AD, Okta, AWS). A growing category in 2025-2026. Infostealer logs frequently include session cookies for Microsoft 365 and Okta, which bypass MFA when used quickly. Maps to T1539 (Steal Web Session Cookie).
If your monitoring strategy treats all listings as equal, you will drown in noise. Treat these five categories as your priority alert tiers.
Who buys IAB listings? The ransomware affiliate pipeline
The buyer side is consolidated. In 2026, IAB listings flow primarily into a handful of ransomware affiliate programmes:
- RansomHub (currently the highest-volume affiliate programme by leak site posts)
- Akira
- Play
- Qilin
- BlackSuit (the Royal successor)
- Medusa
These groups recruit affiliates who specialise in the post-access phase: privilege escalation, lateral movement, exfiltration, encryption. The affiliate buys access from an IAB, splits the eventual ransom payment with the gang (typical splits in 2026 sit at 80/20 in favour of the affiliate), and the gang provides the locker, the negotiation infrastructure, and the leak site.
This is why IAB monitoring matters even if your concern is ransomware. The IAB listing is the first observable signal that ransomware activity is being planned against your environment. By the time the encryption runs, the buyer has had 30 days inside the network.
Recent IAB-linked breaches you have probably heard of
Several high-profile breaches in 2024-2025 traced back to IAB-supplied access. Two examples worth knowing:
- MGM Resorts (September 2023). Initial access was obtained through social engineering of the IT help desk by Scattered Spider, but downstream affiliates working with the ALPHV/BlackCat programme bought into the operation. The model of access broker plus ransomware affiliate played out almost exactly as the IAB market predicts.
- Change Healthcare (February 2024). Public reporting from UnitedHealth Group confirmed initial intrusion through compromised credentials on a Citrix portal without MFA. The pattern matches a typical IAB listing for healthcare sector Citrix access.
Both cases reflect the same structure: a credential or access surface that was almost certainly observable in IAB channels before the attack escalated.
How to detect when your network is on sale
Most security teams cannot manually monitor Telegram. The channels are numerous, multi-lingual, partially private, and use coded language. But the detection problem itself is tractable if you do four things consistently.
One. Monitor for your organisation's identifiers. Domain names, IP ranges, executive names, brand mentions, ASN, parent company aliases. IABs name the victim in the listing more often than people assume, sometimes openly, sometimes by initials, sometimes by sector plus revenue band.
Two. Track infostealer logs. Most IAB listings start as infostealer dumps. If your domain appears in an infostealer log on a public or private market, that is your earliest signal, often days before a curated IAB listing emerges.
Three. Cover the Telegram channels that matter. The list shifts. Channels rotate, get banned, return under new names. You need a feed that tracks the rotation, not a static list of links.
Four. Reduce the time from listing to alert. This is where most internal monitoring fails. Catching a listing on day 5 is closer to incident response than to prevention.
These four steps are the operational core of dark web and Telegram monitoring done well.
How Scrutex helps
Scrutex was built around the exact problem this post describes: external visibility into where your assets get exposed, leaked, listed, or sold, before the attack lands.
For the IAB and Telegram problem specifically, four parts of the platform apply directly.
Underground visibility across five sources. Scrutex monitors infostealer markets, IAB channels, ransomware leak sites, paste sites, and closed forums in one feed. The point is not to brag about coverage. It is to remove the gap where a listing surfaces on Telegram first but your team only sees it after it reaches a leak site.
Telegram emergence tracking. Channels rotate constantly. Scrutex tracks new channel formation, rebrands, and affiliate recruitment posts so the monitoring stays current without manual upkeep.
Linguistic intelligence. Most IAB listings appear in Russian, Ukrainian, or coded English. Scrutex parses listings across languages and surfaces them in English with the original preserved for evidence.
The 48-hour window built into alerting. Alerts are tuned to the operational reality that the first two days matter. Critical listings tied to your organisation route through a faster path than general dark web mentions.
The goal is not more data. It is a shorter distance between a listing appearing on a Telegram channel and your SOC reading the alert.
Key takeaways
- Initial access brokers are the suppliers behind most ransomware operations in 2026, and most of them now work on Telegram.
- IAB listings are priced by sector, revenue, access type, and endpoint posture. Bands run from $500 to over $100,000.
- The time between listing and ransomware deployment has compressed to roughly 30 days, with several cases under a week.
- The 48-hour window after a listing goes live is the operational detection budget. Day-three alerts rarely prevent the incident.
- Effective detection means tracking your organisation's identifiers, infostealer logs, the rotating set of Telegram channels, and time-to-alert performance.
Frequently Asked Questions
What is an initial access broker in cybersecurity?
An initial access broker is a cybercriminal who breaks into corporate networks and sells that access to other attackers, usually ransomware affiliates. They do not deploy malware themselves. They specialise in the first stage of an intrusion.
Where do initial access brokers sell network access in 2026?
Mostly on Telegram channels, often with a presence on closed Russian-language forums such as XSS and Exploit. Telegram has become the primary venue since 2023 due to its speed, low friction, and resistance to takedowns.
How much does an initial access broker charge for corporate access?
Prices in 2026 range from around $500 for small business VPN access to over $100,000 for domain admin or RMM tool access in high-revenue targets. Pricing reflects access type, revenue band, sector, and security posture.
How long after an IAB listing does ransomware get deployed?
Average lag is around 30 days as of 2025-2026, down from 60 days in earlier years. Several documented cases show ransomware deployment within 7 days of the original listing.
How can a security team detect IAB listings of their organisation?
Through dark web and Telegram monitoring focused on organisation identifiers, infostealer log feeds, ransomware affiliate channel coverage, and short alert latency. Manual monitoring is rarely viable at the scale and language coverage required.