Darknet Credentials for Sale

Darknet Credentials for Sale

What does IAB stand for?

Initial Access Broker.

What is an Initial Access Broker (IAB)?

An attacker who compromises systems or collects credentials to sell access to others.

What is the primary goal of an IAB?

To obtain access or credentials that can be sold to another attacker.

Where do IABs often sell stolen credentials?

On darknet websites.

How can IAB-supplied credentials be used in credential stuffing?

A buyer tests the stolen credentials against the target organization's services.

Why might stolen credentials sold by IABs be missing from standard threat intelligence feeds?

They may be shared privately with buyers rather than publicly disclosed.

What does CTI stand for?

Cyber Threat Intelligence.

Why can secretly traded credentials remain a long-term risk?

The organization may not know its credentials were stolen or sold.

What are the two broad types of IAB-enabled access discussed in Book 3?

Opportunistic and targeted access.

What is an opportunistic attack involving purchased credentials?

Trying acquired credentials against other accounts or services to see where they work.

What is targeted access involving an IAB?

Buying credentials specifically for a chosen organization or its subsidiaries.

How does opportunistic credential use differ from targeted credential acquisition?

Opportunistic use tests whatever credentials are available; targeted acquisition seeks access to a specific victim.

What kinds of assets might an IAB sell?

Compromised credentials or access to compromised systems.

Why can IAB sales support follow-on intrusions?

They give other attackers an entry point without requiring them to compromise the initial account themselves.

Why is a public breach list not a complete inventory of compromised credentials?

Some credentials are privately traded and never publicly reported.

What payment methods does the course associate with less-visible IAB transactions?

Pseudo-anonymous payment methods, such as cryptocurrency.

What security problem does an IAB create for an organization?

Unrecognized stolen access that another attacker may purchase and exploit.

What is the relationship between credential stuffing and initial access brokers?

IABs may supply the compromised credentials used in credential stuffing attacks.

Can IAB-enabled attacks be either broad or organization-specific?

Yes. They can be opportunistic or directed at a chosen organization.

What should an incident handler remember about darknet credential sales?

Credentials may be compromised and traded without appearing in conventional CTI reporting.