TechKnowSurge

VideoSecurityFree

Brokers

Access brokers are cybercriminals who buy, sell, and trade stolen credentials, system access, vulnerabilities, and malware on dark web marketplaces, making large-scale cyberattacks faster and easier to carry out. Understanding how these brokers operate is essential for recognizing the infrastructure behind modern cyber threats.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Brokerage is a legitimate and common practice across many industries, where intermediaries connect buyers and sellers to streamline transactions. Cybercriminals have adopted this same structure, creating an underground economy in which stolen data, system access, and malicious tools are bought and sold through dark web marketplaces. These criminal brokers do not necessarily carry out attacks themselves — instead, they serve as middlemen who profit from facilitating transactions between different threat actors. Access brokers represent one of the most significant categories in this ecosystem. When a threat actor compromises a network and harvests credentials or session tokens, that access is often sold to a broker rather than exploited directly. Other criminals then purchase that access to conduct further attacks, such as ransomware deployment or data exfiltration. Beyond access and identity data — which includes credentials, social security numbers, and personally identifiable information — brokers also traffic in vulnerability information and exploit code, allowing buyers to target unpatched systems before defenders have a chance to respond. The dark web serves as the primary infrastructure for these transactions, hosting marketplaces and forums where brokers advertise their inventories and conduct sales with relative anonymity. This brokerage model has made cybercrime significantly more scalable by enabling specialization: attackers can focus on what they do best and outsource the rest. Recognizing how this economy functions is a foundational element of understanding the modern threat landscape and the organized, business-like nature of contemporary cybercriminal operations.

What you'll learn

Explain the role of access brokers in cybercrime, including how they facilitate the buying, selling, and trading of stolen credentials, vulnerabilities, and malware on the dark web
Distinguish between types of cyber brokers, including access and identity brokers, vulnerability brokers, and exploit or malware brokers

What's covered

Cyber Crime Brokers

What Is a Broker
- Buys and Sells Assets
- Legal Broker Example
  - Insurance Broker
- Criminal Broker Role
Access Brokers
- Buy and Sell System Access
- Usernames and Passwords
- Brokering the Deal
  - Hacker Sells to Broker
  - Adversary Buys Access
Types of Brokers
- Access and Identity Brokers
  - SSNs and Personal Info
- Vulnerability Brokers
  - Sell Until System Patched
- Exploits and Malware Brokers
The Dark Web
- Where Brokers Operate
- Hosts Illegal Activities

Key terms

Threat Actor: An individual or group responsible for a security incident or attack.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Exploit: A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.
Zero-Day: A vulnerability that is unknown to the vendor and has no available patch at the time of exploitation.
Access Broker: A cybercriminal intermediary who buys, sells, and trades unauthorized access to systems, including stolen credentials and login information.
Dark Web: A part of the internet not indexed by standard search engines, commonly used for anonymous and often illegal activities such as trading stolen credentials, exploits, and malware.
Identity Broker: A cybercriminal intermediary who buys, sells, and trades stolen personal identifying information such as social security numbers, names, and dates of birth.
Vulnerability Broker: A cybercriminal intermediary who buys and resells discovered vulnerabilities to other threat actors for exploitation before a patch is available.

Topics

Access Brokers Dark Web Marketplaces Stolen Credentials Vulnerability Brokers Exploit Markets Cybercrime Threat Intelligence

Transcript

One of the things that's made cyber crime so much more scalable is brokers. Brokers are not necessarily a bad thing. We see this out in the real world all the time, where brokers will buy, sell, and trade different items. But there is a criminal version of this as well. There are brokers out there that will buy, sell, and trade things like IDs, or they'll buy, sell, and trade viruses. They'll buy, sell, and trade different things on the dark web and cause problems for the rest of us.

What a broker is

The term broker in itself is not anything bad. A broker is just a person who buys and sells goods or assets for others. For instance, I have an insurance broker. The insurance broker that I use has access to a lot of different companies. So I just tell my insurance broker what I want. I tell him, "I want some car insurance," and he goes and shops for me and finds the best deal out of all of the different brokers that are available. Then he will let me know which one's the best available, and that's what he'll sell me. So it's a great deal for me, because I get access to a lot of different companies through one person.

But not all brokers are doing this legally. There are some cyber criminals who are acting as brokers.

Access brokers

An access broker is going to buy, sell, and trade access to systems. So what does that look like? Let's say we have an individual here, and he goes and hacks a database and finds a bunch of usernames and passwords. What this adversary is going to do is sell it to an access broker. So now this access broker has a bunch of usernames and passwords to a system, and an adversary who wants to break into that system will go to the access broker and purchase one or many of these accesses into that system.

So this person is what's called brokering the deal. The broker brokers the deal between the first adversary, who has exploited and found the usernames and passwords and then delivered them to the broker, and the adversary who's going to eventually carry out the attack.

Types of brokers

Here are some different types of brokers that are out there:

Access and identity brokers. Access would be like usernames and passwords; identity maybe like social security numbers, and people's names and dates of birth.
Vulnerability brokers. When somebody finds a vulnerability that can be exploited, they'll sell it to a broker, who will then resell it, and they will get money until that system is patched.
Exploits and malware. This is like software that's used to carry out an attack.

So how does an adversary find a broker out there to buy, sell, and trade from? One way is through the dark web. The dark web is the part of the internet that carries out criminal behavior. It's the conglomeration of all of these sites that are carrying out activities that are illegal, and that's what we call the dark web.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →