![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1)
![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1)
![Endpoint Protection and Threat Intelligence: The Way Forward [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/GK-Blog_Images-1)
Access brokers have become a key component of the eCrime threat landscape, selling access to threat actors and facilitating myriad criminal activities. Many have established relationships with big game hunting (BGH) ransomware operators and affiliates of prolific ransomware-as-a-Service (RaaS) programs. The CrowdStrike Intelligence team analyzed the multitude of access brokers’ advertisements posted since 2019 and identified trends in targeting preferences, as well as insights into the perceived value of different victims.
Top Targets
Access brokers have advertised organizations from more than 30 different sectors, demonstrating an eclectic range of targets. Among these, the academic, government and technology sectors were the most frequently advertised, accounting for a combined 49% of the total advertisements.
The academic sector has historically been a popular focus of ransomware operations, with intrusions timed to coincide with the start of a new school term to cause the greatest disruption and in turn encourage a quick ransom payment. Almost 40% of the academic sector advertisements were for access to U.S.-based institutions, with a spike in activity noted in August 2021 that coincides with the start of the new semester.
Controversial Targets
The healthcare sector has been a divisive target among eCrime actors during the past two years because of the COVID-19 pandemic. Some adversaries actively avoided operations against frontline services in particular. Access brokers showed varying interest in targeting the sector — it sits in joint fourth place alongside financial services for the total number of identified advertisements, but the timing of the advertisements fluctuated.
What Is Access Worth?
Several factors determine the worth of access, and asking prices vary significantly among sectors, countries and access brokers. Access with elevated privileges typically attracts a higher asking price, as does access to large corporations with higher annual revenues or advertisements by more-established access brokers. Some brokers auction the access, offering a “buy-it-now” price or attempting to encourage a bidding war. 
Organizations based in the U.S., the UK, and Canada on average attracted higher asking prices than other countries, reflecting the demand in targeting these locations. It is worth noting that the advertised price is not necessarily what’s paid, and the majority of access brokers appear open to negotiation. 
Fluctuations in asking prices are also common and often reactive to the market. CrowdStrike reported an increase in asking price among access brokers in April 2021, with some corporate entities attracting five-figure sums, indicating that threat actors likely receive a significant return on their investment. When the same access is being advertised by two different access brokers, variations in the asking price are also observed.
Conclusion
The advertisements provide an interesting snapshot of an increasingly lucrative component of the eCrime ecosystem, where reputation and timing both play important roles. There is almost certainly an opportunistic element to access broker operations, such as the availability of exploitable vulnerabilities or the validity of stolen credentials that facilitate intrusions.
Additional Resources
- Learn more about CrowdStrike Falcon® Intelligence Recon by visiting the product webpage and downloading the data sheet.
- Find out how to stop adversaries targeting your industry — schedule a free 1:1 intel briefing with a CrowdStrike threat intelligence expert today.
- Learn how to monitor access brokers to help prevent breaches by downloading this white paper.
- Learn about the powerful, cloud-native CrowdStrike Falcon®® platform by visiting the product webpage.
- Get a full-featured free trial of CrowdStrike Falcon® Prevent™ to see for yourself how true next-gen AV performs against today’s most sophisticated threats.
