access broker
C2 / SpecialistTechnical / Journalistic (Cybersecurity)
Definition
Meaning
An intermediary who sells or provides unauthorized access to computer systems, networks, or data.
A criminal actor in the cybersecurity ecosystem who specializes in acquiring and reselling illicit access credentials, often obtained through data breaches, malware, or phishing. They operate as a key link between initial intrusion and further exploitation by ransomware groups or data thieves.
Linguistics
Semantic Notes
The term carries exclusively negative, criminal connotations. It refers to a specific role within the cybercrime supply chain, not a legitimate broker of authorized access.
Dialectal Variation
British vs American Usage
Differences
No significant difference in meaning. The term is used identically in cybersecurity contexts globally.
Connotations
Universally associated with cybercrime and illicit markets.
Frequency
Equally low-frequency in general language but standard within cybersecurity reporting in both regions.
Vocabulary
Collocations
Grammar
Valency Patterns
[Access broker] + sold + [access] + to + [target organization][Ransomware group] + purchased + [access] + from + [access broker]Vocabulary
Synonyms
Strong
Neutral
Weak
Vocabulary
Antonyms
Phrases
Idioms & Phrases
- “A broker of backdoors”
- “To play the access broker”
Usage
Context Usage
Business
Used in risk assessment reports: 'The breach originated from credentials sold by an access broker.'
Academic
Used in criminology or computer science papers analyzing cybercrime supply chains.
Everyday
Virtually never used in everyday conversation.
Technical
Standard term in cybersecurity threat intelligence for describing a specific actor type.
Examples
By Part of Speech
noun
British English
- The access broker operated on a hidden forum, listing recently compromised networks.
- Authorities identified the individual acting as the access broker for the attack.
American English
- The FBI dismantled a network that included an access broker selling RDP credentials.
- His role in the scheme was strictly as an access broker; he didn't deploy the ransomware himself.
Examples
By CEFR Level
- In cyber attacks, an access broker is the person who first gets into a system and then sells that access to other criminals.
- The ransomware campaign relied on initial compromises provided by a sophisticated access broker who specialized in healthcare organizations.
- Law enforcement agencies are increasingly targeting access brokers to disrupt the cybercrime ecosystem at its source.
Learning
Memory Aids
Mnemonic
Think of a real estate broker, but instead of selling houses, they sell illegal digital keys to corporate networks.
Conceptual Metaphor
CYBERCRIME IS A MARKET / ILLICIT ACCESS IS A COMMODITY. The access broker is the 'merchant' or 'middleman' in this dark marketplace.
Watch out
Common Pitfalls
Translation Traps (for Russian speakers)
- Avoid literal translation that implies a legitimate broker (брокер). Use a descriptive phrase like 'посредник по продаже несанкционированного доступа' or the loanword 'аксес-брокер' in specialist contexts.
Common Mistakes
- Using it to refer to a legitimate IT administrator or system broker.
- Confusing it with a 'data broker', which is often a legal (if controversial) entity selling aggregated personal data.
Practice
Quiz
What is the primary function of an 'access broker'?
FAQ
Frequently Asked Questions
Not exactly. An access broker is a specialized role. A hacker might breach a system. The access broker then sells that access to others (who may be different hackers or ransomware operators). They are part of the same criminal chain but perform different functions.
No. In modern cybersecurity terminology, it is exclusively pejorative and refers to criminal activity. For legitimate roles, terms like 'identity and access management (IAM) consultant' or 'security broker' are used.
An access broker sells *unauthorized entry* to systems. A data broker is typically a company that legally collects, aggregates, and sells *personal data* (like consumer profiles) for marketing or analytics, though their practices are often criticized.
Yes, it is the most precise and commonly used synonym within the cybersecurity industry, emphasizing their role in providing the 'initial' point of entry for follow-on attacks.