Definition
Ransomware encrypts victim systems and demands payment for decryption keys. Initial Access Brokers (IABs) sell perimeter footholds that ransomware affiliates operationalize.
Key Points
- July 2026: Standardized IAB playbook from citrixbleed-2 → dragonforce in <1 hour (huntress)
- Tools in chain: PsExec, Impacket, Mimikatz, ScreenConnect, Zoho Assist persistence
- MFA bypass via session token theft remains critical NetScaler attack vector