What is access as a service (AaaS)?

We’ve become accustomed to a world where almost everything is a service. We have infrastructure as a service, platforms as a service, software as a service, functions as a service, and so much more. Unfortunately for us, the cybercrime industry has also moved in the direction of hyper-specialization. Illicit hacking organizations now offer access as a service (AaaS), which essentially involves selling direct access to a target organization’s network. We often call these cybercriminals initial access brokers (IABs).

Access as a service differs from more conventional forms of cybercrime. Sometimes a group will perform the entirety of an attack by itself, while at other times hackers penetrate an organization, steal data, and then sell it on the darknet. IABs play a somewhat different role in AaaS. They simply do the first few steps and then sell their access over to customers who can do what they want. The criminal customer can then steal data themselves, penetrate further into the network, sabotage the systems, and more.

If we look at the lifecycle of a sophisticated attack, it generally involves something like the following stages:

1. Initial compromise
2. Establish foothold
3. Escalate privileges
4. Perform internal reconnaissance
5. Move laterally
6. Maintain presence
7. Perform malicious action
8. Cover tracks

An IAB performs some of these steps for other cybercriminals, which saves them time, or augments their skills. In some cases, the IAB will just perform the initial compromise and establish a foothold. In others, they will keep going through the steps, escalating privileges, performing internal reconnaissance, and moving laterally. The more that the IAB does, the more the final service will cost. If they have burrowed deeply into the network of a high-value organization and escalated their privileges, the cost of access will obviously be much higher than low-level access to a Mom and Pop store.