Rapid7-Initial-Access-Brokers-Report-2026.md

This Rapid7 report analyzes six months of 2025 forum data (Exploit, XSS, BreachForums, DarkForums, RAMP) and finds a shift toward higher-value, high‑privilege access sales (Domain User/Admin, Local Admin) sold primarily via RDP, VPN, RDWeb and similar vectors; DarkForums and RAMP dominated listings, government, retail and IT were top targets, average alleged victim revenue and listing prices rose markedly, and a critical Oracle E-Business Suite vulnerability (CVE-2025-61882) was observed advertised on RAMP, underscoring active exploitation risk and the need for strengthened remote-access and least-privilege controls.