Cybercrime is a supply chain, not a scene
To understand modern cybercrime economics, stop picturing a lone attacker and start picturing a logistics network. The stolen credentials market is a supply chain with specialized roles, negotiated pricing, quality tiers, volume discounts, and customer support. Credentials are the raw material that flows through that chain, and like any commodity market, behavior is driven by price signals, substitution, and margin compression at the edges.
Below: the supply chain, the pricing tiers that actually exist on the underground today, the migration from forum posts to Telegram to automated credential marketplaces, and why exposure checks are the early-warning system defenders cannot skip.
The cybercrime supply chain
A single compromised credential may change hands four or five times before it is used in an attack. Each hop adds markup and specialization.
Tier 1: Infostealer operators
At the top of the funnel are the operators of stealer malware families like RedLine, Lumma, Vidar, Raccoon, and more recently StealC and Meduza. They rent their malware as a service to affiliates for flat monthly fees, typically 150 to 1,000 US dollars depending on the family and feature set. The operators do not distribute the malware themselves. They collect subscription revenue and maintain the command-and-control infrastructure. The logs those families produce are the same records a stealer-log lookup is built to search.
Tier 2: Affiliates and distribution
Affiliates run the actual campaigns. Cracked software, malvertising via Google Ads, YouTube tutorial comments, fake installers, and increasingly sophisticated SEO poisoning all funnel victims to payloads. An affiliate operating at scale can generate tens of thousands of stealer logs per month. Each log is a bundle of the victim's browser passwords, cookies, autofill data, crypto wallets, and system fingerprint.
Tier 3: Log aggregators and cloud sellers
Affiliates rarely sell individual logs. They sell in bulk to log aggregators, who clean, deduplicate, and tag the data before listing it. This is the layer where marketplaces live. A log aggregator may process millions of logs a month and sell access to filtered slices of the data through subscription services, often called cloud of logs, where a buyer pays a weekly or monthly fee for access to a searchable portal.
Tier 4: Initial access brokers
Sitting above raw logs is the initial access broker, or IAB. An IAB takes a promising credential, typically corporate VPN, RDP, or SSO access, validates it, enriches it with organizational context like revenue, headcount, and industry, and sells it as a packaged access listing. A log that might sell for 10 dollars raw can become a 5,000 dollar access listing once an IAB has verified it leads inside a Fortune 1000 network.
Tier 5: Final attackers
Ransomware affiliates, business email compromise crews, and financial fraud groups are the ultimate buyers. They do not want to spend weeks harvesting credentials. They want verified access at a known price, delivered on demand. RaaS operators like LockBit, Akira, and Play have historically sourced a meaningful share of their initial access from the IAB market, not from their own intrusions.
Underground forum pricing
Pricing in the stolen credentials market varies by freshness, geography, target sector, and verification status. Based on observed listings across Russian Market, 2easy, BidenCash, and various forum and Telegram sources, the pricing tiers look roughly like this.
- Generic retail consumer credentials: 0.50 to 3 US dollars per log in bulk
- Retail banking access with verified balance: 5 to 50 US dollars per account
- Streaming, gaming, and SaaS account logins: 1 to 15 US dollars
- Corporate email access (small business): 20 to 200 US dollars
- Enterprise VPN or RDP access: 500 to 5,000 US dollars depending on company size
- Initial access to a Fortune 500 network: 10,000 US dollars and up, frequently auctioned
A few patterns stand out. Raw consumer credentials have collapsed in price due to oversupply from stealer logs. Corporate access has appreciated, because RaaS affiliates compete for quality targets and are willing to pay a premium. Cookies with active sessions are priced above credentials alone, because they bypass MFA in a way passwords cannot.
The platform migration
Where credentials are sold has shifted meaningfully over the past five years. Each generation of platform optimized a different part of the buyer experience.
Generation one: Forums
Classic Russian-language forums like Exploit and XSS were the original venue. Deals were negotiated in threads, escrow was mediated by forum administrators, and reputation was tied to post history. Forums still matter for high-value access listings, but they are slow and illiquid.
Generation two: Telegram channels
Telegram became the default logistics layer around 2019 to 2021. Channels with tens of thousands of subscribers advertise daily drops of logs, with pricing in stablecoins and delivery through bot interfaces. Telegram solved the speed problem forums had but introduced its own moderation and takedown risks.
Generation three: Automated marketplaces
The most consequential shift was the move to fully automated credential marketplaces. Genesis Market was the landmark example. Until Operation Cookie Monster dismantled it in April 2023, Genesis offered browser fingerprint bundles with session cookies for sale through a slick web interface, letting buyers impersonate victims down to the user agent and timezone. At seizure it contained over 80 million credentials and 2 million unique bots.
Russian Market filled much of the void, and 2easy operates a similar model with a focus on stealer log filtering. BidenCash has taken a different approach, using periodic free credential dumps as a marketing strategy to drive buyers to its paid inventory. The common thread is automation. Buyers self-serve, search, filter, and purchase without ever talking to a seller.
What the Genesis Market takedown actually changed
The Genesis Market takedown was a meaningful law enforcement win but not a market contraction. Within weeks, inventory migrated to Russian Market and 2easy, and Telegram-based cloud of logs services saw subscriber growth. The credential economy proved to be platform-resilient. Take down one marketplace and the supply redistributes. The lesson for defenders is that banking on law enforcement to suppress supply is not a strategy.
RaaS affiliate economics
The ransomware-as-a-service affiliate model is the single largest demand-side driver of the stolen credentials market. A typical RaaS arrangement splits ransom payments 70/30 or 80/20 in the affiliate's favor, with the operator providing the encryptor, leak site, and negotiation infrastructure. For an affiliate, the economic question is straightforward.
- How much does initial access cost?
- What is the probability of successful deployment?
- What is the expected ransom payment?
- What is the operator's cut?
At 5,000 dollars for verified VPN access, a 60 percent deployment success rate, an average payment of 400,000 dollars, and an 80/20 split, the affiliate's expected margin per purchased access is well over 100,000 dollars. That math is why the IAB market exists and why corporate credentials keep appreciating in price.
What this means for defenders
If credentials are the commodity that prices the rest of the attack, the security problem is cash flow. You cannot stop the printing press. You can detect when your bills start circulating.
- Perimeter is irrelevant if credentials are already external. Attackers buy their way past most perimeter controls. Assume initial access is purchasable.
- MFA is necessary but not sufficient. Session cookie theft and MFA fatigue attacks erode its protective value. Cookies stolen by Lumma or RedLine bypass most MFA implementations unless you enforce strict session binding.
- Exposure checks are the early-warning system. The moment a credential leaves the organization and enters the supply chain, there is a detection window before it is purchased and used. That window is the defender's entire advantage.
That window is why stealer-log and breach lookups matter. Revealer.US checks those sources, plus 800+ platforms and public records, so you can see whether an employee, customer, or partner email already appears in known datasets. See the API documentation if you want to wire those lookups into an existing workflow.
Conclusion
Cybercrime economics is a supply chain with named roles, posted prices, and operators optimizing for margin. Credentials move through it because they open bank accounts, corporate networks, ransom payments, and cloud infrastructure. The market has survived forum takedowns, Telegram crackdowns, and the seizure of Genesis Market for the same reason any commodity market does: the economics reward whoever keeps selling.
Defenders are not hunting lone attackers. They are competing against a liquid market that prices their credentials in real time. Stay ahead of it the same way the market stays ahead of you: watch your inventory continuously, globally, and before a buyer shows up.
Want to see whether your organization's credentials are already priced in that market? Run a data breach lookup or search stealer logs in Revealer.US.
Frequently asked questions
Why are stolen consumer credentials so cheap?
Oversupply. Infostealer logs dump retail passwords by the million, so generic consumer pairs often sell for well under a few dollars in bulk. Price follows freshness, geography, and whether the listing includes a live session cookie, not the fact of the leak itself.
What is an initial access broker?
An IAB buys or harvests a credential that leads into a corporate network (VPN, RDP, SSO), validates it, adds company context, and resells it as packaged access. A 10 dollar raw log can become a four- or five-figure listing once it is verified against a named organization.
Did the Genesis Market takedown stop the trade?
No. Inventory moved to other automated shops and Telegram cloud-of-logs services within weeks. Takedowns raise operator costs. They do not remove demand, and they do not drain the supply of fresh stealer logs.
How do ransomware affiliates buy access?
Many do not break in themselves. They buy verified VPN or RDP access from IABs, deploy the operator's encryptor, and split the ransom (commonly 70/30 or 80/20 in the affiliate's favor). Cheap access plus a large expected payout is why corporate credentials keep rising in price while retail logs fall.
Why do session cookies cost more than passwords?
A stolen cookie often skips the login, which means it can bypass MFA that would have stopped a stuffed password. Buyers pay for that shortcut. Binding sessions to device or network signals is how you take that premium away.
How can defenders use this market view?
Treat exposure as a priced event, not a future maybe. When an employee or customer credential appears in a dump or stealer log, reset it before an IAB packages it. Revealer.US searches known breach datasets and stealer logs for that purpose. It is not a consumer reporting agency, and the result is not an employment, tenant, or credit decision.