A crew held quiet remote access six weeks, then went for finance — were you selected in advance?

## Two parties, one question `Were we targeted?` has no single answer when the intrusion passed through an access market, because the party that got in and the party that chose you are different people with different economics. **The seller.** An initial-access broker's business is volume. It acquires footholds cheaply and at scale — a reachable unpatched service, a credential reused from a public breach set, a remote-access portal without a second factor — and does nothing else with them. It does not escalate, does not stage anything, does not care what your organisation does for a living beyond enough detail to price the listing. For the seller you were never selected in any meaningful sense; you were harvested. **The buyer.** The buyer selects, and does so on explicit criteria, because the listing is written to support exactly that: a country, a sector, an approximate revenue figure taken from public sources, a headcount, the type of access, the privilege level it carries, and a price. A buyer looking for organisations that move money picks accordingly. This is real selection — deliberate, criteria-driven, and performed *after* the access existed. So the honest answer to the counterpart asking the question is: nobody chose you before entry; somebody chose you afterwards, from a catalogue, and paid for the privilege. ## What the six-week gap actually measures The intuitive reading is stealth — a disciplined crew lying low. The market reading is better: the gap is latency. Time between acquisition and listing, time on the market, time in the buyer's own queue. It says almost nothing about the first party's skill and nothing at all about its intentions towards you, because it had none. A related tell sits at the other end. Once the buyer takes over, the behaviour changes character abruptly — quiet or absent activity for weeks, then purposeful movement toward a specific objective with little exploration. That discontinuity is two different operators, not one operator changing gear. ## Three consequences that matter more than the label **The original route is probably still open, and not only for you.** The seller's method was generic, so whatever let it in — an unpatched reachable service, a credential without a second factor — very likely exists elsewhere in your estate and at other organisations. Fixing the account the buyer used addresses the buyer's convenience, not the seller's method. **Access can be sold more than once, and to more than one buyer.** A second, unrelated crew showing up months later is a normal market outcome. It is easy to misread as the first crew never having left, which sends effort at re-entry hunting when the actual exposure is the un-closed original route. **The buyer's objective tells you nothing about the seller's.** Financial motive at the sharp end does not mean the entry was financially motivated; the entry had no motive beyond resale value. ## Why this is the leaf's hardest case Both simple stories are wrong here. `We were targeted` overstates it — nothing about your organisation caused the entry. `We were just unlucky` understates it — a person read a description of your company and decided it was worth money. The split market makes selection and access genuinely independent events, performed by different parties for different reasons, which is why the order in which they happen is the thing to reason about rather than the label at the end. A final caution about naming: which crew, and whether this activity belongs with anything seen elsewhere, is a separate discipline with its own evidentiary standards. The order-of-targeting question can be answered from the shape of the intrusion alone, and answering it does not require, or produce, a name.