How Ransomware Gets In: Phishing, RDP, VPNs and Edge Devices

Ransomware does not appear out of nowhere. Somebody logged in, somebody opened something, or something on the internet edge was left unpatched. When incident reports are written up, the initial access almost always falls into a small number of categories, and every one of them is preventable with unglamorous work.

Here are the four doors we see most, how the attacker walks through each one, and what actually closes it.

Door one: phishing and the credential that follows

Modern phishing rarely delivers ransomware directly. It delivers a login page. The email looks like a shared document, a voicemail, or a password expiry notice. The link lands on a page that mirrors your Microsoft 365 sign-in, the user types their password, and if MFA is a push notification they approve it because they were expecting to sign in.

With a working mailbox login, the attacker reads email for days, looks for VPN instructions and IT contacts, and then uses the same password on the VPN. From there the ransomware deployment is a separate, later step.

Move MFA to phishing-resistant methods: FIDO2 keys or Windows Hello for Business for admins, number matching in Microsoft Authenticator for everyone else.
Enable Conditional Access policies that block legacy authentication and require a compliant device for VPN and email.
Report buttons matter more than training videos. Make it one click to report and make sure someone actually reads the reports.

Door two: Remote Desktop on the internet

An RDP port open to the internet is an invitation. Scanners find it within hours of it going live, and password spraying starts immediately. A weak or reused password on any account with remote desktop rights is enough. The attacker logs in, disables the antivirus, and runs the encryptor by hand.

The fix is not a stronger password. It is removing the port from the internet entirely.

Find it: scan your public IP range for TCP 3389 from outside, or check the firewall NAT table for any rule forwarding to 3389.
Remove the forward. Put RDP behind the VPN, or behind a gateway such as Remote Desktop Gateway or Azure Virtual Desktop that requires MFA.
Enable Network Level Authentication on every host: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > Require user authentication for remote connections by using Network Level Authentication.
Set an account lockout policy so spraying trips alarms: Account lockout threshold at 10, duration 15 minutes.
Restrict the Remote Desktop Users group to the people who need it. Domain Users should not be in it.

Door three: the VPN appliance itself

VPN appliances from every major vendor have shipped with serious flaws that let an attacker bypass authentication or run code on the device. These get exploited within days of disclosure, and the appliance is by definition reachable from the internet. Once inside the VPN box, the attacker is on your LAN with no credentials needed.

Two things go wrong here: the firmware is old, and nobody is watching the vendor advisory feed. A VPN appliance that has not been updated in a year should be treated as already compromised until proven otherwise.

Subscribe to the vendor's security advisory list for every edge device you own. Fortinet, SonicWall, Cisco, Palo Alto, Ivanti and Citrix all publish one.
Patch the edge within 72 hours of a critical advisory. Schedule the maintenance window before the advisory exists, not after.
Require MFA on VPN logins, tied to your identity provider rather than local accounts on the appliance.
Disable the web admin interface on the WAN side. Manage it from the LAN or through a management VPN.
Review local accounts on the appliance. Attackers add their own so they survive a password reset.

Door four: whatever else is facing the internet

The edge is wider than the firewall. File transfer servers, backup consoles, hypervisor management pages, IP cameras, printers with public IPs and forgotten test servers all count. Each is a piece of software that will eventually have a vulnerability, and each is one the attacker can reach without a password.

You cannot patch what you do not know about. The first step is an honest inventory of everything answering on your public address space.

Run an external scan against your full public range. nmap from a cloud VM works: nmap -Pn -p- -sV your.public.range/29.
For every open port, write down what it is, who owns it, and why it needs to be public. If nobody can answer, close it.
Move management interfaces (iDRAC, iLO, vCenter, Hyper-V hosts, backup servers) off the internet without exception.
Repeat the scan quarterly. Ports reopen when people troubleshoot and forget.

nmap -Pn -p- -sV --open 203.0.113.0/29 -oN external-scan.txt

Frequently asked questions

We have antivirus on every machine. Is that not enough?

Antivirus catches known malware once it lands. Every door listed here is walked through with valid credentials or an appliance exploit, before any malware runs on a workstation. Endpoint protection is necessary, but it is the last layer, not the first.

Which of the four should I fix first?

Whichever is open right now. Exposed RDP is the fastest to exploit and the fastest to close, so start there. Then confirm your VPN and firewall firmware are current. Phishing defense is ongoing work and should run in parallel.

How do I know if an attacker is already inside?

Look for logins from unfamiliar locations in Entra ID sign-in logs, new local accounts on the VPN or firewall, new scheduled tasks on servers, and antivirus that has been silently disabled. If you want a second set of eyes on that review, RackLedge does exposure assessments that cover exactly these points.

Takeaway

Almost every ransomware incident starts at one of these four doors, and all four are closed by the same boring discipline: know what is on your edge, patch it quickly, put MFA on every remote login, and keep Remote Desktop off the internet. None of it is exotic. All of it has to actually be done.