Ransomware gangs are still getting in through unpatched VPN appliances
If you look at how ransomware affiliates actually get their first foothold, the answer is rarely a zero-day. It's an internet-facing VPN concentrator, firewall, or remote-access gateway that's been running an old firmware version for a year or two, sitting on a known, already-patched vulnerability. Initial access brokers scan for these constantly and sell working access to whoever pays.
Why this keeps working
Remote-access appliances sit at the network edge by design, which makes them both the most exposed device on the network and, too often, the least frequently patched. Patching them usually means a maintenance window, a reboot, and coordination with whoever depends on that VPN to work from home — so it slips. Attackers don't need a novel exploit; public proof-of-concept code for edge-device vulnerabilities is usually available within days of disclosure, and mass scanning finds the stragglers within weeks.
Once inside, the playbook is consistent: harvest credentials from the compromised device, move laterally using legitimate admin tools already on the network, disable or evade backups, then deploy the encryptor. The appliance itself is rarely the target — it's the door.
What actually closes the gap
- Patch edge devices on a fixed cadence, not "when convenient." Treat VPN and firewall firmware updates as security patches with a defined SLA, not routine maintenance.
- Require MFA on every remote-access login, including local admin accounts on the appliance itself. A stolen password alone should never be enough.
- Turn on the vendor's own hardening guide. Most edge-device vendors publish one and most deployments never apply it — disabling unused management interfaces, restricting admin access by IP, enabling built-in intrusion prevention.
- Assume the appliance can be compromised and segment what it can reach. A flat network turns one edge device into full domain access; a segmented one buys time to detect and respond.
- Keep backups offline or immutable. The single biggest factor in whether a ransomware incident is a bad week or a company-ending event is whether backups survived.
The device guarding your network edge is only as strong as its last firmware update.
None of this is exotic advice, and that's the point — the gap between "known fix exists" and "fix gets applied" is where almost every ransomware intrusion that starts at the edge actually happens.