Critical Threat Intel ·

Ransomware gangs are still getting in through unpatched VPN appliances

If you look at how ransomware affiliates actually get their first foothold, the answer is rarely a zero-day. It's an internet-facing VPN concentrator, firewall, or remote-access gateway that's been running an old firmware version for a year or two, sitting on a known, already-patched vulnerability. Initial access brokers scan for these constantly and sell working access to whoever pays.

Why this keeps working

Remote-access appliances sit at the network edge by design, which makes them both the most exposed device on the network and, too often, the least frequently patched. Patching them usually means a maintenance window, a reboot, and coordination with whoever depends on that VPN to work from home — so it slips. Attackers don't need a novel exploit; public proof-of-concept code for edge-device vulnerabilities is usually available within days of disclosure, and mass scanning finds the stragglers within weeks.

Once inside, the playbook is consistent: harvest credentials from the compromised device, move laterally using legitimate admin tools already on the network, disable or evade backups, then deploy the encryptor. The appliance itself is rarely the target — it's the door.

What actually closes the gap

The device guarding your network edge is only as strong as its last firmware update.

None of this is exotic advice, and that's the point — the gap between "known fix exists" and "fix gets applied" is where almost every ransomware intrusion that starts at the edge actually happens.