Why do ransomware groups keep targeting local government and education even when their techniques change?

They target these sectors because the combination of legacy systems, exposed services, and uneven security maturity creates repeated opportunities for intrusion. The entry method may shift from phishing to vulnerability exploitation or remote access compromise, but the underlying weakness remains the same: organisations often expose enough reachable attack surface to make initial access practical and scalable.

Why the target set stays the same even as the attack path changes

Ransomware operators follow the path of least resistance, not a single tactic. Local government and education keep presenting the same structural advantages: long-lived systems, public-facing services, limited patch windows, and a large operational burden relative to security staffing. That makes them attractive even when the entry method shifts from phishing to exploitation or remote access abuse.

The important point is that the tactic is only one layer of the intrusion chain. MITRE ATT&CK Enterprise Matrix is useful here because it separates initial access, credential access, lateral movement, and impact, which helps explain why a group can change technique without changing target preference. The sector remains attractive as long as reachable services, reusable credentials, or weak segmentation still shorten the path to encryption and extortion.

Public-sector and education environments also tend to have heterogeneous estates. Older servers, shared administration patterns, unmanaged remote access, and dependent third-party services can coexist in the same environment, so a new exploit chain often lands in a place that was already operationally exposed. That is why the target profile persists after a defender hardens one attack path: the attacker simply moves to another reachable weakness.

What makes these sectors repeatedly exposed

The recurring issue is not one perfect failure, but the overlap of multiple ordinary weaknesses. In these environments, an exposed service may be unimportant on its own, yet it becomes a practical entry point when combined with weak password hygiene, delayed patching, or broad internal reach once inside. The result is repeatable attacker economics, low-cost intrusion opportunities against large numbers of similar organisations.

Those economics are especially visible when access management is weak. The NIST Cybersecurity Framework 2.0 remains a strong fit because the issue spans govern, identify, protect, detect, respond, and recover, not just one control family. In practice, the weak point is often the combination of exposed attack surface and uneven control maturity, which lets a ransomware crew reuse the same playbook across many organisations with only small adjustments.

That pattern is also why the same sectors are targeted even after defenders improve awareness. Better phishing resistance does not help much if an internet-facing application is still unpatched, and better patching does not help much if remote access is reachable with weak credentials. The operational reality is that attackers do not need the newest technique, only the most dependable one available at that site.

Risk and Threat Considerations

Ransomware targeting in these sectors is a concentration risk as much as a technical one. When many organisations share similar legacy platforms, similar procurement constraints, and similar remote-access patterns, a single exploited weakness can be reused at scale across a large attack set.

Failure mechanism: Attackers probe for the easiest initial access path, then pivot through weak segmentation, shared credentials, or exposed administrative interfaces until they can deploy encryption and pressure the organisation into paying.

Impact: The consequence is service disruption, data loss or exposure, and a recovery burden that can overwhelm small IT teams, especially where backup quality, restoration speed, and incident coordination are already limited.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	Explains exploitation of exposed services as initial access here.
	T1110 — Brute Force	Covers credential attacks against reachable remote access in these sectors.
	T1021 — Remote Services	Maps abuse of remote access pathways that often remain exposed in public-sector estates.
Recommendation — Hunt and harden internet-facing services that can provide initial access. Detect and rate-limit repeated authentication attempts across exposed access paths. Restrict and monitor remote services that can be used to gain interactive access.
NIST CSF 2.0	PR.AC — Identity Management, Authentication, and Access Control	Applies because exposed access paths and weak credentials are central to repeatable intrusion.
	PR.PT — Protective Technology	Relevant to segmentation and hardening of externally reachable systems.
	DE.CM — Continuous Monitoring	Needed to spot abuse of changing entry methods across a heterogeneous estate.
Recommendation — Tighten authentication and access control for all internet-reachable services. Use protective technologies to reduce the blast radius of exposed services. Continuously monitor exposed services and authentication activity for intrusion patterns.
CIS Controls v8	CIS 4 — Secure Configuration of Enterprise Assets and Software	Addresses legacy systems and weak hardening that create repeatable exposure.
	CIS 6 — Access Control Management	Relevant because recurring ransomware access depends on broad or weak access paths.
	CIS 8 — Audit Log Management	Supports detection of the intrusion chain when attackers change techniques.
Recommendation — Standardise secure configurations for externally reachable systems. Remove unnecessary access and enforce least privilege on reachable systems. Centralise and review logs for remote access, authentication, and privilege changes.

Practitioner Guidance

What to prioritise: Focus first on the reachable edge of the environment, because that is where tactic changes usually land. If remote access, VPN, email, or public web services are weak, the group’s exact initial access method matters less than the fact that the path exists.

What to verify: Confirm that externally reachable services are inventoried, patched within a defined window, and segmented from core systems. If you cannot quickly show which services are exposed and which can reach crown-jewel systems, the organisation is still operating with attacker-friendly ambiguity.

Practitioner takeaway: The right question is not which ransomware technique is current, but whether the organisation has reduced the number of reliable entry paths enough that technique changes stop being commercially useful.