July 2025 ransomware roundup shows patch gaps and credential risk

At a glance

What this is: This is a July 2025 threat roundup from ColorTokens showing how patch gaps, unsupported appliances and credential theft combine into broader ransomware exposure.

Why it matters: It matters because IAM, PAM, NHI and security teams all have to treat patch latency, token hygiene and access containment as one governance problem, not separate workstreams.

By the numbers:

• By July 14, over 85 FortiWeb devices were infected with web shells after active exploitation began.

Context

July 2025’s threat picture is best understood as a governance failure across patch management, exposed services and credential control, not as five unrelated incidents. The common pattern is that unsupported assets, delayed remediation and externally reachable interfaces create a pathway from vulnerability to operational disruption.

The article also has a clear identity-security angle because several of the incidents turn on credential theft, remote access exposure and token reuse. That places the issue squarely in the overlap between vulnerability management, PAM and NHI governance, where service access can become the first compromise path.

Key questions

Q: What breaks when unsupported appliances are left in production?

A: Unsupported appliances keep trusted access paths alive after security fixes stop. That creates a standing exposure window for stolen credentials, rootkits, and remote exploitation. In practice, the breakage is organisational: defenders may still think the device is governable when the vendor no longer supports its trust model, making containment slower and recovery more expensive.

Q: Why do patch gaps so often become ransomware risk?

A: Patch gaps become ransomware risk because public exploits and exposed services reduce the time between disclosure and compromise. Attackers do not need a perfect chain if one reachable flaw yields code execution, web shell placement or credential theft. The risk is amplified when remediation is slow, assets are internet-facing and segmentation does not limit what the compromised host can reach.

Q: What are the signs that credential theft is driving a broader breach?

A: Common signs include unusual access to systems beyond the initial entry point, unexpected use of trusted accounts, and activity that looks normal at the authentication layer but abnormal in scope or timing. A separate warning sign is delayed detection, because credential abuse often lets attackers operate for long periods while appearing to be legitimate users.

Q: Should teams prioritise microsegmentation or patching first during an active vulnerability campaign?

A: Teams should patch or isolate the most exposed systems first, then use microsegmentation to limit what remains reachable during the remediation window. Segmentation does not fix a vulnerable service, but it can prevent one compromised host from becoming a route to broader ransomware impact. The right sequence depends on exposure, but both controls are needed to shrink blast radius.

Technical breakdown

Why unsupported appliances become persistence anchors

Unsupported appliances are a special problem because they combine internet-facing access, privileged administrative functions and no vendor-supported remediation path. When a device reaches end of life, patching stops being a complete control and becomes only one layer in a larger containment strategy. If attackers can obtain shell access or plant a backdoor, the appliance can serve as a durable foothold for credential theft, traffic interception or lateral movement. In this article, the SonicWall SMA case illustrates the risk: even patched hardware remained exploitable because support had ended, leaving defenders with no viable product-side fix.

Practical implication: retire or isolate end-of-life remote access appliances before they become persistence points.

How patchable vulnerabilities still lead to breach conditions

A patched CVE does not eliminate risk when exploitation begins before remediation is complete or when exposed services remain reachable. The Windows, Office and SharePoint issues in this roundup show three different attack patterns: network-exploitable code execution, file-triggered compromise through the Preview Pane, and application-layer RCE. Each route depends on an exposure window that defenders must shorten through patch speed, exposure reduction and temporary compensating controls. In practice, the attack surface is the time between disclosure and verified remediation, not just the existence of the flaw.

Practical implication: treat disclosure day as the start of containment, not the end of the response.

Credential theft turns infrastructure flaws into access abuse

Once attackers steal credentials, the problem shifts from vulnerability exploitation to identity misuse. That matters because remote access appliances, admin consoles and authentication tokens often carry more privilege than a typical endpoint compromise. The article’s SMA and eSIM examples both show this transition: access material is taken first, then used to keep persistence or enable later abuse. For identity teams, the key issue is not only whether a system is patched, but whether the access tokens, admin passwords and delegated credentials tied to that system can still be used after compromise.

Practical implication: pair remediation with forced credential revocation and session invalidation for every exposed access path.

Threat narrative

Attacker objective: The attacker objective is to turn exposed infrastructure and stolen credentials into durable access for ransomware, extortion or data theft.

1. Entry occurs through exposed or actively exploited vulnerabilities in Windows, Office, SharePoint, FortiWeb and unsupported SonicWall SMA appliances.
2. Credential access follows when attackers steal administrative credentials, authentication material or mobile operator access from compromised systems.
3. Escalation and persistence come from rootkits, web shells and backdoor access that preserve control even after patching or partial cleanup.
4. Impact is ransomware enablement, data theft, remote code execution and long-term compromise of infrastructure and sensitive records.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Patch latency has become an access-control problem, not just a vulnerability problem. The article shows that once a flaw is public, the meaningful control is how quickly exposed assets are removed from reach, patched or isolated. That shifts governance from software maintenance into exposure management. Practitioners should treat remediation speed as part of identity and privilege risk, because the same window that leaves a server vulnerable also leaves its access paths usable.

Unsupported remote access devices create governance debt that defenders eventually pay through incident response. The SonicWall case is not just a device problem; it is a lifecycle failure where the organisation keeps a privileged access path after the support contract and security assumptions have expired. That is a classic zero-standing-privilege lesson for infrastructure access, including admin tokens and VPN credentials. Practitioners should measure whether any privileged pathway exists beyond its supportable lifecycle.

Credential theft is the point where technical compromise becomes an identity governance failure. Once credentials, admin passwords or operator material are stolen, the attacker no longer needs to break the system in the same way. This is where NHI and PAM overlap with broader cyber hygiene, because service access, remote admin rights and device-authentication material must be revoked as aggressively as any user account. Practitioners should align compromise handling with credential invalidation, not only patching.

Microsegmentation is a containment control, but it only works when governance already knows what must be contained. ColorTokens’ roundup implicitly shows that organisations often discover asset exposure only after exploitation starts. The named concept here is exposure-to-exploitation drift: the period in which a known defect, exposed interface or stale credential remains operationally reachable. Practitioners should reduce that drift by tying exposure management, access reviews and emergency isolation into one operational loop.

From our research library:

• Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.

What this signals

Exposure management now sits inside identity governance. The July roundup shows why security teams cannot separate patching from access control when remote services still authenticate users, admins and machines. If the vulnerable asset also holds tokens or privileged sessions, the first response has to be both containment and revocation.

Unsupported access paths are the new blind spot. Organisations often focus on known CVEs while ignoring the systems that can no longer be fully remediated because they are out of support. That is where microsegmentation, emergency offboarding of credentials and retirement of stale access routes become governance controls, not just technical hardening.

Operational resilience depends on reducing exposure-to-exploitation drift. The shorter the time between disclosure, validation and containment, the less room attackers have to turn a routine bug into ransomware, persistence or data theft. Practitioners should make that drift a measurable programme signal rather than an after-action lesson.

For practitioners

• Retire unsupported remote access appliances Remove end-of-life VPN and remote administration devices from production paths, especially where they still terminate privileged sessions or house authentication material.
• Accelerate emergency patch verification Prioritise externally reachable Windows, Office, SharePoint and WAF exposures for same-day validation, then confirm the patch actually closes the exploit path.
• Force credential and token revocation after compromise Rotate admin passwords, disable old VPN tokens and revoke any access material tied to the compromised appliance or service before restoring normal operations.
• Contain blast radius with segmentation Use network microsegmentation to separate vulnerable servers, remote access systems and sensitive workloads so one exploited asset cannot reach the rest of the environment.
• Inventory and remove fragile IoT trust dependencies Track eSIM and mobile operator credentials as part of the privileged inventory, then replace SIM-only authentication where device compromise would create outsized access.

Key takeaways

• The roundup shows that ransomware exposure now emerges from the combination of stale access, unsupported appliances and public vulnerabilities.
• The most damaging cases in July were not isolated flaws but chains that moved from reachable systems to credential theft, persistence and disruption.
• Teams can limit damage by treating patching, credential revocation and segmentation as one response cycle instead of separate tasks.

Key terms

• Exposure Drift: Exposure drift is the gap between the state a security team last validated and the state the environment has reached since then. In fast-changing cloud and identity-heavy environments, that gap can be large enough to make a previous pentest result unreliable for operational decisions.
• Persistence anchor: A system, appliance or account that lets an attacker keep access after the initial entry path has been discovered or partially remediated. For NHIMG, the important point is governance: if the asset remains privileged, internet-facing or supported by stale credentials, it can keep serving the attacker even after patching begins.
• Credential Revocation: Credential revocation is the process of disabling a secret, token, or key so it can no longer authenticate or authorize action. It is the operational half of detection, because exposed credentials remain dangerous until they are invalidated and replaced across every dependent system.
• Microsegmentation: A network control approach that divides environments into small security zones with explicit rules between them. Its purpose is to limit lateral movement and reduce blast radius when an identity, workload, or device is compromised.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security and identity practitioners connect access control, lifecycle governance and operational resilience across the programmes they run.