Ransomware operators rarely need novel techniques to get in: an unpatched firewall, a VPN account without MFA or a convincing call to the help desk is usually enough. Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of breaches and vulnerability exploitation overtaking stolen credentials as the leading way in, at 31% of breaches. This list ranks the ten initial access vectors that most often precede ransomware, with the signals that reveal each one and the controls that close it, mapped to MITRE ATT&CK. It is for security operations, infrastructure and risk teams and contains no attacker procedures.
The Top 10 at a glance
Sources disagree on exact shares because they measure different populations, so the ranking combines them. The Sophos State of Ransomware 2025 survey of 3,400 victims put exploited vulnerabilities first (32%, for the third year running), then compromised credentials (23%), malicious email (19%) and phishing (18%). Coveware's Q2 2026 report, based on incident response cases, saw phishing and social engineering back in the lead, with remote access compromise declining from a late-2025 peak but still material. CISA's #StopRansomware Guide organises prevention around six vectors, all covered below.
| # | Vector | Main ATT&CK technique | Strongest control |
|---|---|---|---|
| 1 | Exploited edge devices (firewalls, VPNs, file transfer) | T1190 | KEV-driven patching within days, reduced exposure |
| 2 | Stolen VPN and remote access credentials without MFA | T1133, T1078 | Phishing-resistant MFA on every remote access path |
| 3 | Phishing and malicious email | T1566.001, T1566.002 | Email filtering, macro controls, phishing-resistant MFA |
| 4 | Help desk and voice social engineering | T1566.004 | Strong caller verification for resets |
| 5 | Exposed RDP and remote services | T1133, T1021.001 | Remove from the internet, broker through a gateway |
| 6 | Brute force and password spraying | T1110.003 | MFA, lockout, breached-password checks |
| 7 | Third-party and MSP access | T1199 | Least privilege, monitored and time-bound vendor access |
| 8 | Abused RMM and remote access tools | T1219 | Allowlist one approved tool, block the rest |
| 9 | Precursor malware and infostealers | T1204.002, T1189 | EDR, application control, Protective DNS |
| 10 | Leaked cloud and machine credentials | T1078.004 | Short-lived credentials, secret scanning |
1. Exploited edge devices
The vector: unpatched firewalls, SSL VPNs, remote access gateways and file transfer servers. In the CISA KEV catalog (version 2026.10.21), 361 of 1,754 entries are flagged as known to be used in ransomware campaigns, including CVE-2024-40766 (SonicWall SonicOS) and CVE-2023-20269 (Cisco ASA and FTD). The Ivanti Connect Secure exploitation showed how appliance flaws also expose stored credentials and sessions.
Detect: new KEV entries matching your asset inventory, unexpected admin logins or configuration changes on appliances, and outbound connections from management interfaces.
Prevent: CISA advises prioritising patching of internet-facing systems, especially known exploited vulnerabilities, and not exposing management interfaces. Reported Verizon data shows only 26% of critical KEV vulnerabilities fully remediated in 2025, so measure your own rate. Rotate credentials after patching a credential-exposing flaw. See the Edge Device Security Guide.
2. Stolen VPN and remote access credentials without MFA
The vector: valid usernames and passwords, often from infostealers or reuse, used on a VPN or virtual desktop gateway that accepts a password alone. Coveware notes that Akira affiliates often use stolen or weak credentials against exposed VPNs. The Colonial Pipeline attack began with an unused VPN account, and the Change Healthcare breach with a Citrix login without MFA.
Detect: VPN logins from hosting providers or new countries, dormant accounts becoming active, and logins outside working patterns.
Prevent: CISA calls for MFA on VPNs, and where MFA is impossible, passwords of at least 15 characters. Remove dormant and local VPN accounts, and check that MFA applies to every portal and protocol, not just the main one. See the VPN Security Guide.
3. Phishing and malicious email
The vector: credential phishing and malicious attachments or links that install a loader. CISA's Medusa advisory (AA25-071A) lists phishing as a primary method for stealing credentials.
Detect: user reports, Office applications launching scripts, and sign-ins soon after a reported phish.
Prevent: CISA recommends DMARC built on SPF and DKIM, filtering risky attachment types, disabling macros from email and disabling Windows Script Host. See the Phishing Guide.
4. Help desk and voice social engineering
The vector: a caller impersonates an employee and gets a password or MFA reset. CISA's Scattered Spider advisory (AA23-320A) describes this alongside SIM swaps and MFA fatigue, and Coveware called help desks "the front line of compromise" in July 2025. The MGM Resorts breach began with a help desk call.
Detect: resets followed within minutes by sign-in from a new device, resets of privileged accounts, and new MFA methods registered after a reset.
Prevent: verify callers through a channel the attacker does not control, require stronger proof for privileged accounts, and alert on reset-then-register patterns. See the Account Recovery and Help Desk Security Guide.
5. Exposed RDP and remote services
The vector: RDP (TCP 3389), SMB and other services reachable from the internet. CISA treats these as internet-facing misconfigurations and advises blocking TCP 445 and 137-139 at the perimeter and disabling SMBv1.
Detect: external scans of your own ranges, and Windows event 4625 bursts or 4624 logon type 10 from external addresses.
Prevent: remove RDP from the internet, broker access through a gateway with MFA, enforce account lockout and log attempts. See the Remote Desktop (RDP) Security Guide.
6. Brute force and password spraying
The vector: common passwords tried across many accounts on VPNs, webmail and cloud sign-in, staying under lockout thresholds.
Detect: failed logins across many accounts from few sources, followed by one success.
Prevent: CISA's guidance asks for unique passwords of at least 15 characters, lockout, logging of spraying attempts and changing default admin credentials. MFA on every external sign-in removes most of the value.
7. Third-party and MSP access
The vector: a supplier's remote access, shared accounts or management platform. Reported 2026 DBIR figures put third-party involvement at 48% of breaches, up from 30%.
Detect: vendor accounts active outside agreed windows or reaching systems outside their scope.
Prevent: CISA advises assessing supplier cyber hygiene, least privilege and separation of duties for third-party access, and contract requirements where an MSP manages backups. Make vendor access named, MFA-protected, time-bound and logged. See the Remote Access Identity Guide.
8. Abused RMM and remote access tools
The vector: legitimate tools such as ScreenConnect, AnyDesk, Splashtop and TeamViewer, either installed by a tricked user or reached through a flaw. CISA advisory AA23-025A warns that portable RMM executables run without admin rights and evade antivirus; Medusa affiliates exploited CVE-2024-1709 in ScreenConnect.
Detect: execution of any remote access tool not on the approved list, and RMM processes loaded only in memory.
Prevent: allowlist one approved tool, block installation and execution of others, block common RMM ports at the perimeter and keep the approved product patched. See the RMM Tool Security Guide.
9. Precursor malware and infostealers
The vector: loaders delivered through email, malvertising or poisoned search results, and infostealers that harvest passwords and session cookies later sold to initial access brokers.
Detect: EDR alerts on loaders, command-and-control beacons seen by an IDS, and stolen-credential alerts from dark web monitoring.
Prevent: CISA recommends centrally managed antivirus or EDR, application allowlisting with WDAC or AppLocker, and Protective DNS, including for remote workers. See the Infostealer Threat Guide.
10. Leaked cloud and machine credentials
The vector: access keys and tokens for cloud and SaaS accounts, which MFA does not protect. The Codefinger S3 ransomware used stolen AWS keys to encrypt buckets, and Storm-0501 carried ransomware operators into the cloud with synchronisation credentials.
Detect: keys used from unexpected networks, first use of dormant credentials, and bulk encryption or deletion API calls.
Prevent: replace long-lived keys with short-lived workload credentials, scan for secrets, and restrict destructive actions with organisation-level policies. See the Secrets Management Guide.
Mapping to MITRE ATT&CK
| Vector | ATT&CK technique (v20) | CISA guide vector |
|---|---|---|
| 1. Edge devices | T1190 Exploit Public-Facing Application | Internet-facing vulnerabilities |
| 2. VPN credentials | T1133 External Remote Services; T1078 Valid Accounts | Compromised credentials |
| 3. Phishing | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | Phishing |
| 4. Help desk | T1566.004 Spearphishing Voice; T1621 MFA Request Generation | Advanced social engineering |
| 5. RDP | T1133 External Remote Services; T1021.001 Remote Desktop Protocol | Internet-facing misconfigurations |
| 6. Spraying | T1110.003 Password Spraying | Compromised credentials |
| 7. Third parties | T1199 Trusted Relationship | Third parties and MSPs |
| 8. RMM tools | T1219 Remote Access Tools | Third parties; phishing |
| 9. Precursor malware | T1204.002 Malicious File; T1189 Drive-by Compromise | Precursor malware |
| 10. Cloud credentials | T1078.004 Cloud Accounts | Compromised credentials |
Track five measures: days to patch KEV entries on internet-facing assets, share of remote access paths enforcing phishing-resistant MFA, count of internet-exposed RDP and SMB services (target zero), number of unapproved remote access tools detected, and share of vendor accounts that are named, time-bound and MFA-protected.
Where to start
- Inventory and patch the edge: list every internet-facing appliance and service, match it to KEV daily and patch or isolate within days.
- MFA on every way in: VPN, virtual desktop, webmail, cloud consoles and vendor portals, phishing-resistant for administrators.
- Close exposed services: take RDP and SMB off the internet and allowlist a single RMM tool.
- Harden the help desk: caller verification and alerting on resets of privileged accounts.
- Assume one vector will work: keep immutable, tested backups and a rehearsed plan. See the Ransomware Prevention Guide and Ransomware Response and Recovery Guide.
Related NHI Mgmt Group resources: Ransomware Groups Guide · Backup Security and Immutable Backup Guide · Ransomware Playbook Template · Patch Management Guide