Behind Ransomware Attacks: Which Vulnerabilities Let Attackers In?

When people hear the word "ransomware," what most of them picture first is the "result": "our files were encrypted," "we got a ransom demand."
The news, too, inevitably tends to emphasize that moment.

But when you work on the front lines of assessments and incident response, your attention naturally turns somewhere a little different.
Before "whether things were encrypted," the question is where they got in in the first place.
There are also infection routes other than vulnerabilities.

Speaking from experience, there aren't that many entry points.
If anything, the patterns are so limited that you find yourself thinking "here again?"
It's also important to verify intrusion routes from an attacker's perspective.

In reality, flashy zero-day attacks and movie-style advanced intrusion techniques aren't used all that often.
What's actually common is:

• Management services that have been left exposed to the internet for a long time
• Known vulnerabilities that everyone knew were important but kept putting off

Cases where unremarkable places like these quietly become the way in.

What makes it worse is that nothing breaks right after the intrusion.
Even if someone logs in, even if they take a peek at the configuration, business carries on as usual.
No notifications appear, and a period in which "nothing seems to be wrong" goes on.

After that state continues for a while, one day it suddenly surfaces in the form of encryption.
Most of the ransomware incidents we've seen on the ground follow roughly this flow.

Today's mainstream ransomware attacks are no exception.
Rather than saying the popular techniques have changed, it feels closer to the truth to say that the easily overlooked entry points just keep getting used.

https://cyber.spool.co.jp/open-source-intelligence-osint/

Common Intrusion Patterns in Today's Ransomware Attacks

The intrusion methods used by ransomware groups have gradually changed over the past few years.
It used to be that suspicious email attachments and attacks that trick you into enabling macros stood out, but recently we're seeing more and more cases on the ground that those alone can't explain.

What stands out most now is intrusion that starts from management services exposed to the outside.
And it's a very realistic entry point that can be established just by a few misconfigurations or operational decisions piling up.

Among these, the one whose name comes up again and again is RDP (Remote Desktop Protocol).

Source: Coveware, "Q1 2020 Ransomware Marketplace Report"

RDP itself isn't a dangerous mechanism.
For IT administrators, it's a perfectly legitimate and convenient feature for operating servers and devices remotely.
In fact, it's used every day in many workplaces.

The problem arises when RDP is operated in the following conditions:

• It's exposed directly to the internet
• The password is reused with other services
• Multi-factor authentication isn't configured

Any one of these alone won't necessarily be fatal right away.
But the moment they overlap, RDP becomes a very obvious "entry point."

The actual intrusion isn't very dramatic either.
Attackers log in using brute force or already-leaked credentials, and gradually look around inside without being noticed.

Once attackers have a foothold, they don't necessarily run the ransomware right away.
They map the internal structure, expand their privileges and quietly explore "when, and how far, they can go."

Then, once everything is fully prepared, encryption is what's carried out last.

In many of the cases we've seen on the ground, encryption wasn't the start but almost the final step.
We think that's exactly why, by the time the damage surfaces, it tends to turn out that "they'd been inside for quite a while already."

Notable Vulnerabilities Exploited as Entry Points for Ransomware Attacks

Frankly, it isn't realistic to keep chasing every vulnerability.
The more time people spend on the front lines of assessments and operations, the better they understand this.
The volume of information published every day is huge, and the very idea of "dealing with all of it" easily becomes a burden.

On the other hand, when you look back at actual incidents, it's also true that some vulnerabilities come up again and again.
Even across different environments and industries, the points where you think "this again?" overlap to a surprising degree.

What they have in common is that their existence was already known and patches or workarounds had been published, yet they continued to be used as they were for operational reasons or because of priority issues.

Here, we organize the vulnerabilities that have actually been exploited as footholds for initial ransomware intrusion, in a way that lets you picture how they're used in the field.

Pulse Secure VPN (CVE-2019-11510)

VPN appliances are, by design, "the authorized route for getting into the company from outside."
That's exactly why, once one is breached, the impact is inevitably large.
It may be closer to the feeling of an authorized entrance being used as-is, rather than something being forced open from outside the firewall.

This vulnerability made it possible to read files inside the appliance without authentication.
As a result, cases were confirmed in which usernames contained in configuration files and logs, and in some cases plaintext password information, were obtained and used as a starting point for lateral movement into the internal network.

What made it troublesome was that information could be obtained without any special operation.
There wasn't even a need to log in to the admin console; it was a state in which "whatever is visible from outside can simply be read."

Patches themselves were provided relatively early.
But actual attacks surged only after the vulnerability became widely known and a PoC was published.

On the ground, too, we heard "we knew about it, but we thought we were still fine" more than once.
VPNs are often running stably as infrastructure, and there's also the fact that decisions to take them down and the timing of updates tend to get pushed back.

As a result, there were quite a few cases where the assumption that "it's a VPN, so it must be safe" delayed the response.

Seeing VPNs as the linchpin of defense isn't wrong in itself.
But when that sense of security is too strong, judgment can be dulled when a problem is actually found.
We feel this vulnerability was a case that drove that point home.

Microsoft SharePoint (CVE-2019-0604)

For many organizations, SharePoint is the hub of internal information.
It's also a system deeply embedded in day-to-day work, from document management and workflows to information sharing between departments.

With this vulnerability, uploading a crafted application package could lead to arbitrary code execution on the SharePoint server.
At first glance the operation looks limited, but in reality it puts the attacker in a position to act quite freely within the privileges SharePoint runs with.

In actual incidents, the web shell known as China Chopper was planted and used as a foothold for exploring the server and carrying out further malicious operations.
In other words, it was as if "a back door had been built into a business system."

What's troublesome is that at this stage, no files are destroyed and no services stop.
From the administrator's point of view, SharePoint is running as usual.
People can log in, and work goes on.
That's exactly why there's almost nothing to tip you off that something is wrong.

What's more, because SharePoint is a "business system," there are quite a few cases where the organization doesn't accurately know that it's exposed externally at all.

"It's supposed to be for internal use."
"It isn't meant to be reachable directly from the internet."

It was operated with that understanding and, as a result, ended up sitting where attackers could see it. We've come across this situation several times in our assessments.

We think this vulnerability was an example that once again drove home the fact that "the more indispensable a system is to the business, the more likely it is to become an entry point."

Microsoft Exchange (CVE-2020-0688)

Exchange is a system people tend to judge as "something that requires authentication, so it can't easily be exploited from outside."
And indeed, from an administrator's perspective, that view is understandable.

But what made this vulnerability troublesome was that once authentication was passed, the subsequent privilege checks became meaningless.
Even an account without administrator rights, one with only enough permission to read email, could potentially execute arbitrary code with SYSTEM privileges.

In other words, the issue wasn't "whether the administrator accounts were protected."
The point was that if even one internal account leaked, there was room for the entire server to be taken over from there in one go.

When responding on the ground, we sometimes hear "we never imagined an ordinary user's account would be the way in."
This vulnerability was exploited in a way that took advantage of exactly that assumption.

Another background factor that can't be overlooked is operational.
Because the email platform is at the core of the business, it's expected to run around the clock.
Stopping it is difficult in itself, and it's a system where the timing of patching tends to get pushed back.

As a result, we've seen many cases where a state of "we know it's important, but we can't touch it right now" went on for a long time, and attackers got in by exploiting that gap.

We feel the Exchange case once again drove home the very basic fact that "having authentication doesn't necessarily mean being safe."

Exim (CVE-2019-10149)

Exim is an MTA (mail transfer agent) widely used around the world.
Especially in Linux environments it has a long track record of stable use, which also makes it the kind of thing people tend to treat as "it just works" and "install it once and leave it."

This vulnerability stemmed from inadequate input validation in the mail delivery process, and under the right conditions it could lead to command execution.
Because from the outside it looks like ordinary email traffic, a defining feature is how hard it is to notice that an attack has even succeeded.

Source: Tenable blog, "CVE-2019-16928: Critical Buffer Overflow Flaw in Exim is Remotely Exploitable"

The fact that a very large number of vulnerable versions were running at the time of the research also symbolizes this case.
Looking at results from Shodan and other surveys, old versions vastly outnumbered the latest, patched version.

Looking at the distribution of publicly observed Exim servers, it was confirmed that about 90% were still running vulnerable versions for which a fix had already been released at the time.

What we feel on the ground is that mail servers are treated with "never going down" as the top priority.
Because the impact on the business is large, work that involves updates or restarts inevitably gets pushed back.

As a result, the perception that "running stably = safe" takes hold, and in reality servers stay in a vulnerable state for long periods.

We think the Exim vulnerability was an example that once again drove home the fact that "running" and "being secure" are two different things.

Citrix ADC (CVE-2019-19781)

Citrix products are deployed at a very large number of organizations for VPN and remote access.
They're a family of products that have been used for many years as the foundation for connecting securely to internal systems from outside the company.

With this vulnerability, cases were confirmed in which a directory traversal served as the starting point and ultimately led to remote code execution. The entry point may be simple, but the end result is anything but minor.

What stood out was that, before the question of whether anyone could log in to the admin console even arose, simply being visible from outside created room for exploitation.
For attackers, it was a very easy entry point to work with, since it required no special preparation or elevated privileges.

Another feature of this vulnerability was the breadth of its impact.
Published research found large numbers of vulnerable Citrix endpoints in countries around the world, not limited to any particular country or region.

Source: Public data from Bad Packets Report

Looking at the distribution by country, you can see that the more mature a country's IT infrastructure, the more Citrix environments were left exposed on the internet.
This quietly shows that "it isn't a problem limited to a particular industry or region."

When responding on the ground, we're reminded once again of the cycle of
"it's a critical system, so we can't stop it"
"since we can't stop it, updates get pushed back."

We think the Citrix case confronted many organizations with the reality that the remote access infrastructure itself can become the biggest entry point.

Why Are These So Easily Overlooked?

What all the cases we've looked at have in common is that each one meets the following conditions:

• It's a management system
• It's something that "can't be stopped" for business reasons
• It's a mechanism that's already deployed and used every day

None of these is anything special.
If anything, for many organizations they're "things that are just there."

That's exactly why they get targeted.

No new attack techniques or unknown technologies are being used.
What actually becomes the entry point is, in almost every case, a mechanism you should have known about all along and a vulnerability that made headlines at some point in the past.

But because they're "not causing problems right now," they gradually get pushed out of mind.

You can log in to the admin console.
The service hasn't stopped.
Business is running today as usual.

When that state continues, the perception that "nothing in particular is wrong" quietly turns into an assessment that "it's safe."

As a result, places that could really be entry points remain without anyone paying attention to them.

What we feel on the front lines of assessments and incident response is that much ransomware damage doesn't begin suddenly after something happens, but surfaces at the end of an accumulation of time in which nothing happened.

That's why we believe the very state of "now, when nothing is happening" is actually the easiest and most valuable time to take another look.

https://cyber.spool.co.jp/penetration-test-purpose-types/

The Entry Point Is Always Somewhere Quiet

Ransomware doesn't appear out of nowhere one day.
In many cases, there's a certain amount of time between intrusion and encryption.
During that time, the attackers don't make a fuss; they watch what's going on inside without drawing attention.

That's why, if you look only at the moment the damage surfaces, it's easy to feel that "it happened suddenly" or "there was no way to prevent it."
But looking at the field from the standpoint of prevention and assessment, we often feel that the real turning point comes at a much earlier stage.

It comes down to whether, before anything broke, during the time when nothing seemed to be happening, you were able to stop once and take another look at your environment.

For example:

• What management services are currently exposed externally?
• Among them, are there any whose updates have stalled, and since when?
• Are there mechanisms that rely on credentials and are trusted too much?

You don't need to identify all of this perfectly.
You don't need to change everything at once either.

But take stock once, now, while nothing is happening.
Whether you've done that makes a big difference to your options when something does happen.

What we feel in our assessment work is that "whether there was room to think" shapes the subsequent response more than "whether it could have been prevented."

Ransomware countermeasures aren't about stoking fear, nor about aiming for perfection.

You don't need to make big changes.
Review your current setup from today's perspective.
That alone will give you more to base your decisions on.

For recommended companies that can identify the vulnerabilities that become entry points through assessments, see the article below.

https://cyber.spool.co.jp/vulnerability-assessment-company-guide/

For countermeasures that prevent attacks exploiting vulnerabilities, see the article below.

Best Ransomware Protection Software Compared (2026): A Guide for Individuals and Businesses