Ransomware Initial Access Shifts to Remote Access: VPNs and RMM Dominate
Key Questions
What does data show about ransomware initial access methods?
At-Bay reports that 87% of ransomware claims now originate via remote access, with 73% through VPNs and zero from email, shifting priorities away from traditional phishing training.
Which vendors are frequently involved in these attacks?
SonicWall appears in one-third of At-Bay claims, while Qilin ransomware has exploited PAN-OS authentication bypass vulnerabilities for initial access.
How has identity become the primary attack vector?
Sophos data confirms identity as the top vector at 80% for the first time in four years, overtaking vulnerabilities, with MFA gaps enabling rapid access and longer dwell times averaging 12 days per Mandiant.
What are the implications for security spending?
The shift emphasizes investment in VPN and remote access security, identity protection, and continuous monitoring over email-focused defenses, influencing insurance underwriting and vendor priorities.
How do affiliate groups contribute to access variability?
Arctic Wolf analysis highlights significant variability among RaaS affiliates in exploiting remote access, underscoring the need for layered defenses against inconsistent but high-impact tactics.
At-Bay claims data flips the script: 87% of ransomware claims now start via remote access, 73% via VPN, and email produced zero claims. SonicWall alone appears in 1/3 of claims. This challenges the phishing-training orthodoxy and directly impacts security spending priorities, insurance underwriting, and vendor risk. Combined with Mandiant data (exploits 28%, vishing 14%, dwell time 12 days, 22-second hand-off), this signals a fundamental shift in attack vectors. New Sophos report confirms identity as primary vector (80%), overtaking vulnerabilities for first time in 4 years. MFA gaps persist, UK median ransom $2.5M, recovery costs rising. New: Qilin ransomware exploiting PAN-OS authentication bypass (CVE-2026-0257) for initial access, directly tying to VPN trend. Arctic Wolf analysis of affiliate variability under RaaS. Reinforces need for VPN/remote access security, identity protection, and continuous monitoring.