How ransomware gets in: six entry routes and what stops each

The encryption is the last thing ransomware does. Before that, someone has to get into the network, and the ways they do it repeat. If you know the usual routes, you know where to start closing things.

This post leans on two sources. The first is the #StopRansomware Guide, written jointly by CISA, MS-ISAC, NSA and FBI, which groups its prevention advice by common initial access vector. The second is the Initial Access tactic (TA0001) in MITRE ATT&CK v17.

ENTRY ROUTE             CONTROL         NETWORK      FILES      
                                       ┌──────────┐ ┌──────────┐
exposed RDP/VPN    ────────────────────│         ●│ │□ a.docx  │
                                       │          │ │          │
stolen password    ────────────────────│          │ │□ b.pdf   │
                                       │          │ │          │
phishing mail      ────────────────────│          │ │□ c.xlsx  │
                                       │ internal │ │          │
earlier malware    ────────────────────│          │ │□ d.jpg   │
                                       │          │ │          │
fake site          ────────────────────│          │ │□ e.pptx  │
                                       │          │ │          │
MSP / 3rd party    ────────────────────│          │ │□ f.src   │
                                       └──────────┘ └──────────┘
                                                                
no controls: route -> network -> files encrypted (T1486)        
                                                                
initial access first; encryption is the last step               

What is ransomware?

Ransomware is malware that encrypts files on a device, making them and the systems that rely on them unusable, and then demands a ransom for decryption. Many groups now also copy data out first and threaten to publish it. Doing both is called "double extortion", and some groups skip the encryption and extort with the stolen data alone.

In ATT&CK the encryption step is Data Encrypted for Impact (T1486), under the Impact tactic. The usual targets are ordinary user files (Office documents, PDFs, images, source code), and attackers may also encrypt virtual machines hosted on ESXi or other hypervisors.

Impact comes at the end. The beginning is Initial Access, which ATT&CK sums up as the adversary trying to get into your network. That first step is what this post is about.

Which routes does ransomware use to get in?

The #StopRansomware Guide lists six groups of initial access vectors (CISA). The table pairs each with the closest ATT&CK v17 technique. The pairing is mine; the guide doesn't make it.

Initial Access in ATT&CK v17 has 11 techniques. The ones not in the table, such as Hardware Additions and Replication Through Removable Media, are real routes too, but the CISA guide doesn't treat them as main groups.

How are internet-facing systems used to get in?

The attacker finds a service exposed to the internet and uses an unpatched flaw or a loose configuration to get through it. ATT&CK describes T1190 as exploiting a weakness in an internet-facing host, where the weakness can be a software bug, a temporary glitch, or a misconfiguration. T1133 covers VPNs, Citrix and other remote access mechanisms that let outside users reach internal resources.

The CISA guide puts it plainly: threat actors often gain initial access through exposed and poorly secured remote services, and also by exploiting VPNs or using compromised credentials.

What the guide recommends for this route (CISA):

• Don't expose RDP on the web. If a service must be exposed, add compensating controls, and disable unused ports such as RDP on TCP 3389.
• Scan for vulnerabilities regularly, internet-facing devices first.
• Patch internet-facing servers promptly, especially for flaws in the Known Exploited Vulnerabilities catalog.
• Update VPNs and network devices, and require MFA on every VPN connection.
• Block SMB at the perimeter: TCP 445 inbound and outbound, plus TCP 137, 138 and 139. Disable SMBv1.

At the edge firewall the last point turns into something like this (zone names and syntax are illustrative; every vendor writes it differently):

rule  block-smb-edge
  from  untrust  to  any     service  tcp/445, tcp/137-139   action  deny   log
  from  any      to  untrust service  tcp/445, tcp/137-139   action  deny   log

How do stolen passwords let attackers in?

The attacker logs in with a username and password obtained elsewhere, the same way the real user would. ATT&CK calls this Valid Accounts and notes it works against VPNs, Outlook Web Access, network devices, and remote desktop. It's hard to spot because the attacker may choose not to use malware or tools at all; a real account logging in looks normal.

From the guide (CISA):

• Phishing-resistant MFA for all services, particularly email, VPNs and accounts that reach critical systems.
• Change default admin usernames and passwords.
• Unique passwords of at least 15 characters.
• Account lockout after failed attempts, with logging to catch brute force and password spraying.
• Separate admin accounts from everyday user accounts.
• LAPS for local administrator passwords.

The first item matters most here. If a login needs a second factor that a phishing page can't capture, a leaked password on its own isn't enough.

How does phishing deliver ransomware?

Phishing is a message that gets the recipient to open a file, click a link or hand something over. ATT&CK lists four kinds: attachment, link, via a third-party service, and voice. Attachment phishing usually relies on the user opening the file; link phishing uses a link instead of a file to avoid defenses that inspect attachments.

The guide has several points you can act on straight away (CISA):

• Malware is often packed in password-protected archives that evade antivirus scanning and email filters.
• OneNote attachments with embedded malware have been used in phishing campaigns, so review the blocked file types at least every six months.
• Disable macros in Office files that arrive by email.
• Set up DMARC, but know its limit: it protects your domain from being spoofed, not your inbox from spoofed mail sent from domains that don't use DMARC.
• Disable Windows Script Host.
• Flag external emails in the mail client.

How is earlier malware connected to ransomware?

Ransomware is often the next stage of an infection that was already there. CISA says a ransomware infection may be evidence of a previous, unresolved network compromise and names QakBot, Bumblebee and Emotet as examples. In some cases ransomware is dropped last to cover up what came before, such as business email compromise.

In practice: a small antivirus or EDR alert on one laptop shouldn't be closed without a look. The guide recommends (CISA):

• Centrally managed antivirus, configured to send warnings to security staff.
• Application allowlisting or EDR on all assets; on Windows, WDAC and AppLocker.
• An IDS to catch command-and-control traffic before ransomware is deployed.

How do fake sites and third parties become entry routes?

The last two groups don't come through your own email or VPN. The first is social engineering beyond email, such as fake websites and search results. The guide suggests training staff to recognize illegitimate websites and search results, using Protective DNS, and considering sandboxed browsers. The nearest ATT&CK technique is Drive-by Compromise, where access comes from a user visiting a website over the normal course of browsing.

The second is third parties and managed service providers. CISA notes that MSPs have been an infection vector for ransomware impacting numerous client organizations. ATT&CK's Trusted Relationship describes access through an existing connection that may receive less scrutiny than standard ways in. What you can do: give third parties access only to the systems in their remit, put security requirements in the contract, and regularly audit publicly reachable remote monitoring and management accounts.

If attackers are already in, what makes recovery possible?

Offline, tested backups. They are the first item in the guide's preparation section, because many ransomware variants try to find and then delete or encrypt accessible backups. A backup that is always reachable on the network can go down with everything else.

Other preparation items from the guide (CISA):

• Keep "golden images" of critical systems, and keep infrastructure-as-code templates offline.
• Have an incident response plan and a communications plan, with paper and offline copies.
• Patch and harden hypervisors: attackers have started targeting VMware ESXi and other central systems, which enables fast encryption of the infrastructure at scale.

Where should you start?

I'd start with what an attacker can see from the internet, because those routes don't need anyone inside to make a mistake. Every item below is in the guide; the order is my own opinion.

1. List everything exposed to the internet: VPN, RDP, web, mail, any device with an admin page.
2. Close RDP and SMB at the edge. Patch VPNs and edge devices, starting with KEV entries.
3. Turn on phishing-resistant MFA for VPN, email and admin accounts.
4. Restore at least one system from an offline backup, for real.
5. Tighten email filtering, disable macros, review blocked attachment types.
6. Make sure antivirus and EDR alerts reach someone who reads them.
7. Review what your MSPs and other third parties can reach.

None of these blocks everything. Each one makes the most common routes harder to use, which is the point of organising the guide by entry route in the first place.

Sources

• CISA, MS-ISAC, NSA, FBI: #StopRansomware Guide (September 2023)
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK v17: Initial Access (TA0001)
• MITRE ATT&CK v17: Data Encrypted for Impact (T1486)
• MITRE ATT&CK v17: Exploit Public-Facing Application (T1190)
• MITRE ATT&CK v17: External Remote Services (T1133)
• MITRE ATT&CK v17: Valid Accounts (T1078)
• MITRE ATT&CK v17: Phishing (T1566)
• MITRE ATT&CK v17: Drive-by Compromise (T1189)
• MITRE ATT&CK v17: Trusted Relationship (T1199)
• MITRE ATT&CK v17: Supply Chain Compromise (T1195)