Almost nobody gets hit by ransomware because an attacker did something clever. They get hit because a box that has been sitting on the public internet since 2019 was still answering requests, still running firmware nobody has updated, and still trusted by everything behind it.
That is the unglamorous truth of initial access. The intrusion starts at the edge of your network, at the oldest and least documented piece of it, then moves inward through infrastructure that assumes anything already inside must be friendly. This article is about that first hop: what the entry points are, why they survive in businesses that take security seriously, and the order in which to shut them down.
Ransomware initial access is boring on purpose
Attackers pick the cheapest way in, not the most impressive one. In practice that means three families: an unpatched internet-facing service, a legacy remote access path, or a valid credential bought or stolen. All three are cheap, repeatable and scalable, which is exactly why crews use them instead of anything exotic.
The economics explain it. Writing a novel exploit costs weeks of expensive talent and burns the moment it is detected. Scanning the entire internet for a known vulnerable appliance costs an afternoon and works forever, because there is always someone who has not patched.
So the surface that gets hit is not the one you worry about, it is the one you forgot to write down. You are not targeted, you are found. The only question is whether the thing that gets found is patched, and whether it can reach anything worth encrypting.
Internet-facing appliances are the front door
The most common way in is an unpatched service you deliberately exposed and then stopped thinking about: a VPN concentrator, a firewall management interface, a file transfer appliance, a mail gateway, a remote support tool. They are exposed by design, run vendor firmware you cannot inspect, and authenticate the request before your identity provider ever sees it.
The pattern repeats:
- ▸A vulnerability is published in a widely deployed edge appliance, often one allowing authentication bypass or code execution before login.
- ▸Proof of concept code circulates within days, sometimes hours, and mass scanning begins immediately.
- ▸Access brokers sweep first, harvesting footholds they will sell on rather than use themselves.
- ▸Ransomware crews buy the foothold weeks or months later, which is why the intrusion often lands long after the patch was available.
The CISA Known Exploited Vulnerabilities catalogue tells you which flaws have confirmed exploitation in the wild, a far better patching queue than raw severity scores. If a product you expose appears on that list, it is not a ticket for next sprint. It is tonight.
The trap is that these devices sit outside your normal patch process. Servers get patched by an agent, laptops by policy. The appliance in the rack gets patched when someone remembers, and the person who remembered left in 2023.
Legacy remote access is the second door
Remote desktop and old support tools exposed to the internet remain a reliable entry path, because they pair a login prompt anyone can reach with credentials that are weak, reused or shared. Add a service account whose password never expires and you have a permanent, unmonitored door into the network.
Hunt specifically for:
- ▸Remote desktop published directly, on the standard port or a "hidden" one. Port obscurity buys nothing against a scanner.
- ▸Old remote support and screen sharing agents installed for a vendor project years ago and never removed. Many use their own cloud relay, so your firewall never sees an inbound connection at all.
- ▸Management interfaces for hypervisors, backup software and storage arrays reachable from the general staff network.
- ▸Vendor accounts with standing access, shared passwords and no multifactor, created during an implementation that finished long ago.
Backup infrastructure deserves its own line: crews target it deliberately before they encrypt anything. If your backup console is reachable with a password alone from an ordinary workstation, your backups are not a recovery plan, they are part of the attack surface. Read CISA Stop Ransomware for the recovery side specifically.
Valid credentials often need no exploit at all
A large share of intrusions involve no vulnerability whatsoever. The attacker simply logs in. Credentials come from infostealer malware on a personal or unmanaged device, from credential stuffing against reused passwords, or from a phishing page that also captures the session cookie so the second factor never matters.
Session theft is the part most owners have not caught up with. An infostealer on an employee home machine does not only take saved passwords, it takes live browser session tokens. Replaying that token puts the attacker inside as that user, already authenticated, with no multifactor prompt firing, because the session was established long ago.
This is why the MFA conversation has moved on. SMS codes and push approvals can be phished or fatigued into approval. Phishing-resistant methods bind the credential to the real site, so a proxy phishing page cannot relay it, and the CISA guidance on implementing phishing-resistant MFA is the reference to hand your IT provider. Checking your domain against Have I Been Pwned shows which of your users are already in circulation.
The servers nobody owns
The most dangerous machine on your network is the one with no owner: the staging server from a project that shipped, the old intranet on an unsupported operating system, the marketing site someone spun up personally, the test database holding a copy of production data. Nobody patches them because nobody is responsible for them.
They are dangerous twice over. First, they usually run end of life software, so no patch exists at any price. Vendor timelines are public: the Microsoft product lifecycle covers Windows and server products, and PHP and Node.js publish their own end of life pages. Anything past its date is permanently vulnerable by definition.
Second, they sit on the same flat network as everything else. An attacker who lands on a forgotten staging box is not stuck in a corner, they are inside your trust boundary with a stable place to work from. The same neglect kills public websites, the subject of The WordPress Security Reality Check Every Business Owner Avoids.
What to inventory first, in this order
Do not start with a full asset inventory, you will never finish it. Start with what is reachable from the internet, because that is what gets found, then work inward. A useful first pass takes days rather than a quarter, and it will surprise you.
1. Everything with a public IP or DNS name. Reconcile your DNS zones, your cloud provider address list and your firewall inbound rules. The gaps are your problem set. 2. Every inbound firewall rule and its justification. Name the person who needs it and the system it serves. Any rule missing either is a deletion candidate. 3. Every remote access path, including vendor tools, cloud relays and agents installed on servers rather than published through the firewall. 4. Every account with administrative rights, especially service, shared and vendor accounts. 5. Every system whose vendor no longer ships patches, checked against lifecycle pages rather than memory. 6. Your backup infrastructure, treated as a crown jewel with its own access rules and credentials.
If the result does not fit on a few pages a director can read, you have produced a list of machines, not an inventory of risk. Our Small Business Website Security Checklist for 2026 applies the same discipline to public web assets.
What to shut down this month
Most initial access risk in a mid sized business can be removed in a few weeks with decisions rather than products. None of this needs a security operations centre or a six figure platform, and the unexciting items are the effective ones.
- ▸Delete inbound rules with no owner. If nobody claims it, close it. Whatever breaks gets documented for the first time.
- ▸Remove remote desktop from the internet entirely. Put it behind an authenticated broker, never directly exposed.
- ▸Patch anything on the exploited vulnerabilities catalogue immediately, with a standing rule granting those emergency change windows.
- ▸Turn on phishing-resistant multifactor for administrators first, then all staff, then vendor accounts.
- ▸Isolate or decommission end of life systems. If it cannot be replaced this quarter, give it its own segment with no outbound internet and no lateral reach.
- ▸Separate backup credentials completely from normal administrative accounts, then verify a restore actually works.
- ▸Kill dormant accounts, including former staff and finished vendor engagements.
You do not have to be unbreakable. You have to be more expensive than the next candidate the scanner found.
How to know it worked
Measure exposure, not activity. Four numbers tell the story: internet-reachable services with no named owner, the age of the oldest unpatched exploited vulnerability you run, the share of administrators on phishing-resistant MFA, and the days since your last verified restore.
Then keep watching. Put someone on the CISA cybersecurity advisories feed so a new appliance flaw reaches a human in your organisation the week it is published, not the month you get breached. Fold the inventory refresh into the support contract you already pay for, a good moment to read What Website Maintenance Should Actually Include and check whether any of it is covered.
If the honest answer is that your legacy systems cannot be patched, cannot be segmented and cannot be replaced, that is not a security finding. That is a modernisation decision deferred until the risk became someone else's to price.
How TuniCyberLabs helps
We map what you actually expose to the internet, rank it by how it gets exploited in the real world, and hand you a remediation plan sequenced by risk rather than vendor convenience. Where the fix is replacement rather than patching, we build and migrate the system, including the legacy applications everyone is afraid to touch. Our engineers are in Tunisia, the company is registered in Estonia, and we serve the EU and North Africa.
Want to see your own edge before somebody else does? Talk to us about an exposure review.