How Ransomware Gangs Exploit Known Vulnerabilities

The Ransomware Playbook

Ransomware is a business. The groups behind it, LockBit, Cl0p, BlackCat/ALPHV, Play, and their successors, operate with the discipline of a software company. They have developers, affiliates, support channels, and revenue targets.

And their favorite entry point? Known, unpatched vulnerabilities.

Why Known CVEs, Not Zero-Days

Zero-day exploits are valuable. A working zero-day for a widely-deployed product can sell for $500K–$2M on the legitimate market (and more on the black market). Ransomware groups don't burn those on every target.

Instead, they exploit the patch gap, the window between a vulnerability being disclosed and organizations actually applying the fix. For many companies, that window is 30–90 days. For some, it's never.

When a critical CVE drops for a VPN appliance, firewall, or remote access tool, ransomware groups reverse-engineer the patch within days and begin scanning the entire internet for vulnerable instances. They don't need to be first. They just need to find one organization that hasn't patched.

The Most-Exploited Vulnerability Classes

Ransomware operators consistently target the same types of flaws:

1. Edge Device Vulnerabilities

VPNs, firewalls, and remote access gateways sit at the boundary of your network and are reachable from the internet. A single vulnerability here gives attackers direct access to the internal network.

Frequently targeted products include Fortinet FortiGate, Citrix NetScaler, Ivanti Connect Secure, Palo Alto GlobalProtect, and Cisco ASA. Check the KEV catalog, these vendors appear repeatedly.

2. Remote Code Execution (RCE)

Any vulnerability that allows executing arbitrary code remotely is gold for ransomware. The attacker goes from "external scanner" to "code running inside your network" in a single step.

3. Authentication Bypass

Vulnerabilities that let attackers skip login screens are nearly as valuable as RCE. Once past authentication, they use legitimate tools (RDP, PowerShell, WMI) to move laterally, a technique that blends in with normal admin activity.

4. File Transfer Tool Exploits

MOVEit, GoAnywhere, Accellion FTA, secure file transfer tools have been devastating attack vectors. Cl0p alone exfiltrated data from hundreds of organizations via the MOVEit zero-day in 2023. These tools often hold sensitive data and have broad network access.

The Kill Chain

A typical ransomware attack using a known CVE follows this pattern:

Step 1: Scanning, Automated tools (Shodan, Censys, custom scanners) identify internet-facing systems running vulnerable software versions. This happens at internet scale within days of a CVE disclosure.

Step 2: Initial Access, The attacker exploits the vulnerability to gain a foothold. For VPN/firewall bugs, this often means obtaining valid credentials or a reverse shell.

Step 3: Persistence, Deploy a backdoor, create rogue accounts, or install remote access tooling (Cobalt Strike, Sliver, AnyDesk). This ensures access survives even if the original vulnerability is patched.

Step 4: Reconnaissance, Map the Active Directory environment, identify high-value targets (domain controllers, file servers, backup systems), and enumerate user accounts.

Step 5: Privilege Escalation, Move from the initial compromised account to domain admin. Tools like Mimikatz, Rubeus, or simply harvesting cached credentials from compromised hosts.

Step 6: Data Exfiltration, Before encrypting anything, modern ransomware groups steal data. This enables double extortion: "pay to decrypt AND pay to prevent us from publishing your data."

Step 7: Encryption, Deploy the ransomware payload across the network. Targets include file servers, databases, backup systems, and virtual machine hosts. Many groups specifically target VMware ESXi to encrypt entire virtual environments at once.

Step 8: Ransom Demand, The victim discovers encrypted systems and a ransom note. Demands typically range from $100K to $50M depending on the organization's perceived ability to pay.

Breaking the Chain

The most cost-effective intervention point is Step 1–2: preventing initial access. And the most straightforward way to do that is patching known vulnerabilities, particularly in internet-facing systems.

Specific actions:

• Patch edge devices within 7 days of critical CVE disclosure. VPNs, firewalls, and remote access tools should be your fastest patch cycle.
• Monitor the KEV catalog for vulnerabilities in your stack. If CISA says it's being exploited, assume ransomware groups are using it.
• Inventory your internet-facing attack surface. You can't patch what you don't know about. Shadow IT, forgotten test servers, and legacy systems are common entry points.
• Disable unnecessary services. If you don't need RDP exposed to the internet, don't expose it. If your file transfer tool has a web portal, restrict access to known IPs.
• Assume breach for backup strategy. Immutable, offline, or air-gapped backups are your last line of defense. If ransomware hits, clean backups mean you can recover without paying.

The Economics

The average cost of a data breach reached $4.88M in 2024 (IBM Cost of a Data Breach Report). Ransomware incidents often exceed that when you add ransom payments, business interruption, and reputational damage. Patching a known vulnerability costs a few hours of engineering time.

The math is not complicated. Patch your edge devices.