Ransomware Evolution: VPN and Firewall Attacks on the Rise

At a glance:

• Ransomware gangs are using brute-force attacks against VPNs and firewalls.
• Multi-factor authentication (MFA) is one of the best defenses.
• Keeping security devices patched and configured correctly is just as important.
• Training users and IT staff closes many of the gaps attackers exploit.

Why VPNs and firewalls are now targets

Ransomware crews have moved past their usual entry points. VPNs and firewalls are now favorite targets. These devices are the gateways into an organization’s network, so a single successful login can open everything behind them, from file servers to backups.

The Rise of Brute-Force Attacks

Ransomware attacks used to start mainly with phishing emails and exploit kits. That has changed. Attackers now also run brute-force attacks against VPNs and firewalls, trying huge numbers of username and password combinations, often from many IP addresses at once, until one works; with so many people working remotely, these devices sit on the front line of most organizations’ defenses.

Security researchers see the change as a sign that attackers are adapting to better email filtering and endpoint protection by going after the network edge instead.

Importance of Multi-Factor Authentication

Multi-Factor Authentication (MFA) is the most effective answer. It adds a second check. Even if attackers guess or steal a VPN password, they still cannot log in without the second factor.

Keeping Security Protocols Updated

Patching matters as much as MFA. Security agencies keep warning that unpatched VPN and firewall software is one of the most common ways in. Regular audits catch weak configurations, default accounts and exposed management interfaces before attackers find them.

Owning a firewall or VPN is not enough. Admins have to keep the firmware current, lock out repeated failed logins and watch the logs for signs of password spraying.

Further Education and Awareness

Technology is only half the defense. Organizations need training programs that teach IT staff and ordinary users how attacks work and how to keep accounts secure. People slip up. Good training reduces how often.

Regular training and simulation exercises help staff spot phishing attempts and understand why strong, unique passwords matter.

What organizations should do first

Attackers keep refining their methods. Defenses have to keep up.

The shift to VPN and firewall targets calls for a layered response. Turn on MFA for every remote login, patch edge devices quickly and train staff. Organizations that do those three things will block most of these attacks.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.