Ransomware Initial Access Vectors: What 25 CISA #StopRansomware Advisories Show

How do ransomware groups get in?

Across the 22 advisories that publish an initial access technique list, five techniques account for nearly every entry. Shares are the percentage of those 22 advisories that list each technique; one advisory can list several.

The matrix: every advisory, every technique

Each row is one #StopRansomware advisory, newest first. A filled dot means CISA lists the technique under Initial Access for that group. Advisory IDs link to the original on cisa.gov.

Percentages in the header use the 22 advisories with an initial access technique list as the base. 3 advisories do not publish one.

Edge devices are the common thread

In 20 of 22 advisories (91%), initial access included either an exploit of a public-facing application (T1190) or abuse of an external remote service such as a VPN or RDP gateway (T1133). Since January 2025, 3 of the 4 new advisories with an initial access list name T1190. Several advisories are built around a single product flaw: CL0P’s MOVEit campaign (CVE-2023-34362) and LockBit 3.0 affiliates exploiting Citrix Bleed (CVE-2023-4966).

Valid accounts (T1078) appear in 10 advisories. Of those, 7 also list external remote services, the pattern of a stolen or purchased login used on an exposed VPN or remote desktop gateway.

What this means for MSPs and MSSPs

For a managed provider, the matrix is a patching and exposure priority list. Internet-facing appliances, file transfer servers, and remote access gateways belong at the top of the vulnerability queue, ahead of internal endpoints. Phishing still appears in 59% of advisories, so email security and user reporting remain necessary, but they cover less than two thirds of the entry routes documented here.

Frequently asked questions

What is the most common ransomware initial access vector?

Exploitation of public-facing applications (MITRE ATT&CK T1190). It appears in the initial access section of 16 of the 22 CISA #StopRansomware advisories that list initial access techniques (73%).

How often is phishing the way ransomware gets in?

Phishing (T1566) is listed in 13 of 22 advisories (59%). It is the second most common technique, but most advisories list more than one entry route.

Do ransomware groups use stolen credentials?

Valid accounts (T1078) appear in 10 of 22 advisories (45%), and external remote services such as VPN and RDP (T1133) in 12 (55%). The two often work together: a stolen or bought login is used on an exposed remote access service.

How many #StopRansomware advisories has CISA published?

We counted 25 unique #StopRansomware advisories from 2022-06-30 (MedusaLocker) to 2026-08-10 (Gunra Ransomware), as listed on cisa.gov in October 2026.

What should an MSP patch first to reduce ransomware risk?

The data points at internet-facing systems. In 20 of 22 advisories (91%), initial access included either a public-facing application exploit or an external remote service. That makes VPNs, firewalls, file transfer tools, and remote access gateways the first place to look, alongside MFA on every remote login.

Methodology

References

1. CISA, #StopRansomware official alerts and statements. Accessed October 2026.
2. MITRE ATT&CK, Initial Access (TA0001). Accessed October 2026.
3. CISA, AA26-222A: #StopRansomware: Gunra Ransomware. Accessed October 2026.