Ransomware: why VPNs and firewalls are the main way in

Ransomware is an attack that locks an organisation out of its systems, encrypts or copies its data, then demands a ransom. In autumn 2026, several of the most serious campaigns did not start with a booby-trapped email or an infected laptop: they came in through VPNs, firewalls and remote access gateways exposed to the internet. Here is why these devices have become the preferred way in, and what a CISO can do right now.

According to the French government platform Cybermalveillance.gouv.fr, ransomware means compromising a device or an information system to block access to it, encrypt or copy its data, then demand payment in exchange for giving it back. Attackers no longer just encrypt: they steal the data first and threaten to publish it. This is double extortion, which makes backups necessary but no longer sufficient.

In France, ANSSI, the national cybersecurity agency, was made aware of 128 ransomware attacks in 2025, compared with 141 in 2024. The drop is misleading: these figures only count cases reported to the agency, and its 2025 cyber threat overview also records 460 possible data leak events. At European level, the ENISA Threat Landscape 2026 report ranks ransomware as the incident type with the most immediate impact: it accounts for 40% of the cybercrime events analysed in 2025.

The initial access broker → affiliate model

A ransomware attack is rarely the work of a single crew. The market has specialised. Initial access brokers take care of getting into the network: they exploit a flaw or use stolen credentials, check that the access works, then resell it. Affiliates buy it, move through the network, steal data and trigger encryption with ransomware leased from a criminal group.

The FBI and US Secret Service advisory of 6 October 2026 describes exactly this chain: the FortiBleed operation culminated in selling access to compromised networks, used as an “initial entry point” by INC/Lynx and Payload ransomware affiliates.

Edge devices are the appliances sitting on the boundary between the internet and the internal network: SSL VPNs, firewalls, remote access gateways, email relays. They combine three traits that make them an ideal target:

• they are exposed by design: anyone can reach and scan them, at any time;
• they open onto the internal network and are often connected to the account directory, giving the attacker credentials from the start;
• they are less monitored than laptops and servers, even though a critical vulnerability can be exploited on them without authentication, sometimes in the default configuration.

ANSSI sums it up in its latest overview: edge devices “remain a highly prized target”. The agency also sees vulnerabilities exploited just hours after disclosure, especially on internet-facing devices. At European level, ENISA notes that exploiting known flaws or zero-day flaws “remains a prevalent intrusion vector”: when the vector of unauthorised access could be identified, it was a vulnerability in 60% of cases. And the volume is not falling: more than 48,000 new CVEs were published in 2025, 22% more than in 2024.

Citrix NetScaler: a zero-day flaw turned mass attack

CVE-2026-88771 and CVE-2026-88772 allow remote code execution on NetScaler ADC and Gateway appliances, without authentication. CERT-FR (alert CERTFR-2026-ALE-011) states that exploitation “began before patches were available” and that all devices are vulnerable in their default configuration. According to Help Net Security, Mandiant traces the first attacks, attributed to suspected state actors, back to early September. The release of a proof of concept then triggered a wave of opportunistic attacks.

Exposure is massive: Censys counts about 42,000 devices visible on the Internet, 13% of them in Germany. And as of 29 September, fewer than 10% of exposed hosts were patched according to researcher Kevin Beaumont, who was already tracking more than 100 victim organisations.

FortiBleed: access resold to ransomware affiliates

FortiBleed is not a flaw but a credential theft campaign. According to the FBI and the Secret Service, attackers scanned FortiGate SSL VPN portals, tried passwords from leaks and infostealer logs, dumped user databases, then cracked offline the passwords stored with a legacy SHA-256 hashing format. The toll, verified by SOCRadar: more than 86,644 compromised devices in 194 countries, and administrators sometimes locked out of their own firewalls.

FortiMail and SonicWall: when patching is not enough

On 1 October, Fortinet confirmed exploitation of CVE-2026-104286 (CVSS score 9.8) in its FortiMail email gateway: an unauthenticated attacker can write arbitrary files to the device. CISA added it to its KEV catalogue the same day. A month earlier, CERT-FR had warned of two actively exploited flaws in SonicWall SMA 1000 gateways (CERTFR-2026-ALE-009), with a clear instruction: applying the patches “is not sufficient”. It recommends reinstalling the system, changing all passwords and resetting TOTP secrets.

When the security tool becomes the way in

The case of the cryptocurrency exchange Bitget is not ransomware, but it illustrates the same logic. According to The Hacker News, attackers exploited a zero-day flaw in third-party security appliances, planted a web shell on them, then pivoted to the wallet servers: $387.5 million stolen. The devices meant to protect the perimeter are part of the perimeter to protect.

1. Inventory what is exposed. You cannot patch a device you do not know exists. List every VPN, firewall, gateway and email relay reachable from the internet, with its version, its owner and whether its admin interface is exposed. Cross-check with an external scan: that is what attackers see.

2. Prioritise patches using KEV and CERT-FR. Not all CVEs are equal. A flaw listed in the CISA KEV catalogue or covered by a CERT-FR alert is being exploited: it jumps the queue, with a deadline counted in hours for edge devices.

3. Harden access. The FBI recommends phishing-resistant MFA (FIDO2 security keys, smart cards) on remote access and administration, removing administration from the internet, ending active sessions and renewing passwords and API keys after an incident.

4. Hunt for compromise before and after patching. A patch shuts the door but does not evict an intruder who is already inside. CISA advises checking for indicators of compromise before patching and preserving evidence, as reported by BleepingComputer. Citrix itself acknowledges that the indicators of compromise it provides may miss actual compromises.

5. Prepare for the crisis. Offline backups and tested restores, a crisis plan known to senior management, contact details for your incident response provider. In the event of an attack, Cybermalveillance.gouv.fr advises disconnecting from the internet without switching machines off, not paying the ransom, filing a complaint and notifying the CNIL within 72 hours if personal data is affected.

These measures make the most sense when they answer an explicit risk scenario approved by management. ANSSI's EBIOS Risk Manager method is well suited to this, especially its workshops 3 and 4:

• Workshop 3 (strategic scenarios): map the ecosystem. The firewall vendor, the managed service provider running the VPN or the supplier of a security tool are stakeholders whose threat level must be assessed. The “access broker → affiliate” path becomes a strategic scenario.
• Workshop 4 (operational scenarios): build the attack graph, from exploiting the VPN or reusing credentials through to data theft and encryption. Assess its likelihood with real data: whether the version is in KEV, CERT-FR alerts, share of devices patched.

Workshop 5 then turns the five priorities above into a treatment plan, with owners and deadlines. Our analysis of the CNIL fine against a hospital and our article on data breaches in the French State show what the lack of MFA on remote access costs.

A risk analysis is only valuable if it stays alive. With Phinasoft's risk analysis module, an EBIOS RM software labelled by ANSSI, the “ransomware through an edge device” scenario is built workshop by workshop and updated when a new alert comes out. The scenario is linked to the treatment plan, which can then be followed through compliance campaigns. And because the managed service provider or the vendor of a device is part of the attack surface, vendor risk management lets you check their own patching and authentication practices.