Ransomware operators break into organisations most often through software flaws that already have a fix. Microsoft's Security Response Center, the US Cybersecurity and Infrastructure Security Agency, and the company's own Digital Defense Report have each identified poor patch management as a primary factor enabling intrusions. The most famous example is WannaCry in May 2017, which used the EternalBlue exploit against an SMBv1 flaw, CVE-2017-0144. A patch had been available since March of that year. Two months later the ransomware encrypted hundreds of thousands of systems worldwide.
The pattern has not changed. Adversaries scan for internet-facing machines where a known weakness remains unpatched, gain remote code execution, deploy a payload that steals credentials, move laterally across the environment, and finally encrypt critical data. Guidance from Redmond addresses each step of that chain. What follows explains how the attack works, which exposures are most commonly targeted, and what defenders should do before, during and after a ransomware incident that starts with an unpatched system.
How ransomware groups find and exploit unpatched systems
Ransomware operators do not develop novel zero-day exploits for each target. They use publicly available proof-of-concept code for flaws that the vendor has already disclosed and patched. The Microsoft Security Response Center classifies exposures using the Common Vulnerability Scoring System (CVSS), with critical flaws scoring 9.0 to 10.0. Remote code execution bugs in internet-facing workloads are the most dangerous because they let an intruder run arbitrary code on the target machine without authentication.
Threat actors scan the internet for servers running outdated versions of Exchange, Remote Desktop Services, or VPN appliances. When they find one, they exploit the known gap to install a web shell, a small script that gives them persistent remote access. From that foothold they dump credentials from memory or from the Local Security Authority Subsystem Service (LSASS), using tools like Mimikatz. With valid credentials they move laterally to domain controllers, backup servers, and file shares. Only then do they deploy the ransomware that encrypts files across the environment.
Why unpatched VPN appliances and remote desktop gateways are prime targets
VPN gateways and Remote Desktop Services are exposed to the internet by design. When a critical bug is disclosed in a VPN appliance, organisations that delay patching leave a direct path from the public internet to the internal network. The company's guidance identifies internet-facing systems with missing patches as the starting point for many ransomware attacks. The same applies to Remote Desktop Services: if the offering is exposed without network-level authentication and the underlying system is unpatched, an adversary can brute-force credentials or exploit a remote code execution flaw to gain access.
The specific vulnerability types most commonly targeted
Not all weaknesses are equally useful to ransomware operators. The most targeted are remote code execution flaws in components that listen on the network. These let an intruder take control of a machine without any user interaction. Examples include buffer overflows in SMBv1, deserialisation bugs in Exchange, and heap overflows in HTTP protocol stacks. Microsoft assigns a CVSS score of 9.0 or higher when exploitation is trivial and the impact is total compromise.
Privilege escalation bugs are the second category. After gaining initial access as a low-privilege user, the adversary needs to become SYSTEM or domain administrator. Local privilege escalation flaws in the Windows kernel or in processes running as SYSTEM give them that elevation. The guidance on reducing the attack surface includes removing unnecessary privileges from user accounts and disabling legacy protocols such as SMBv1 and NTLMv1, which are frequently used in credential relay attacks.
Microsoft Defender for Endpoint includes attack surface reduction rules that block behaviours common to ransomware, such as unauthorised encryption, process injection, and credential theft. These rules do not replace patching, but they can stop an attack that exploits a flaw for which a fix exists but has not yet been applied.
Core mitigation guidance: patch management, credential hygiene, and attack surface reduction
Published guidance on preventing ransomware attacks recommends applying security patches within a risk-based timeframe. Critical updates should be applied as soon as possible. Organisations should inventory their internet-facing systems and ensure that no known critical gap remains unpatched. The Microsoft Digital Defense Report has repeatedly identified poor patch management as a primary factor enabling intrusions.
Credential hygiene is the second pillar. The recommendation is to enforce multi-factor authentication (MFA) on all accounts, especially for administrators and for remote access. The principle of least privilege should limit what each account can do. If an adversary compromises an unpatched system but can only execute code as a limited user, the damage is contained. Network segmentation also limits lateral movement. If the VPN server is on a separate segment with no direct route to domain controllers, the intruder cannot pivot easily.
Attack surface reduction includes disabling legacy protocols. SMBv1 should be disabled on all systems. NTLMv1 should be replaced with Kerberos or at least NTLMv2. Internet-facing offerings should be minimised. If Remote Desktop Services must be exposed, they should use network-level authentication and be protected by a VPN or a Remote Desktop Gateway.
Automated ransomware delivery versus human-operated campaigns
Two broad patterns of ransomware attack require different defences. Automated delivery uses self-spreading worms or email-based malware that encrypts files indiscriminately. WannaCry was an example: once it infected one machine, it scanned the local network for other systems with the SMBv1 flaw and spread without human intervention. The defence against automated ransomware is primarily patching and network segmentation, because the attack does not adapt to obstacles.
Human-operated campaigns are more dangerous. A human operator sits at the keyboard, uses the initial foothold to explore the network, steals credentials, disables backups, and chooses the moment to deploy encryption. These campaigns target high-value organisations and demand larger ransoms. Defence requires more than patching. It requires monitoring for unusual credential use, restricting administrative access, and maintaining offline backups that the adversary cannot reach. The guidance for human-operated ransomware emphasises that patching alone is insufficient if an intruder can use a single unpatched system to gain a foothold and then move laterally using stolen credentials.
The role of legacy protocols and internet-exposed services
Legacy protocols such as SMBv1 and NTLMv1 were designed for environments that did not face modern threats. SMBv1 has no authentication integrity checks, which is why EternalBlue could send a malformed packet that gave the intruder code execution. Microsoft has deprecated SMBv1 and recommends disabling it on all versions of Windows. NTLMv1 uses a weak hash that can be cracked or relayed. Adversaries who gain access to an unpatched system can extract NTLM hashes and use them to authenticate to other systems without knowing the password.
Internet-exposed offerings are the entry point. The company's guidance states that many ransomware attacks begin with exploitation of internet-facing systems where patches are missing for known flaws. Remote Desktop Protocol (RDP) exposed directly to the internet is a common vector. Threat actors brute-force weak passwords or exploit unpatched RDP bugs. VPN appliances from multiple vendors have had critical gaps that were exploited in ransomware campaigns before organisations applied the fixes. The common thread is that the weakness was known and a patch existed.
Incident response and recovery after a ransomware attack via an unpatched system
If a ransomware attack succeeds through an unpatched system, the recommended approach is a structured incident response process. The first step is to contain the attack by disconnecting affected machines from the network. Do not power them off, because forensic data in memory will be lost. Preserve logs from domain controllers, firewalls, and the compromised system. Identify the initial access vector: which gap was exploited and whether the patch was available.
Recovery should come from offline backups that were not reachable from the compromised network. The advice is clear: do not pay the ransom. There is no guarantee that the adversary will provide a working decryption key, and payment funds future attacks. After recovery, the organisation should apply the missing patch, reset all credentials, and review the attack surface. The shared responsibility model applies: Microsoft patches its software, but the organisation is responsible for deploying those patches and for configuring the environment to limit the impact of a missed patch.
The guidance also recommends using tools like Microsoft Defender for Endpoint to investigate the scope of the compromise and to identify any persistence mechanisms the intruder left behind. The goal is not only to recover but to ensure the same weakness cannot be used again.
Key facts
- WannaCry outbreak: May 2017, using EternalBlue exploit against CVE-2017-0144, an SMBv1 vulnerability patched in March 2017
- CVSS critical range: 9.0 to 10.0, as classified by Microsoft Security Response Center
- Primary enabler of ransomware intrusions: Poor patch management, per the Microsoft Digital Defense Report
- Joint alerts: CISA and Microsoft have jointly issued alerts on ransomware actors exploiting unpatched systems
- Top mitigation: Apply critical security patches as soon as possible within a risk-based timeframe
- Additional defences: Enforce MFA, implement least privilege, disable SMBv1, segment networks, use attack surface reduction rules in Microsoft Defender for Endpoint
Frequently asked questions
What is the most common initial access vector for ransomware?
Exploitation of unpatched vulnerabilities in internet-facing systems. Guidance from Microsoft and the Digital Defense Report have repeatedly identified missing patches as a primary enabler.
How does Microsoft classify the severity of vulnerabilities?
The Microsoft Security Response Center uses the Common Vulnerability Scoring System (CVSS). Critical vulnerabilities score 9.0 to 10.0.
Should I pay the ransom if my systems are encrypted?
The recommendation is against paying. There is no guarantee that the adversary will provide a working decryption key, and payment funds future attacks.
What is the difference between automated ransomware and human-operated ransomware?
Automated ransomware spreads on its own using worms or email. Human-operated ransomware involves an adversary who actively explores the environment, steals credentials, and chooses when to deploy encryption. Human-operated campaigns require more than patching to defend against.
