Glossary

S=1:500 plain definitionS=1:5 engineer's note29 terms

Active Directory (AD)

S=1:500The Windows system that manages an organization's users, passwords and computers.

S=1:5VPN appliances often check logins against AD with a service account stored on the appliance. An intruder who controls AD controls every Windows machine that trusts it.

Credential

S=1:500Anything that proves identity to a system, such as a password, key, certificate or token.

S=1:5Credentials taken through a flaw keep working after the flaw is patched. Lists of VPN credentials taken through CVE-2018-13379 were posted publicly, and the Handa Hospital report found the hospital's VPN credentials in one. After a compromise, reset every credential the appliance stored or handled.

CVE

S=1:500An ID number assigned to a publicly known security flaw.

S=1:5A CVE ID only names the flaw. It does not say whether the flaw is being exploited; KEV status and internet exposure answer that.

CVSS

S=1:500A score from 0 to 10 for how severe a flaw is.

S=1:5Severity is not risk. CVE-2023-20269 in Cisco ASA scores 5.0, and CISA's catalog records it as used in ransomware campaigns.Source: CISA

Domain admin

S=1:500An account that can control every Windows machine in an Active Directory domain.

S=1:5The usual goal of privilege escalation. Intruders get it by dumping credentials from memory (ATT&CK T1003) or by reusing a local administrator password shared across machines, then use it to push ransomware to every machine at once.

Double extortion

S=1:500Copying data out and threatening to publish it, in addition to encrypting it.

S=1:5Backups recover from encryption but do nothing about the leak. Akira and LockBit affiliates copy data out before they encrypt.

Dwell time

S=1:500How long an intruder is inside before being found.

S=1:5Ransomware ends its own dwell time, because encryption announces the intrusion. An intruder who stays on an edge device with little logging and never encrypts can remain unnoticed far longer.

Edge device

S=1:500A device on the border between an organization's network and the internet.

S=1:5Firewalls, VPN gateways, routers and load balancers. Most cannot run EDR and keep few logs, so an intrusion on them is hard to see.

EDR (endpoint detection and response)

S=1:500Security software that watches computers for attacker behavior and can stop it.

S=1:5It usually cannot be installed on a VPN appliance. Ransomware affiliates routinely try to uninstall or disable it before encrypting, sometimes by loading a vulnerable driver (BYOVD).

End of life (EOL)

S=1:500The point after which a vendor stops releasing fixes for a product.

S=1:5An end-of-life appliance keeps working, but its next flaw will never be fixed. CISA, the FBI and the UK NCSC published a joint fact sheet in 2026 urging organizations to replace end-of-support edge devices.

Immutable backup

S=1:500A backup that cannot be changed or deleted for a set period, even by an administrator.

S=1:5Intruders with administrator rights delete or encrypt every backup they can reach before they encrypt anything else. An immutable or offline copy survives that and makes recovery possible, though it does nothing about data already copied out.

Indicator of compromise (IoC)

S=1:500A trace that suggests a system has been breached, such as a file, IP address or log entry.

S=1:5Advisories publish IoCs so defenders can search their own systems for them. Finding none does not prove a device is clean: attackers change their tools, and appliance logs are often missing or wiped.

Integrity checker

S=1:500A vendor tool that checks whether an appliance's system files have been altered.

S=1:5It compares files against known hashes, so an attacker who controls the appliance can make it pass. CISA reported cases where Ivanti's Integrity Checker Tool failed to detect compromise (AA24-060B); run it alongside independent monitoring.

KEV

S=1:500CISA's list of flaws known to be exploited in real attacks.

S=1:5The clearest single signal that a flaw needs fixing now. Each entry carries a due date for US federal agencies and a knownRansomwareCampaignUse field that records whether ransomware groups are known to use it.Source: CISA

Lateral movement

S=1:500Moving from one compromised computer to others inside the network.

S=1:5Usually done over RDP, SMB or remote service execution with stolen or shared credentials. At Handa Hospital the built-in Administrator password was the same on every PC, which made it easy.

MFA (multi-factor authentication)

S=1:500Logging in with a second proof of identity in addition to a password.

S=1:5One-time codes and push prompts can be phished or bypassed; Arctic Wolf reported logins to OTP-protected SonicWall VPN accounts during the 2025 Akira intrusions. Phishing-resistant methods such as FIDO2 keys or certificates hold up better.

MITRE ATT&CK

S=1:500MITRE's public catalog of attacker techniques, each with an ID.

S=1:5IDs such as T1190 (Exploit Public-Facing Application) and T1133 (External Remote Services) name each step of an intrusion, so advisories, logs and detection rules can refer to the same thing.

N-day

S=1:500A known flaw that has a fix, on a device where the fix has not been applied.

S=1:5The investigation reports on Handa Hospital (2021) and Osaka General Medical Center (2022) both name CVE-2018-13379 as the way in, a flaw Fortinet had fixed in 2019.

Patch

S=1:500A vendor update that fixes a flaw.

S=1:5A patch closes the flaw. An intruder who is already inside stays, and credentials they stole stay valid, so a patch goes together with credential resets and a compromise check.

Pre-authentication

S=1:500Reachable or exploitable before anyone logs in.

S=1:5A pre-authentication remote code execution flaw in a VPN portal needs no credentials, so passwords and MFA do not stop it. On an internet-facing appliance it is the most severe class of flaw.

Ransomware

S=1:500Malware that encrypts data and demands payment to unlock it.

S=1:5Today it is operated by people at a keyboard, often affiliates who rent the malware from a ransomware-as-a-service (RaaS) operator. Encryption is the last step of an intrusion that began hours or days earlier.

RDP (Remote Desktop Protocol)

S=1:500Microsoft's protocol for operating a Windows computer remotely.

S=1:5Inside a network it is a common tool for lateral movement. Exposed to the internet it is an entry point of its own, and NPA's victim survey lists it as the second most common route after VPN appliances.Source: National Police Agency

Session token

S=1:500The value that keeps a user logged in after they sign in.

S=1:5A stolen token skips the password and MFA. CitrixBleed (CVE-2023-4966) leaked tokens from appliance memory, so after a compromise every session has to be revoked as well as every password reset.

SSL-VPN

S=1:500A VPN that users reach through an HTTPS web portal.

S=1:5The portal is a large web application on the appliance that anyone can reach before logging in. Many of the VPN flaws used by ransomware are in this part, including CVE-2018-13379 and CVE-2024-21762 in Fortinet FortiOS.

VPN

S=1:500An encrypted connection that lets staff use the office network from outside.

S=1:5The VPN appliance that accepts these connections can be reached from anywhere on the internet, and passing it puts the user on the internal network. NPA's survey of ransomware victims in Japan names it as the most common entry route.Source: National Police Agency

VPN appliance

S=1:500The device or virtual machine at the network edge that accepts VPN connections.

S=1:5Usually a firewall or gateway product such as FortiGate, Ivanti Connect Secure, Palo Alto Networks GlobalProtect, Cisco ASA or SonicWall. It runs vendor firmware the owner cannot inspect, and it often does not keep logs long enough to investigate an intrusion.

Web shell

S=1:500A small script planted on a web server that lets an attacker run commands through ordinary web requests.

S=1:5On a VPN appliance it sits inside the portal's web application and can survive patching. CISA found web shells on Ivanti systems that the vendor's integrity checker had reported as clean.

Zero-day

S=1:500A flaw attackers use before a fix exists.

S=1:5No patch helps until the vendor ships one. CVE-2025-0282 in Ivanti Connect Secure was exploited as a zero-day; until a fix arrives, the only defenses are less exposure and closer monitoring.

ZTNA (zero trust network access)

S=1:500Access to specific applications only, after checking the user and device each time.

S=1:5A stolen credential reaches less than it would through a network-level VPN. ZTNA gateways are still edge software with their own flaws: CVE-2025-0282 also affected Ivanti Neurons for ZTA gateways.