The door was the VPN
日本語

Sources and method

Every document this site cites, with a link and the page or sheet behind each figure: NPA ransomware statistics, investigation reports, CISA advisories.

Each number was checked against its source

How each kind of material was read and used
MaterialHow it was readRule
NPA ransomware statisticsRead cell by cell from the National Police Agency's own statistical workbooks (.xlsx). Each figure names the sheet it came from, for example 統計編P124. The PDFs from 2024 on were too large to open, so their page numbers are taken from the sheet names. The 2022 and 2023 Japanese PDFs and the 2025 English PDF were opened and their pages confirmed.Counts are NPA's own. Percentages are computed from those counts and checked against the shares NPA prints.
CISA KEV catalogThe JSON feed at catalogVersion 2026.10.23 (released 2026-10-23), taken from CISA's official GitHub repository cisagov/kev-data. The vendorProject, product and knownRansomwareCampaignUse fields were checked with jq.CISA can change knownRansomwareCampaignUse from Unknown to Known later. Values are as of that version.
IncidentsOnly an organization's own statements or an official investigation report, by an expert panel, an investigation committee or a government body.Where an organization says only “network equipment”, the site says so and does not guess the product.
Minato Precision Co., Ltd.A fictional company with 280 staff, a head office and a factory, used to place the real findings on one floor plan.Every figure that shows it is labelled “Composite scenario, fictional company”.
UNVERIFIEDThe research notes mark anything that could not be tied to a primary source as UNVERIFIED.Items marked UNVERIFIED are left out of this site.

Sources by publisher

Every number on the other pages links to one of the documents below. They are grouped by publisher and listed oldest first. Titles are copied exactly as published, in their original language. 80 documents.

Anabuki Kosan Inc.

TitlePublishedPage or sheet
情報流出に関するお知らせとお詫び（ランサムウェア被害発生のお知らせ（第４報））case-anabuki-4thpp.1–2

Arctic Wolf

TitlePublishedPage or sheet
Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Lessarcticwolf-akira-2025—

Asahi Group Holdings

TitlePublishedPage or sheet
サイバー攻撃による情報漏えいに関する調査結果と今後の対応についてcase-asahi-2025-11-27—
サイバー攻撃被害の再発防止策とガバナンス体制の強化についてcase-asahi-2026-02-18—

ASKUL Corporation

TitlePublishedPage or sheet
ランサムウェア攻撃の影響調査結果および安全性強化に向けた取り組みのご報告（ランサムウェア攻撃によるシステム障害関連・第 13 報）case-askul-13thPDF pp.1–4, 6

BankInfoSecurity

TitlePublishedPage or sheet
Colonial CEO at Senate Hearing Details Ransomware Attackcase-colonial-bis—

BleepingComputer

TitlePublishedPage or sheet
CISA tags Citrix Bleed 2 as exploited, gives agencies a day to patchdoors-bleeping-citrixbleed2—

Canadian Centre for Cyber Security

TitlePublishedPage or sheet
Security considerations for edge devices (ITSM.80.101)cccs-itsm-80-101ITSM.80.101

CISA

TitlePublishedPage or sheet
Continued Threat Actor Exploitation Post Pulse Secure VPN Patchingdoors-cisa-aa20-107aAA20-107A
ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilitiescase-cisa-ed-24-01Supplemental Direction V2
Chemical Security Assessment Tool (CSAT) Ivanti Notificationcase-cisa-csat—
ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devicesdoors-cisa-ed-25-03Background; Background; V1 update 2026-04-23
BOD 26-04: Prioritizing Security Updates Based on Riskcisa-bod-26-04—
Known Exploited Vulnerabilities Catalogcisa-kevcatalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories

CISA and FBI

TitlePublishedPage or sheet
Secure by Design Alert: Eliminating Buffer Overflow Vulnerabilitiesdoors-cisa-bo-alertp.1

CISA and partners

TitlePublishedPage or sheet
Understanding Ransomware Threat Actors: LockBitcisa-aa23-165aAA23-165A
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gatewayscisa-aa24-060bAA24-060B

CISA, FBI and NCSC-UK

TitlePublishedPage or sheet
Reducing the Attack Surface for End-of-Support Edge Devicescisa-eos-edge-2026p.1; pp.1–2

CISA, FBI and partners

TitlePublishedPage or sheet
#StopRansomware: Akira Ransomwarecisa-aa24-109aAA24-109A

CISA, FBI, MS-ISAC, ASD's ACSC

TitlePublishedPage or sheet
#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerabilitycase-cisa-aa23-325aAA23-325A

Cisco PSIRT

TitlePublishedPage or sheet
Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software VPN Web Server Remote Code Execution Vulnerabilitych5-cisco-webvpncisco-sa-asaftd-webvpn-z5xP8EUB

CVE Program

TitlePublishedPage or sheet
CVE-2025-0282cve-2025-0282Description

Cybersecurity Dive

TitlePublishedPage or sheet
CISA attacked in Ivanti vulnerabilities exploit rushcase-cisa-dive—

Fortinet PSIRT

TitlePublishedPage or sheet
Malicious Actor Discloses FortiGate SSL-VPN Credentialsdoors-fortinet-87000—
Heap-based buffer overflow in sslvpndch5-fg-ir-22-398FG-IR-22-398, Indicators of Compromise
Analysis of Threat Actor Activityfortinet-psirt-2025-04—
SSL-VPN Symlink Persistence Patch Bypassdoors-fortinet-fg-ir-25-934FG-IR-25-934

Google Cloud (Mandiant)

TitlePublishedPage or sheet
How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trendsmandiant-tte-2023—
Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitationmandiant-ivanti-2025—

Google Threat Intelligence Group

TitlePublishedPage or sheet
Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysisdoors-gtig-2024—

Help Net Security

TitlePublishedPage or sheet
MITRE breached by nation-state threat actor via Ivanti zero-dayscase-mitre-helpnet—
Check Point VPN zero-day exploited since beginning of April (CVE-2024-24919)doors-helpnet-checkpoint—

JPCERT/CC

TitlePublishedPage or sheet
Fortinet 社製 FortiOS の SSL VPN 機能の脆弱性 (CVE-2018-13379) の影響を受けるホストに関する情報の公開についてdoors-jpcert-2020—
Fortinet製FortiOSの境域外書き込みの脆弱性（CVE-2024-21762）に関する注意喚起ch5-jpcert-at-2024-0004JPCERT-AT-2024-0004, IV. 回避策
JPCERT/CC Incident Handling Report: July 1, 2024 - September 30, 2024jpcert-ir-2024q2p.14
Ivanti Connect Secureなどにおける脆弱性（CVE-2025-0282）に関する注意喚起jpcert-at-2025-0001JPCERT-AT-2025-0001, updated 2025-02-13
Fortinet製品に関連する認証情報の漏えいに関する注意喚起ch5-jpcert-at-2026-0019JPCERT-AT-2026-0019

Kantsu Co., Ltd.

TitlePublishedPage or sheet
【第3報】当社におけるサイバー攻撃によるシステムの停止事案発生のお知らせcase-kantsu-3rd—

Mandiant (Google Cloud)

TitlePublishedPage or sheet
Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966)doors-mandiant-citrixbleed—
Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)doors-mandiant-22457—

Microsoft

TitlePublishedPage or sheet
Advanced security audit policy settingsms-audit-eventsper-event pages linked from this reference: 4624, 4625, 4672, 4720, 4728, 4732, 4798, 4799, 5140, 5145, 4663, 1102

Ministry of Land, Infrastructure, Transport and Tourism

TitlePublishedPage or sheet
コンテナターミナルにおける情報セキュリティ対策等検討委員会 中間取りまとめ① 名古屋港のコンテナターミナルにおけるシステム障害を踏まえ緊急に実施すべき対応策について（案）case-mlit-nutspp.1, 3–4, 7–8

MITRE

TitlePublishedPage or sheet
MITRE Concludes Its Internal Cyber-Attack Investigationcase-mitre-conclusion—
Enterprise Techniquesmitre-attack—

MIVD and AIVD (Netherlands), published by NCSC-NL

TitlePublishedPage or sheet
Ministry of Defence of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RATdoors-mivd-coathangerp.1, p.2 §3.1; p.1 (Wayback Machine capture of the NCSC-NL PDF of 2024-02-06; ncsc.nl no longer serves it)

Nagoya Harbor Transportation Association

TitlePublishedPage or sheet
NUTS システム障害の経緯報告case-nuts-associationpp.1–2

National Police Agency

TitlePublishedPage or sheet
令和４年におけるサイバー空間をめぐる脅威の情勢等についてnpa-r4p.5 図表6
令和５年におけるサイバー空間をめぐる脅威の情勢等についてnpa-r5pp.25–26 図表25
令和６年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）npa-r6-datasheet 資料編P46(3)
サイバー攻撃の被害に係る企業・団体を対象としたアンケート調査結果及び対策npa-leaflet-r7p.1
令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）npa-r7-datasheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138
Threats in Cyberspace in 2025 And Police Effortsnpa-r7-enpp.14–16
令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）npa-r8h1-datasheets 統計編p139, p143, p148, p153

NCSC (Netherlands)

TitlePublishedPage or sheet
Casus: Citrix kwetsbaarheiddoors-ncsc-nl-citrix—

NCSC (UK)

TitlePublishedPage or sheet
Making forensic observability the norm for network devicesdoors-ncsc-uk-observability—

NetScaler (Cloud Software Group)

TitlePublishedPage or sheet
CVE-2023-4966: Critical security update now available for NetScaler ADC and NetScaler Gatewaych5-netscaler-4966—

Osaka General Medical Center investigation committee

TitlePublishedPage or sheet
大阪急性期・総合医療センター 情報セキュリティインシデント調査報告書 概要case-ogmc-summarypp.1–3

Osaka General Medical Center, Information Security Incident Investigation Committee

TitlePublishedPage or sheet
調査報告書osaka-report-2023pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71

Palo Alto Networks

TitlePublishedPage or sheet
CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectch5-paloalto-3400—

Ryomo Systems

TitlePublishedPage or sheet
当社社内システムへの不正アクセスに関するお知らせ（第3報）case-ryomo-3rdWayback Machine 2026-10-16

ScanNetSecurity

TitlePublishedPage or sheet
両毛システムズにランサムウェア攻撃case-ryomo-scan—

Seidensha Electronics

TitlePublishedPage or sheet
サイバー攻撃に関するお知らせcase-sedeco-2026-07-21—

SoftBank Corp. business blog

TitlePublishedPage or sheet
サイバー攻撃の教訓～関通 情シスが語る、全て捨てて挑んだ再構築。防御から復旧へ～case-kantsu-softbank—

Software ISAC, Okayama Psychiatric Medical Center investigation committee

TitlePublishedPage or sheet
ランサムウェア事案調査報告書case-opmc-reportpp.12–13, 16–17, 20–21, 30–31

SonicWall

TitlePublishedPage or sheet
Gen 7 and newer SonicWall Firewalls – SSLVPN Recent Threat Activitydoors-sonicwall-2025—

Sophos

TitlePublishedPage or sheet
It takes two: The 2025 Sophos Active Adversary Reportsophos-aar-20252024 case data
Nowhere, man: The 2026 Active Adversary Reportsophos-aar-20262025 case data

TechCrunch

TitlePublishedPage or sheet
Boeing confirms ‘cyber incident’ after ransomware gang claims data theftcase-boeing-techcrunch—

Tenable

TitlePublishedPage or sheet
CVE-2025-5777, CVE-2025-6543: Frequently Asked Questions About CitrixBleed 2 and Citrix NetScaler Exploitationdoors-tenable-citrixbleed2—

Tsurugi Town Handa Hospital, expert panel on the computer virus incident

TitlePublishedPage or sheet
徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書handa-report-mainprinted pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38
徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編handa-report-techprinted pp.9–11, 14–15; pp.10–14

UK National Cyber Security Centre

TitlePublishedPage or sheet
Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliancesch5-ncsc-forensics-specSecure logging actions; Volatile data collection

US Senate Committee on Homeland Security and Governmental Affairs

TitlePublishedPage or sheet
Testimony of Joseph Blount, President and Chief Executive Officer Colonial Pipeline Companycase-colonial-testimony—

Verizon

TitlePublishedPage or sheet
2025 Data Breach Investigations Report: Executive Summarydbir-2025p.6
2026 Data Breach Investigations Report: Executive Summarydbir-2026p.9

Volexity

TitlePublishedPage or sheet
Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPNdoors-volexity-ivanti-2024—
Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)doors-volexity-3400—
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Daysdoors-volexity-ivanti-2026—

watchTowr Labs

TitlePublishedPage or sheet
Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)doors-watchtowr-3055—

YCC Information System

TitlePublishedPage or sheet
【重要】ランサムウェア攻撃に関するお知らせ（第五報）case-ycc-5th—

Revision history

Revisions
Rev.PublishedChange
5Text cut to the facts on every page (no announcements, figure-building notes or advice outside the what-to-do page); page titles name what each page answers; the report number and per-section scale tags removed.
4CVSS scores of the 2026-numbered rows checked against NVD; CVE-2026-15409 now shows 10.0 (CISA-ADP), and score sources corrected for four rows.
3Corrections after a full read against the sources: Kantsu reclassified to its own wording 'connection point with external networks' (9 VPN, 5 undisclosed, 1 other); case facts, hedges and attributions fixed across chapters 1 to 4 and 6; Ryomo now cites its own third report.
2Home summary scoped to cases with a known entry route; Nagoya port reclassified as 'device type not disclosed' per the association's own wording; one source entry per document; source titles and dates checked against the documents.
1First publication

Type a product, a CVE ID, a case or a term.