Preventing VPN ransomware entry: controls, owners, deadlines

Summary

Every control works at one point on the intruder’s route. A patch does nothing against a flaw exploited before the fix existed, multi-factor authentication (MFA) nothing against a flaw reached before login. An offline backup undoes the encryption but not the leak.

Leadership decides three things: an owner for every internet-facing device, how many days a fix may take, and the budget for a backup the intruder cannot reach. Fig. 6-5 lets you switch each control on and see where the route stops.

What leadership decides

Exploitation of a published flaw starts within days; measured fixes take a month or more. Leadership sets the patch deadline. Name an owner, and provide a standby unit or HA pair so a reboot does not wait for sign-off.

Fig. 6-1Days from disclosure: when exploitation starts, the CISA deadline, and how long fixes take

Source: CISA BOD 26-04: Prioritizing Security Updates Based on RiskGoogle Cloud (Mandiant) How Low Can You Go? An Analysis of 2023 Time-to-Exploit TrendsVerizon 2025 Data Breach Investigations Report: Executive Summary (p.6)Verizon 2026 Data Breach Investigations Report: Executive Summary (p.9)

Data

Measure	Days	Source
CISA’s shortest remediation tier for US federal agencies	3	CISA BOD 26-04 (2026-06-10)
Average time from disclosure to exploitation, 2023	5	Mandiant, time-to-exploit analysis
Median time to remediate edge-device vulnerabilities	32	Verizon 2025 DBIR, Executive Summary p.6
Median time to fully resolve CISA KEV vulnerabilities	43	Verizon 2026 DBIR, Executive Summary p.9

CISA’s three-day tier comes with a forensic triage of the device to check whether it was already compromised. Put the deadline and the compromise check in the same rule.

Decision	Why	Owner
Name an owner for every internet-facing device, including remote-maintenance appliances vendors install.	At Osaka, who maintained and patched the catering vendor’s VPN appliance was unclear. At Handa, the vendors never passed on the VPN vulnerability notices.	CEO. Vendor contracts say who patches and who reports flaws.
Set a patch deadline in days for exploited flaws on internet-facing devices, with a compromise check.	CISA’s tightest tier is 3 days. The measured median for edge devices is 32 days. NPA found 52% of Japanese organizations using VPN appliances had not applied the latest patch.	Leadership sets it; the IT team reports against it.
Fund MFA for all remote access.	39.8% of Japanese organizations authenticate remote access with an ID and password alone (NPA). CISA reports Akira entering through VPNs that had no MFA.	Leadership funds; the IT team rolls out.
Replace edge devices that are out of support, on a funded schedule.	A device past end of support gets no more fixes. The Osaka entry device had never been updated and was still on firmware 5.4.2.	Leadership, as a capital budget line.
Fund a backup the intruder cannot reach, and regular restore tests.	In 2025, 79 of 99 victims that tried to restore from backup could not. In 48 cases the backups were encrypted too.	Leadership funds; the IT team tests.
Sign an incident-response retainer in advance, and keep logs long enough to investigate.	At both hospitals, a maintenance vendor upgraded the firmware before the VPN logs were preserved, and the logs were lost.	Leadership.
Plan the move away from network-wide VPN access. The replacement is internet-facing software too.	CVE-2025-0282, a pre-auth flaw in Ivanti Connect Secure, also affected Ivanti Neurons for ZTA gateways.	Leadership, with the IT lead.

Fig. 6-2Decisions for leadership, with the reason for each and who owns it

Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院コンピュータウイルス感染事案有識者会議調査報告書技術編」 (printed pp.9–11, 14–15; pp.10–14)CISA BOD 26-04: Prioritizing Security Updates Based on RiskVerizon 2025 Data Breach Investigations Report: Executive Summary (p.6)National Police Agency 「サイバー攻撃の被害に係る企業・団体を対象としたアンケート調査結果及び対策」 (p.1)CISA, FBI and partners #StopRansomware: Akira Ransomware (AA24-109A)CISA, FBI and NCSC-UK Reducing the Attack Surface for End-of-Support Edge Devices (p.1; pp.1–2)National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院コンピュータウイルス感染事案有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)CVE Program CVE-2025-0282 (Description)

With zero-trust network access (ZTNA) products a stolen password reaches one application instead of the whole network. They still answer the internet, and get CVEs and patches like any VPN.

What the IT team does

Most of these items cost staff time more than money.

Task	Why	Owner
Keep a list of every internet-facing device: model, firmware version, end-of-support date, owner, maintaining vendor.	Osaka had no asset inventory. CISA, FBI and NCSC ask for one covering edge devices and their support timelines.	IT team. Vendors supply the data for their devices.
Check the CISA KEV catalog and vendor advisories every working day; patch to the deadline.	KEV lists flaws already used in attacks. In NPA’s data for 2022 to 2025, the entry device was missing patches in 203 of 344 cases.	IT team.
After any flaw in the VPN appliance, change every password it held and end all sessions, even if it is patched.	JPCERT/CC handled intrusions into patched SSL-VPN appliances with credentials stolen before the patch.	IT team. Vendors reset their own accounts.
MFA on every VPN account. Delete unused accounts, contractors’ included.	CISA’s Akira advisory names VPN access without MFA as an entry point.	IT team.
Separate admin accounts for administrators; a different local administrator password on every server.	At Osaka, one built-in Administrator password shared across servers made lateral movement easy.	IT team.
One backup copy offline or immutable, under separate credentials; test a restore.	Osaka’s critical-care backups were online only and could not be used. Offline tapes restored the rest. At Handa, offline backups up to 2018 survived; later data was recovered by the forensics vendor.	IT team.
Before touching a suspect device, export its logs and configuration.	At both hospitals, the firmware upgrade erased the VPN logs.	IT team, with the vendor.

Fig. 6-3Work for the IT team, with the reason for each and who owns it

Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)CISA, FBI and NCSC-UK Reducing the Attack Surface for End-of-Support Edge Devices (p.1; pp.1–2)CISA Known Exploited Vulnerabilities Catalog (catalogVersion 2026.10.23; VPN/remote-access entries of the chapter 3 door schedule, bug class from NVD CWE and vendor advisories)National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)JPCERT/CC JPCERT/CC Incident Handling Report: July 1, 2024 - September 30, 2024 (p.14)CISA, FBI and partners #StopRansomware: Akira Ransomware (AA24-109A)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院コンピュータウイルス感染事案有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)

In the remaining cases the device was patched and the intruder still got in. NPA’s data does not say how. JPCERT/CC documents one way: a password copied before the patch.

Technical detail

What engineers check

Check	Component and identifier	Evidence
The management interface is not reachable from the internet. The portal is limited by source address where the use case allows.	Management plane; CCCS ITSM.80.101	CCCS: management interfaces “should not be directly exposed to the Internet.” Handa’s appliance accepted any address.
After a VPN KEV: preserve, then upgrade from a clean image or factory reset. Reset local users, admin accounts, the LDAP/AD bind account, RADIUS secrets, certificates and API tokens. Revoke sessions.	Credential store, session cache; AA24-060B	Fortinet: a symbolic link kept read-only file access after the fix. Mandiant: SPAWNANT persists across Ivanti upgrades. CISA: assume stored credentials are compromised.
Phishing-resistant MFA for admin access. One-time codes alone are not enough.	Authentication backend; T1078 Valid Accounts	Arctic Wolf saw OTP-protected SonicWall accounts logged into during the 2025 Akira campaign.
VPN users and vendors land in a restricted zone. No always-on RDP from vendor networks.	Address pool and firewall policy; T1021.001 Remote Desktop Protocol	At Osaka, always-on RDP from the vendor’s server was the way in. The report found it was not needed.
Logs go off the appliance to a SIEM; admin logons and configuration changes raise alerts.	syslog forwarding; CCCS ITSM.80.101	CCCS: “Enable centralized (off-device) logging” and alert on successful administrative log-ons and configuration changes.
Check integrity from outside as well as with the on-box tool.	Integrity Checker Tool (Ivanti); running-config baseline	CISA found Ivanti’s internal and earlier external integrity checks missed the compromise.
Backup server credentials separate from the domain; alerts on backup deletion.	Backup service accounts; T1490 Inhibit System Recovery	Arctic Wolf describes Akira reading Veeam Backup & Replication credentials before encrypting.
A ZTNA gateway gets the same patch deadline and log checks as the VPN.	CVE-2025-0282, Ivanti Neurons for ZTA gateways before 22.7R2.3	The same pre-auth flaw as Connect Secure. JPCERT/CC confirmed exploitation in Japan from late December 2024, before publication.

Fig. 6-4Checks for engineers, with the component, the identifier and the evidence

Source: Canadian Centre for Cyber Security Security considerations for edge devices (ITSM.80.101) (ITSM.80.101)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院コンピュータウイルス感染事案有識者会議調査報告書技術編」 (printed pp.9–11, 14–15; pp.10–14)Fortinet PSIRT Analysis of Threat Actor ActivityCISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)Google Cloud (Mandiant) Ivanti Connect Secure VPN Targeted in New Zero-Day ExploitationArctic Wolf Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or LessOsaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)MITRE Enterprise TechniquesCVE Program CVE-2025-0282 (Description)JPCERT/CC 「Ivanti Connect Secureなどにおける脆弱性（CVE-2025-0282）に関する注意喚起」 (JPCERT-AT-2025-0001, updated 2025-02-13)

After a VPN KEV: preserve, then patch or rebuild, then reset credentials, then hunt behind the device. Patching first destroys the logs that show whether a reset and a hunt are needed.

Each control stops the route at one point

On the plan from chapter 2, choose how the intruder gets in, then switch on controls.

The scenarios are fixed. The stolen password belongs to a VPN account nobody uses any more. The pre-auth flaw is first exploited on day 5 after the fix is published, close to Mandiant’s 2023 average. The zero-day is exploited before any fix exists, as JPCERT/CC reported for CVE-2025-0282 in Japan.

Source: Google Cloud (Mandiant) How Low Can You Go? An Analysis of 2023 Time-to-Exploit TrendsJPCERT/CC 「Ivanti Connect Secureなどにおける脆弱性（CVE-2025-0282）に関する注意喚起」 (JPCERT-AT-2025-0001, updated 2025-02-13)

What each control did

No controls are on. The route runs to the end.

What still happens

Entry: Gets in
Master keys (AD): Taken
Backups: Wiped
Data leak: Everything reachable leaves
Encryption: Company-wide, no way back

Link to this combination

Fig. 6-5Close the door: Minato Precision head office, intruder route with controlsComposite scenario, fictional companyNTS (not to scale)

Source: JPCERT/CC JPCERT/CC Incident Handling Report: July 1, 2024 - September 30, 2024 (p.14)Arctic Wolf Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or LessGoogle Cloud (Mandiant) How Low Can You Go? An Analysis of 2023 Time-to-Exploit TrendsJPCERT/CC 「Ivanti Connect Secureなどにおける脆弱性（CVE-2025-0282）に関する注意喚起」 (JPCERT-AT-2025-0001, updated 2025-02-13)

Data

Control	Stops the route at	Does not stop
Patch within 3, 14 or 60 days	① the door, only if the patch lands before exploitation starts	A zero-day; a password stolen before the patch
MFA on the VPN	① the door, for a stolen password	A pre-auth flaw; a stolen session token
Remove unused accounts	① the door, when the stolen password belongs to an unused account	Any exploit; a password of an account in use
Tiered admin accounts	③ the key safe: the master keys stay in it	Entry; the leak of files the first account can read
Offline or immutable backup	④ the backups: they survive, so recovery is possible	Entry; the leak (double extortion still works)

With every control on and the zero-day chosen, the intruder still gets in, and data the first account can read still leaves.