Summary

In 2025, 92 answers to the National Police Agency (NPA) survey of ransomware victims named how the intruder got in. 61 named the VPN appliance, 19 remote desktop and 2 suspicious email.

Over 2021–2025, 293 of 485 cases came through VPN appliances and 24 through email. In 59.0% of the cases where NPA asked, the device used to get in was missing security patches.

92 answers named a route

Every number on this page comes from one question in NPA’s survey of ransomware victims: the route the intruder used to get in (感染経路). NPA counts only answers that named a route; “unknown” and blank answers are left out.

In 2025 NPA received 226 ransomware reports, and 92 answers named a route. The shares on this page are shares of those 92.

Fig. 1-12025 ransomware reports, one square per report. Dark squares: the answers that named an intrusion route

Source: National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)

Data

2025	Reports	%
Survey answer named a route	92	40.7
No route named	134	59.3
Ransomware reports	226	100.0

Each answer names one route, and the four counts add up to 92. NPA gives labels but no definitions. This site names them as follows:

NPA label (as printed)	Name on this site	Opening on the plan
VPN機器	VPN appliance	VPN door
リモートデスクトップ	Remote desktop	Window
その他	Other	Loading door
不審メールやその添付ファイル	Suspicious email or attachments	Main entrance

The label names the device. A VPN answer covers a leaked password and an exploited flaw in the appliance alike. NPA’s English edition lists “unpatched vulnerabilities, leaked credentials, weak passwords, and misconfigurations” as the ways attackers get through.

Source: National Police Agency Threats in Cyberspace in 2025 And Police Efforts (pp.14–16)

The VPN door: 61 of 92

Fig. 1-2Minato Precision head office. The VPN door and its 61 cases; the other openings greyedComposite scenario, fictional companyNTS (not to scale)

Data

2025, cases by intrusion route
Route (opening on the plan)	Cases	%
VPN appliance (VPN door)	61	66.3
Remote desktop (window)	19	20.7
Other (loading door)	10	10.9
Suspicious email or attachments (main entrance)	2	2.2
Total (route named)	92	100.0

A VPN appliance lets staff, branch offices and maintenance contractors connect to the company network from outside. It sits at the internet edge, often as a function of the firewall.

Its login page answers anyone on the internet, and until someone logs in it cannot tell an employee from a stranger. A flaw in the code that runs before login can be used by anyone who finds the device.

On the plan it is a door in the outer wall that opens into the corridor behind reception. In 2025 it was the route in 61 of 92 cases (66.3%). Chapter 3 covers the products and their flaws.

The window: remote desktop, 19

Fig. 1-3Minato Precision head office. The remote desktop window and its 19 casesComposite scenario, fictional companyNTS (not to scale)

Data

2025, cases by intrusion route
Route (opening on the plan)	Cases	%
VPN appliance (VPN door)	61	66.3
Remote desktop (window)	19	20.7
Other (loading door)	10	10.9
Suspicious email or attachments (main entrance)	2	2.2
Total (route named)	92	100.0

Remote desktop lets a user work on another computer’s screen from a distance; on Windows it is the Remote Desktop Protocol (RDP). IT staff and maintenance contractors use it to manage servers.

It is meant for the internal network. It becomes reachable from the internet when a router forwards the connection straight to a server, for example so that a contractor can connect without a VPN. NPA’s 2023 report describes these cases as remote desktop services set up with weak credentials (「強度の弱い認証情報等が設定されたリモートデスクトップサービス」).

On the plan it is a window that opens straight into one room. In 2025 it was the route in 19 of 92 cases (20.7%). The highest year was 2024, with 31 of 100.

Source: National Police Agency 「令和５年におけるサイバー空間をめぐる脅威の情勢等について」 (pp.25–26 図表25)National Police Agency 「令和６年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheet 資料編P46(3))

Other routes: 10

Fig. 1-4Minato Precision head office. The loading door stands for all other routes: 10 casesComposite scenario, fictional companyNTS (not to scale)

Data

2025, cases by intrusion route
Route (opening on the plan)	Cases	%
VPN appliance (VPN door)	61	66.3
Remote desktop (window)	19	20.7
Other (loading door)	10	10.9
Suspicious email or attachments (main entrance)	2	2.2
Total (route named)	92	100.0

NPA’s table does not break down 「その他」. The plan draws it as a loading door, a third way through the outer wall, without saying what it is.

In 2025 other routes made up 10 of 92 cases (10.9%). Over five years they total 63 of 485, more than email in every year.

The main entrance: email, 2

Fig. 1-5Minato Precision head office. The main entrance, where email arrives: 2 casesComposite scenario, fictional companyNTS (not to scale)

Data

2025, cases by intrusion route
Route (opening on the plan)	Cases	%
VPN appliance (VPN door)	61	66.3
Remote desktop (window)	19	20.7
Other (loading door)	10	10.9
Suspicious email or attachments (main entrance)	2	2.2
Total (route named)	92	100.0

Anyone can send a message to a company address, so mail passes through filtering before it reaches staff, and the PCs it lands on run antivirus. On the plan, these checks are the reception desk at the main entrance.

NPA’s label is 「不審メールやその添付ファイル」, suspicious email or its attachments. In 2025 it was the route in 2 of 92 cases (2.2%).

Email was 24 of 485 cases in five years

Email was the smallest of the four routes in every year from 2021 to 2025.

Fig. 1-6Intrusion routes, 2021–2025 combined. One square per case

Source: National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)

Data

Route, 2021–2025	Cases	%
VPN appliance	293	60.4
Remote desktop	105	21.6
Other	63	13.0
Suspicious email or attachments	24	4.9
Total (route named)	485	100.0

VPN appliances and remote desktop together account for 398.

The table records the opening and not where a password came from. A password stolen with a phishing email and later used to log in to the VPN counts as VPN.

VPN has been the largest opening every year since 2021

Fig. 1-7VPN appliances as a share of known intrusion routes, by year. 2026 H1 is hatched: a half-year with 36 answers

Source: National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)National Police Agency 「令和４年におけるサイバー空間をめぐる脅威の情勢等について」 (p.5 図表6)National Police Agency 「令和５年におけるサイバー空間をめぐる脅威の情勢等について」 (pp.25–26 図表25)National Police Agency 「令和６年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheet 資料編P46(3))National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)

Data

Year	Answers	VPN	RDP	Other	Email	VPN %
2021	76	41	15	15	5	53.9
2022	102	63	19	11	9	61.8
2023	115	73	21	15	6	63.5
2024	100	55	31	12	2	55.0
2025	92	61	19	10	2	66.3
2026 H1	36	18	9	9	no row	50.0

The VPN share has moved between 53.9% (2021) and 66.3% (2025), the largest in every year. In 2024 the share dipped while remote desktop rose to 31 cases; their combined share still rose.

NPA’s 2026 first-half table has 36 answers and no row for email. VPN appliances account for 18 of them (50.0%). Half-years differ from full years: NPA’s leaflet gives 62.2% for the first half of 2025, against 66.3% for the whole year.

NPA recorded 123 ransomware reports in the first half of 2026, the highest half-year since the series began.

Source: National Police Agency 「サイバー攻撃の被害に係る企業・団体を対象としたアンケート調査結果及び対策」 (p.1)National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)

143 of 226 victims were SMEs

Fig. 1-82025 ransomware victims by organization size, one square per report

Data

Year	Large	SMEs	Other bodies	Reports	SME %
2022	63	121	46	230	52.6
2023	71	102	24	197	51.8
2024	61	140	21	222	63.1
2025	64	143	19	226	63.3
2026 H1	31	79	13	123	64.2

In 2025, 143 of the 226 reported victims (63.3%) were small and medium-sized enterprises. The SME share was about half in 2022 and 2023 and has been above 63% since 2024.

Minato Precision, the fictional company on the plans, has 280 staff, one head office and one factory, and stands for this group. NPA does not cross the route count with company size, so this page cannot say whether SMEs are entered through the VPN more often than large companies.

Source: National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)

203 of 344 entry devices were missing patches

Fig. 1-9Devices used as the intrusion route that had security patches not yet applied, by year

Source: National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)

Data

Year	Answers	Patches missing	Fully patched	Missing %
2022	100	65	35	65.0
2023	86	52	34	60.5
2024	87	46	41	52.9
2025	71	40	31	56.3
2022–2025	344	203	141	59.0
2026 H1	29	17	12	58.6

NPA also asks whether the device used to get in had its security patches applied (「侵入経路とされる機器のセキュリティパッチの適用状況」). From 2022 to 2025, 203 of 344 answers (59.0%) said patches were missing. NPA does not split this by route.

The other 141 devices (41.0%) were fully patched. JPCERT/CC reports SSL-VPN cases where credentials stolen while the device was vulnerable still worked after the patch was applied.

Source: JPCERT/CC JPCERT/CC Incident Handling Report: July 1, 2024 - September 30, 2024 (p.14)

VPN and remote desktop combined

Fig. 1-10VPN appliances and remote desktop combined, as a share of known intrusion routes

Source: National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)

Data

Year	Answers	VPN	RDP	VPN + RDP	%
2021	76	41	15	56	73.7
2022	102	63	19	82	80.4
2023	115	73	21	94	81.7
2024	100	55	31	86	86.0
2025	92	61	19	80	87.0

In 2025 the two together account for 80 of 92 cases (87.0%), up every year from 73.7% in 2021. NPA’s 2022 report groups them the same way, as intrusions that used flaws in devices for remote work or weak credentials (「テレワーク等に利用される機器等のぜい弱性や強度の弱い認証情報等を利用して侵入したと考えられるもの」), 81% of that year’s cases.

Both exist so that people outside can work on the inside, and both accept connections from the internet before they know who is connecting.

Source: National Police Agency 「令和４年におけるサイバー空間をめぐる脅威の情勢等について」 (p.5 図表6)

Technical detail

Outside Japan, edge devices became a main target

Verizon’s Data Breach Investigations Report (DBIR) counts breaches worldwide. Its dataset and categories differ from NPA’s, so the percentages cannot be compared.

Measure	DBIR 2025	DBIR 2026
Exploitation of vulnerabilities as the initial access vector	20%	31%, “now the most common initial access vector”
Edge devices and VPNs among exploitation targets	22%, up from 3% in the previous report	Not in the executive summary
Remediation	Edge-device vulnerabilities: about 54% fully remediated, median 32 days	CISA KEV vulnerabilities: 26% fully remediated, median 43 days to full resolution

Fig. 1-11Verizon DBIR executive summaries, 2025 and 2026 editions

Source: Verizon 2025 Data Breach Investigations Report: Executive Summary (p.6)Verizon 2026 Data Breach Investigations Report: Executive Summary (p.9)

In the 2025 edition, edge devices and VPNs rose from 3% to 22% of the targets of vulnerability exploitation. In the 2026 edition, exploitation passed credential abuse as the most common way breaches started (31%). Of the flaws in CISA’s Known Exploited Vulnerabilities catalog, which lists flaws already used in attacks, 26% were fully remediated in 2025.

What the NPA tables can answer

The 61 VPN answers for 2025 mix at least two techniques that ATT&CK keeps apart: logging in with valid credentials through an external remote service (T1133, T1078), and exploiting a flaw in the internet-facing appliance (T1190). Multi-factor authentication (MFA) stops a reused password but is never reached by a flaw that works before login.

Question	Answered by the NPA tables?
Which opening was used	Yes. Four categories, one per answer (R7 workbook `統計編P124`).
Stolen password or exploited flaw	No. One VPN category covers both.
Which product, vendor or firmware version	No.
Whether the device was missing patches	Separately (`統計編p153`), for the route device in general. A missing patch does not show that the missing patch was the flaw used.
What 「その他」 contains	No.
Cases where the route was unknown	Excluded. 2025 has 92 named routes against 226 reports.

JPCERT/CC’s incident handling report for July to September 2024 describes SSL-VPN intrusions where CVE-2023-27997 and CVE-2024-21762 “are presumed to be among the exploited vulnerabilities”, and where “the attacker used credentials they had stolen before the fix was applied”. In NPA’s table, such a case is one VPN answer on a patched device. JPCERT/CC advises checking for signs of intrusion before updating the firmware and, if intrusion cannot be ruled out, considering a change of the passwords of the accounts in use.

Source: JPCERT/CC JPCERT/CC Incident Handling Report: July 1, 2024 - September 30, 2024 (p.14)National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)