Ransomware actors usually get in through a small number of routes. The joint CISA ransomware guide groups them as internet facing vulnerabilities and misconfigurations, phishing, compromised credentials, precursor malware infections, third parties and managed service providers, and advanced social engineering. Each route has a matching set of controls.
Where does this list come from?
The #StopRansomware Guide was produced by CISA, the Multi-State Information Sharing and Analysis Center, NSA and FBI through the Joint Ransomware Task Force. Part 1 offers prevention best practices, organized by common initial access vectors. Part 2 is a response checklist. Below, each vector is paired with a plain description and the practical controls.
1. Internet facing vulnerabilities and misconfigurations
Services reachable from the internet with known flaws or weak settings. The guide advises not to expose services such as remote desktop on the web, and if they must be exposed, to apply compensating controls. It also advises disabling unnecessary operating system applications and network protocols on internet facing assets and running regular vulnerability scanning.
Controls: an inventory of exposed services, fast patching for those, no direct remote desktop exposure, scanning on a schedule.
2. Phishing
Messages that lead users to open a malicious attachment, follow a link or enter credentials. The guide lists user awareness and training, and filtering as basics.
Controls: email filtering, attachment handling rules, reporting buttons, training that rehearses real scenarios.
3. Compromised credentials
Stolen or guessed credentials used to sign in as a legitimate user.
Controls: multi-factor authentication, preferably phishing resistant, for remote access and administrators. Blocking known compromised passwords. Restricting administrator accounts.
4. Precursor malware
Ransomware often arrives after a different infection has already given the attacker a foothold. Treat a commodity malware alert as a possible early warning of a bigger incident.
Controls: automatic updates, endpoint detection, and a rule that every malware alert on a server gets a person's eyes.
5. Third parties and managed service providers
The guide notes that MSPs have been an infection vector for ransomware affecting many client organizations, and advises considering the cyber hygiene of third parties you depend on.
Controls: inventory of providers with privileged access, least privilege for their accounts, MFA on their access, contract terms on incident notice.
6. Advanced social engineering
Phone calls and messages that persuade help desks or staff to reset credentials or approve access.
Controls: a firm identity verification procedure for resets, callbacks to known numbers, and no resets approved on the strength of a call alone.
A constructed walk through
A mid sized company reviews these six routes against its own environment. It finds a remote desktop service reachable from the internet, no MFA on the VPN, and a help desk that resets passwords after a call. Three fixes, each a few days of work: close the service, enrol the VPN in MFA, and require a callback procedure. None needs new products.
What happens once they are in?
Entry is only the first step. Actors usually explore, collect credentials, move to other systems and often steal data before encrypting. That gives defenders a window. Alerts on new administrator accounts, unusual use of remote tools, large outbound transfers and disabled security software are all places to catch the intrusion before encryption starts. Part 2 of the CISA guide is a response checklist to rehearse for that moment.
How to check or apply this
- Draw a table with the six routes down the side and your controls across.
- Mark each cell: in place, partial, missing.
- Fix missing items in the order of exposure: internet facing first, then credentials.
- Test backups. Keep offline or immutable copies and practice a restore.
- Write and rehearse the response steps from Part 2 of the guide.
- Review third parties with privileged access every quarter.
- Re-run the table whenever something significant changes.
Quick check
What is the most common way in?
It varies by period and dataset. Rather than guess, cover all six routes in the CISA list and prioritize by what your own review finds exposed.
Do backups stop ransomware?
They limit the damage from encryption if they are protected and tested. They do not stop data theft and extortion, so prevention still matters.
Sources
Last reviewed: 18 October 2026.
