Ransomware, software that locks computers until victims pay, still breaks in through VPN services without MFA, weak remote access and phishing. Payments dropped even as claimed victims hit a record because fewer victims paid, so tested backups and phishing-resistant MFA beat paying.
The FBI reports in the FBI annual Internet Crime Report 859,532 complaints in 2024 with losses over $16 billion, up 33% from 2023. Those losses hit businesses, governments and individuals. Entry points explain how those cases start.
Table of Contents
- How do attackers first get in?
- Who gets hurt and how badly?
- Why did payments fall while victims rose?
- Should you pay, and what works instead?
How do attackers first get in?
CISA reports in CISA joint advisory AA24-109A that Akira actors entered through VPN services without MFA. They used Cisco flaws CVE-2020-3259 and CVE-2023-20269, plus RDP, spearphishing and valid credentials. One missing MFA check can open remote access.
CISA warns that exposed RDP on port 3389 with weak or compromised credentials is a common ransomware entry. MFA adds an effective extra layer against stolen passwords. Closing open RDP and enforcing MFA shrinks that opening.
Who gets hurt and how badly?
CISA and the FBI report that North Korean Maui ransomware targeted Healthcare and Public Health. It encrypted servers handling health and electronic records. Attackers ran it manually from the command line.
Hospitals and clinics feel that loss directly in daily work. Locked record systems delay care decisions and force manual workarounds. Public health offices face the same pressure at larger scale.
Why did payments fall while victims rose?
Chainalysis reported about $813.55 million in on-chain ransomware payments in 2024. That was down about 35% from 2023's record $1.25 billion. The drop came despite more attacks and a $75 million Dark Angels outlier.
Chainalysis found in the Chainalysis 2026 Crypto Crime Report claimed victims rose about 50% in 2025 to the most active year on record. On-chain payments still fell about 8% to $820 million. Fewer victims paid.
Should you pay, and what works instead?
The FBI, CISA and Treasury strongly discourage paying ransoms in the CISA and FBI Maui advisory. Payment does not guarantee recovery and can invite more targeting. It can fund illicit activity and create sanctions exposure.
Chainalysis totals are observed on-chain payments that grow as new wallets are attributed, so early figures undercount. CISA therefore urges offline encrypted backups with tested restoration and phishing-resistant MFA. Practical cover looks like this: One tested restore proves more than any payment promise. Keep that backup offline and check MFA on every remote login.
- Keep offline encrypted backups apart from the main network.
- Test restoration on a schedule, not during an incident.
- Require phishing-resistant MFA on VPN and remote access.
You Might Also Like
- Cybersecurity — SEC Cyber Disclosure Security Review: Entry Point, Impact, and Lessons
- Teen Ransomware Suspect Allegedly Led Gang Behind Hundreds of Attacks
- Ransomware Negotiation Response Checklist: Passwords, Accounts, and Credit