How Ransomware Lands in 2026
Executive summary
Ransomware is the final move of an intrusion, not the first. By the time files are encrypted, an attacker has usually already logged in with access that was exposed or purchased, moved through the network, stolen data, and disabled the victim’s ability to recover. The encryption is the moment the victim notices. The decisions that made it possible happened earlier, sometimes days earlier and sometimes seconds earlier, at the point of initial access and at the handoff between the actor who obtains access and the actor who monetizes it.
This paper reconstructs one well-documented 2025 campaign in which the Akira ransomware group reached encryption through SonicWall SSL VPN devices, then draws the transferable lesson. The pattern it exposes is consistent across the current incident-response record from Palo Alto Networks Unit 42, Mandiant, and Cisco Talos: the attacker’s window has compressed to minutes and seconds, and defender leverage now sits at access and exposure rather than at the payload. AKATI operates detection and response for organizations in exactly this position, which is why this paper is candid about which controls actually shorten the attacker’s window and which mostly reassure the people who buy them.
How a patched firewall still accepted a valid login
A firewall that had already been patched still accepted a legitimate login, and that is where the intrusion began. Through the second half of 2025, incident responders at Arctic Wolf, Rapid7, and others traced a wave of Akira ransomware intrusions to a single class of entry point: SonicWall SSL VPN appliances. According to CISA’s #StopRansomware advisory on Akira, updated on 13 November 2025, the actors most often gained their foothold by abusing CVE-2024-40766, an improper access control flaw in SonicWall’s SonicOS, or by logging in with valid VPN credentials they already held. CISA had added CVE-2024-40766 to its Known Exploited Vulnerabilities catalog in September 2024, a full year before this surge, which tells you the vulnerability was neither novel nor unknown when it was used.
The detail that matters most is why patching did not end the exposure. As Rapid7 and SonicWall documented, many affected organizations had upgraded their firewalls from older to newer hardware and carried local user passwords across during the migration without resetting them. The patch closed the software flaw. It did not invalidate the credentials that had already been exposed while the flaw was open. Arctic Wolf observed intrusions in which attackers logged in successfully even against accounts protected by one-time-password MFA, using credentials that were valid because no one had rotated them. The door was locked. The key had already been copied.
From that login to encryption
Once inside, the operation moved at a tempo that left little room for human response. Arctic Wolf reported that successful VPN logins were followed within minutes by network scanning and by Impacket-based SMB activity, the reconnaissance and lateral-movement toolkit that lets an intruder map a network and reach adjacent systems. From there the documented Akira chain is consistent: local account compromise, privilege escalation, credential extraction from memory, and identification of the systems that hold the data worth stealing.
Two moves near the end of the chain define the modern extortion decision. First, the attackers exfiltrated data, giving them leverage independent of any encryption. Second, and this is the step that separates a survivable incident from a crisis, they moved against the victim’s ability to recover. CISA’s advisory documents Akira targeting backup infrastructure and, in at least one 2025 case, encrypting Nutanix AHV virtualization systems, extending the damage beyond the Windows estate into the platforms organizations rely on to rebuild. Only after recovery was compromised did encryption follow. By then the ransom note was not the start of the negotiation. It was the attacker’s summary of leverage already acquired: the data is gone, the backups are gone, and here is the number.
CISA assessed the campaign as an imminent threat to critical infrastructure, and reported Akira had claimed roughly $244 million in proceeds by late September 2025.
Where the chain was actually breakable
Reconstruction is only useful if it shows where the outcome could have changed. In this campaign the breakable moments were not where most buyers look.
The patch was necessary and insufficient. Applying the SonicWall fix closed the vulnerability but did nothing about credentials already exposed, so the control that mattered was credential rotation, not the update alone. Organizations that reset every VPN and local firewall account after patching removed the attacker’s key. Organizations that only patched left it in the lock.
MFA held less than its presence suggested. Because some logins succeeded against OTP-protected accounts using valid credentials, the mere presence of MFA overstated the protection it gave. The form of the factor and the integrity of the underlying account together decide whether it holds. Phishing-resistant factors and enforced re-registration after any exposure are the difference between MFA as a control and MFA as a checkbox.
The quiet reconnaissance was the last cheap warning. The minutes of scanning and Impacket SMB traffic between login and lateral movement were detectable. They are also the kind of low-severity signal a stretched team deprioritizes. Detecting and acting on that low-impact activity, rather than waiting for the high-severity ransomware alert, is where a defender still has time to act.
The backups were a control-plane decision made long before the incident. Whether Akira could destroy recovery depended on choices made months earlier: whether backups were isolated from the production domain, whether they were immutable, and whether the virtualization platform was treated as a crown-jewel asset. None of that can be bought in the hour after the first alert.
Why the window is now measured in minutes and seconds
The Akira campaign is not an outlier in its speed. It is representative of a measured compression across the incident-response record.
Palo Alto Networks Unit 42, in its 2026 Global Incident Response Report drawn from more than 750 investigations, found that the fastest quarter of intrusions reached data exfiltration in 72 minutes in 2025, down from 285 minutes the year before. The same report attributes 65 percent of initial access to identity-based techniques such as credential misuse and social engineering, against 22 percent from vulnerability exploitation, placing identity rather than the exploit at the center of how attackers arrive.
The fastest quarter of intrusions reached exfiltration in 72 minutes in 2025, down from 285 the year before. Access now changes hands in a median of 22 seconds.
Mandiant’s M-Trends 2026 measures a different part of the chain and finds the same acceleration. The median time between an initial-access actor gaining entry and handing off to a secondary group fell from more than eight hours in 2022 to 22 seconds in 2025. That figure needs a precise reading: it marks the point at which the secondary group gains access under Mandiant’s division-of-labor model, not the moment hands-on-keyboard activity begins. Read correctly, it still describes an industrialized pipeline in which access is passed on, often through pre-staged malware, faster than a SOC can triage the first alert.
The operational consequence is uncomfortable but clear. If exfiltration can complete in the length of a coffee break and access changes hands in the time it takes to read this sentence, detection and response that begins at the encryption event is answering a decision the attacker made hours ago.
The argument that misleads defenders
Ask three of the most authoritative incident-response teams which initial access vector led in 2025 and 2026, and they give three different answers. The disagreement is real, and it is instructive.
Source comparison / Ransomware initial access
Three reports, three “top” vectors
Leading incident-response teams name different leading initial access vectors for 2025 and 2026. Open each row to see the figures, and how each still resolves to the same two doorways.
| Source | What it names as the leading 2025–26 initial access |
|---|---|
| Phishing first at over a third of engagements; valid accounts second at 24%; public-facing application exploitation down to 18%, from a 62% peak during the ToolShell SharePoint wave. | |
|
Phishing: over a third (top)
Valid accounts: 24%
Public-facing apps: 18% (from 62% peak)
How it resolvesPhishing and valid accounts both end in an authenticated login. The SharePoint servers behind the earlier 62% were exposed, internet-facing systems. Every path lands on access that was obtained or exposed. Basis: Cisco Talos incident-response engagements. |
|
| Exploits first for the sixth consecutive year at 32%; voice phishing second at 11%. | |
|
Exploits: 32% (top, 6th year)
Voice phishing: 11%
Broker handoff: 22s median
How it resolvesExploits target exposed edge and public-facing systems; voice phishing hands over valid credentials. Access is then passed to a ransomware crew in a median of 22 seconds. Basis: Mandiant global consulting investigations, 2025. |
|
| Identity-based techniques 65%; vulnerability exploitation 22%. | |
|
Identity-based: 65%
Vulnerabilities: 22%
Fastest quartile to exfiltration: 72 min
How it resolvesTwo-thirds of initial access is identity: credentials misused, phished, or socially engineered. The rest is exposed, unpatched systems. The same two doorways. Basis: more than 750 Unit 42 incident-response investigations. |
|
The convergence
The doorway differs by report. The destination does not.
Access that was exposed, an internet-facing system left reachable, or obtained, a credential phished, sprayed, or bought. That is where a defender still has leverage, not at the encryption event.
These are not contradictions to be settled by picking a winner. They measure different caseloads, Talos its incident-response engagements, Mandiant its global consulting work, Unit 42 its own investigations, and they are surfaced here for exactly that reason. Treated as a single question, they mislead. Treated as three views of the same object, they converge.
Every one of these rankings ends in the same place: an attacker operating with access that was either exposed, an internet-facing device left reachable and unpatched, or obtained, a credential phished, sprayed, or bought. Phishing, valid accounts, and vulnerability exploitation are three doorways into one room. The productive question is not which doorway ranked highest last quarter. It is how much exposed and purchasable access an organization is leaving available, and how quickly it can act once someone walks through.
Initial access as a market
The word bought is literal. An initial access broker is a criminal specialist who compromises organizations and sells that access rather than monetizing it directly. A broker might obtain a foothold through an exposed VPN, as in the Akira campaign, then hand or sell it to a ransomware crew that specializes in the rest. This division of labor is what Mandiant’s 22-second figure captures at its extreme: the access and the encryption are increasingly performed by different hands, coordinated closely enough that the transition is nearly instant. It also explains why no security product closes the problem on its own. A tool can detect an exploit or a malicious login. It cannot tell you which of your organization’s credentials are already for sale.
Why encryption is no longer the whole threat
Double extortion is the practice of stealing data before encrypting it, so the attacker can demand payment both to restore systems and to suppress publication of the stolen data. The Akira chain shows why this matters for defense: exfiltration happened before encryption, which means an organization able to restore from clean backups still faced a data-exposure demand. When attackers also destroy backups, as Akira did, the two forms of leverage combine. Encryption has become one instrument of pressure among several, which is why measuring a ransomware program only by backup-and-restore readiness understates the exposure.
What defenders actually control
The reconstruction points to a short list of things a defender genuinely controls, and a shorter list of things that reliably shorten the attacker’s window.
Reduce exposed access.
Every internet-facing service is a potential doorway. Knowing which VPNs, firewalls, and applications are reachable from outside, keeping them patched, and rotating the credentials tied to them after any exposure removes the most common footholds before a broker can use them. In the Akira campaign this single discipline, credential rotation after patching, would have closed the intrusion at the door.
Govern purchasable access.
Credentials that are phished, reused, or sold cannot be patched away. The controls that help are phishing-resistant MFA, aggressive deprovisioning of dormant and legacy accounts, and monitoring for logins from infrastructure an organization would never legitimately use. These are identity and exposure-governance measures, and they are the only category that addresses the bought-credential problem at all.
Compress your own window.
Because the attacker’s timeline is now measured in minutes, the deciding factor is how fast a defender sees and acts on the quiet early activity, the scan, the unexpected login, the first lateral movement, rather than the loud late activity. This is the specific value of managed detection and response, and it is worth being honest about its limits: continuous monitoring shortens the interval between foothold and containment, but it does not prevent the foothold. A service that promises to stop ransomware is describing an outcome it cannot guarantee. A service that promises to detect and contain intrusions faster than they can reach encryption is describing what detection and response actually does.
Protect the ability to recover as a design choice.
Isolated, immutable backups and hardened virtualization platforms are decided in advance, not during an incident. They do not stop an intrusion. They decide whether it becomes a negotiation.
The through-line is that ransomware is governed most effectively before it is ransomware. The encryption event is loud, late, and largely beyond a defender’s influence by the time it arrives. The access chain that precedes it is quieter, earlier, and full of points where an exposed door could have been closed or a copied key invalidated. That is where the leverage is, and that is where the work belongs.
Sources
1. Cybersecurity and Infrastructure Security Agency (CISA), FBI and partners, “#StopRansomware: Akira Ransomware (AA24-109A),” updated 13 November 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
2. CISA, “Known Exploited Vulnerabilities Catalog” (entry for CVE-2024-40766, SonicWall SonicOS improper access control), added September 2024. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
3. Arctic Wolf Labs, “Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN.” https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/
4. Rapid7, “Akira Ransomware Group Utilizing SonicWall Devices for Initial Access.” https://www.rapid7.com/blog/post/dr-akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/
5. Palo Alto Networks Unit 42, “2026 Unit 42 Global Incident Response Report.” https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report
6. Mandiant / Google Cloud, “M-Trends 2026: Data, Insights, and Strategies From the Frontlines.” https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
7. Cisco Talos, “IR Trends Q1 2026: Phishing reemerges as top initial access vector.” https://blog.talosintelligence.com/ir-trends-q1-2026/
Disclaimer
This white paper is provided by AKATI Sekurity for general information and educational purposes only. It summarizes third-party incident-response findings and public advisories current at the time of writing and does not constitute legal, regulatory, or professional security advice, nor a guarantee of protection against any specific threat. Threat activity, vendor advisories, and vulnerability status change over time; readers should verify the referenced sources directly and assess controls against their own environment. References to specific vendors, products, threat groups, or incidents are for illustration and do not imply endorsement or attribution beyond what the cited sources state. AKATI Sekurity accepts no liability for actions taken or not taken on the basis of this material.
How ransomware lands in 2026
Frequently asked questions
Ransomware usually gets in through one of three doorways: an exposed internet-facing device or application, a stolen or reused credential, or a phishing message that harvests one. In most 2025 and 2026 intrusions the attacker does not break in so much as log in, using access that was either left reachable and unpatched or obtained in advance. The ransomware itself is deployed only after the attacker is already inside and has moved through the network.
The most common initial access vectors in 2026 are phishing, valid or stolen accounts, and exploitation of public-facing applications and edge devices. Leading incident-response teams rank them differently: Cisco Talos placed phishing first in early 2026 with valid accounts second, while Mandiant placed exploits first for the sixth year running. The disagreement matters less than the shared conclusion, that identity-based access, whether phished, reused, or bought, now drives the majority of intrusions.
Ransomware now moves in minutes to hours rather than days. Palo Alto Networks Unit 42 found that the fastest quarter of 2025 intrusions reached data exfiltration in 72 minutes, down from 285 minutes a year earlier. In the 2025 Akira campaign against SonicWall devices, network scanning and lateral movement began within minutes of the initial login, leaving defenders little time to respond once the intrusion was underway.
An initial access broker is a cybercriminal who specializes in breaking into organizations and selling that access to others, rather than carrying out the attack themselves. Ransomware groups buy this access to skip the intrusion step and move straight to extortion. Mandiant found that the handoff between an access broker and the follow-on group fell to a median of 22 seconds in 2025, reflecting how closely the two now coordinate.
Double extortion is a ransomware tactic in which attackers steal data before encrypting it, then demand payment both to restore the systems and to prevent the stolen data from being published. It means an organization with reliable backups can still face a ransom demand over the exfiltrated data. Attackers increasingly reinforce this by destroying backups during the intrusion, so that recovery and data suppression both require negotiation.
AKATI Sekurity / Insights
