VPN devices were the way in for 18 of 36 ransomware attacks

Statistics released by Japan's National Police Agency in September 2026 show 123 reported ransomware cases in the first half of 2026 (Reiwa 8), not counting 9 "no-ware ransom" cases. That is the highest half-year total since the agency started keeping records in the second half of 2020. About 60% of victims were small and medium-sized businesses, and manufacturing made up about 30% of cases by industry.

Of the 36 organizations that reported how attackers got in, 18 were breached through VPN devices. This first installment of the series "How data leaks happen, and how to defend against it now" covers those VPN and perimeter devices. The first half uses figures and cases to show what happened. The second half sets out what to do today and how to check specific products.

Half of intrusions came through VPN devices, few through email

In the National Police Agency's survey of victim organizations (36 valid responses), the intrusion routes were VPN devices in 18 cases, remote desktop in 9 and other routes in 9. Figure 1 shows the breakdown.

This is not a one-off result for a single half-year. Across the five years from 2021 to 2025 (485 valid responses), VPN devices accounted for 293 cases, remote desktop for 105, suspicious emails or their attachments for 24, and other routes for 63.

As Figure 2 shows, VPN devices account for 60% of entry points even over five years, while suspicious email accounts for only 24 of 485 cases. The statistics suggest that locking down internet-facing devices works better than telling staff not to open email attachments.

Attackers break into organizations' networks by exploiting unpatched vulnerabilities, leaked credentials and the like.

National Police Agency, "Threats in Cyberspace in the First Half of 2026 (Reiwa 8)"

According to the National Police Agency, once inside, attackers try to gain administrator privileges and disable security tools. They then search the network for data and backups, steal the data and only then encrypt it. About 60% of organizations spent 10 million yen or more in total on recovery, and just under half recovered in less than a month.

What attackers did: two cases in Japan, two overseas

Ryomo Systems: a VPN account was abused

Ryomo Systems runs systems under contract for local governments and companies. According to its third report (September 25, 2026), an outside third party broke into its internal network on August 12, 2026. On August 14, the company's internal uptime monitoring detected an anomaly and the network was cut off. An investigation by an outside specialist confirmed a ransomware attack.

An outside third party abused an account on a network connection device (VPN) and broke into the internal network

Ryomo Systems, "Third report"

Sales and transaction information may have leaked, along with personal information on business partners' customers, businesses that made inquiries, individual customers and employees. The damage spread to the company's clients. According to reports, Daito Gas (past files that included about 124,000 customer records) and Isesaki City (account information for 3,789 students) are among those that have disclosed an impact.

The company has not said how the account was obtained (whether it was stolen or the device was at fault), or whether multi-factor authentication was in use.

FortiBleed: login credentials in an attacker's database

In an alert (JPCERT-AT-2026-0019) on June 23, 2026, JPCERT/CC addressed reports (from SOCRadar) that a database run by attackers holds login credentials for more than 86,644 FortiGate and other Fortinet devices in 194 countries. JPCERT/CC has confirmed that the data includes information linked to Japanese companies.

Fortinet's position is that the main cause is reuse of information obtained in past compromises, not a new vulnerability. Researchers, however, have pointed out that some of the credentials may still be valid.

Configuration files contain administrator password hashes, so if one has been stolen, the passwords can be cracked without ever touching the device. Cases have also been confirmed in which attackers went through a compromised FortiGate to steal and crack credentials for internal Windows domain authentication (Kerberos and NTLM). Fixing the VPN device is not enough on its own; Active Directory needs to be checked too.

Ivanti Connect Secure: CVE-2026-104935

On October 13, 2026, the U.S. agency CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Affected versions are 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. The same attacker has reportedly used two other flaws as well, one of which, a privilege escalation to root, had no fix at the time of the reports.

CISA says Ivanti's Integrity Checker Tool may fail to find traces of the attack because the attacker's commands run in memory.

may not detect evidence of exploitation of CVE-2026-104935

CISA alert on Ivanti Connect Secure (October 13, 2026)

Palo Alto Networks PAN-OS: CVE-2026-0322

On October 14, 2026, Palo Alto Networks disclosed a flaw in the PAN-OS management interface (CVSS 4.0 score of 8.6, exploitation confirmed). An authenticated attacker who can reach the management interface can run code as root on the firewall. PA-Series, VM-Series and Panorama are affected; Cloud NGFW and Prisma Access are not. There is no workaround.

What to do today, for every organization (30 minutes to half a day)

Figure 4 is a checklist of the six items in this section plus one backup item covered later. Print it out and cross items off as you finish them.

1. List your internet-facing devices

• Scope: VPN appliances, firewalls, remote desktop and devices used for remote maintenance.
• What to record: vendor, model and firmware version. Without the version, the next step's check is impossible.
• If a systems integrator (SIer) handles maintenance, ask them for a list of models and versions. Many organizations do not keep track of this themselves.

2. Check the list against KEV and JPCERT/CC alerts

• Check whether your models and versions appear in CISA's KEV catalog (known exploited vulnerabilities) or in JPCERT/CC alerts.
• KEV lists only vulnerabilities that have actually been used in attacks. If any of your devices match, updating them comes first.
• As of this article, Ivanti Connect Secure's CVE-2026-104935 is in KEV, and the FortiGate issue is covered by a JPCERT/CC alert.

3. Hide management interfaces from the internet

• The PAN-OS flaw can only be exploited by someone who can reach the management interface.
• Allow connections to the management interface only from specific internal IPs or a single jump host.
• Treat the VPN entry point for users and the device's management interface as two separate things, and check the exposure settings for the management interface on their own.

4. Audit VPN accounts

• In the Ryomo Systems case, a VPN account was abused.
• Disable accounts that are no longer needed: former employees, staff who have changed roles, contractors and test accounts.
• Disable accounts with no logins for 90 days. Re-enable them for anyone who still needs access once they ask.

5. Add multi-factor authentication to VPN logins

• A password-only VPN lets anyone with leaked credentials, like those in FortiBleed, walk straight in.
• Make no exceptions for contractor or maintenance vendor accounts.

6. Do not expose remote desktop directly to the internet

• Remote desktop is the second most common intrusion route: 9 of 36 cases in the first half, and 105 of 485 over the past five years.
• If the list from step 1 shows remote desktop exposed directly to the internet, shut that exposure down.

Product-specific checks: FortiGate, Ivanti and Palo Alto

Organizations using FortiGate

Work through the checks in the JPCERT/CC alert in order.

• In the management interface, filter "System > Events > Messages" by "Config" to review the configuration export history. Check both administrator accounts and REST API accounts.
• Check for administrator accounts you did not create. Examples include "forticloud", "fortiuser", "fortinet-support" and "fortinet-tech-support".
• Compare the current configuration with a known-good configuration.
• Use the Hudson Rock and SOCRadar lookups to see whether information about your devices has leaked. If an SIer registered the devices for you, they may not show up under your own domain.
• Upgrade FortiOS to a version that supports PBKDF2, and enforce PBKDF2 following Fortinet's instructions.
• If the FortiGate is configured with an account for AD/LDAP integration, review domain controller logs to see whether that account has been misused in your internal AD.
• If you run always-on site-to-site IPsec VPNs, also check the state of the device at the other end. Even if your own device is clean, a compromised device on the other side could affect you.

JPCERT/CC explains why changing the password alone is not enough.

Note that even if the administrator password is reset, by default the old SHA256 hash remains in old-password, so if a configuration file was obtained in the past, the risk remains that the plaintext could be recovered through offline cracking.

JPCERT/CC alert "JPCERT-AT-2026-0019"

Organizations using Ivanti Connect Secure

• If you run 25.1.1.1 or earlier, 25.1.2.2 or earlier, or 22.8R2.4 or earlier, update to the latest version following Ivanti's notice.
• Do not treat a clean result from the Integrity Checker Tool as proof that you have not been compromised. Determining whether a compromise occurred requires network and memory forensics.
• The root privilege escalation flaw had no fix at the time of the reports, so keep following Ivanti's notices even after updating.

If you suspect a compromise, rebuild the device using the steps CISA recommends:

• Back up the configuration.
• Factory-reset the device and install the latest version. For virtual appliances, rebuild them.
• Restore the configuration.
• Reset the passwords of all domain, administrator and local accounts.
• Revoke and reissue stored certificates.
• Reset API keys and license server credentials.

Organizations using Palo Alto firewalls

• PA-Series, VM-Series and Panorama are affected. Cloud NGFW and Prisma Access are not.
• Upgrade to the fixed version for your release line. For 12.2, that is 12.2.4. For 12.1, 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2. For 11.2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16. For 11.1 and 10.2, check the table in the advisory for each line's hotfix.
• There is no workaround. If you cannot upgrade right away, first restrict access to the management interface to trusted internal IPs or a single jump host. The company also recommends this as a way to reduce risk.
• Check management interface access logs for connections from the IPs the company's advisory lists as used in exploitation attempts (66.42.72.14 / 208.83.239.114 / 149.248.47.234).

Limiting the damage once attackers are in

Even after you close the entry points, attackers may already be inside. Figure 3 shows how organizations answered when the National Police Agency asked whether they could restore from backups.

Only 11 of 40 valid responses said they could restore. The other 29, more than 70%, could not. Over the past five years (2021 to 2025), the figure was just 120 of 547. Attackers look for backups first and destroy them.

• Keep backups somewhere the internal network cannot modify: a separate account, a separate provider or an immutable setting.
• Test that restores work. At least once a year, actually restore one machine from backup.
• If a VPN device may have been compromised, do not stop the investigation at the device. As the FortiGate case shows, domain authentication credentials may have been stolen, so check domain controller logs as well.
• After rebuilding a device, rotate any credentials stored on it (account passwords, certificates and API keys). The steps CISA set out for the Ivanti case also work as a checklist for other products.

Sources

• National Police Agency, "Threats in Cyberspace in the First Half of 2026 (Reiwa 8)"
• JPCERT/CC alert JPCERT-AT-2026-0019 (June 23, 2026)
• Ryomo Systems, third report (September 25, 2026)
• CISA alert: exploited vulnerability in Ivanti Connect Secure (October 13, 2026)
• Palo Alto Networks security advisory CVE-2026-0322 (October 14, 2026)