Remote Access Infra Remains Riskiest Corp. Attack Surface

Analysis of Black Basta chat logs and industry data shows ransomware actors leveraging nearly 3,000 unique credentials to target Internet-exposed remote-access services (RDP, VPNs, remote login portals) as primary initial access vectors; Coalition's report finds many companies have publicly exposed login panels, with compromised credentials accounting for a large share of ransomware initial access, and recommends firmware patching, phishing-resistant MFA, and adoption of zero-trust architectures to mitigate risk.