RDP and VPN Remain Top Ransomware Attack Pathways

**Executive summary:** Analysis of Black Basta chat logs and related reporting shows the group leveraged nearly 3,000 unique credentials to infiltrate corporate networks via exposed VPN and remote-desktop/web-access portals (e.g., Microsoft RD Web, Palo Alto GlobalProtect, Cisco VPN), enabling data theft and ransomware deployment; the report highlights widespread exposed login panels, common ransomware TTPs (credential spraying, MFA bypass, lateral movement, supply-chain exploitation such as Kaseya), and recommends securing remote access, enforcing MFA, timely patching, and continuous monitoring.