Newsletters
Risk Central
Digital EditionSmall Businesses Fear Cyber Threats as Ransomware Risks Surge
Ransomware attacks continue to pose an existential threat to organizations, particularly small and medium-sized businesses (SMBs), with cybersecurity concerns being a top threat for 60% of SMB owners while only 23% feel very prepared, according to Coalition’s Cyber Threat Index 2025.
The report — which offers insights into the ransomware landscape based on data from digital forensics, internet-wide scanning, and cyber insurance claims — noted that the first two months of 2024 underscored the scale of the cybersecurity challenge.
A series of zero-day vulnerabilities in Ivanti devices enabled both financially motivated criminals and nation-state actors to exploit businesses across various industries. Researchers who first discovered the flaws reported the victims ranged “from small businesses to some of the largest organizations in the world.”
Weeks later, the ransomware attack on Change Healthcare, which processes payments and health information, upended thousands of health care organizations of all sizes. The widespread event forced Change Healthcare’s parent company to issue $2 billion in advance payments and prompted a congressional hearing.
Scale of the Problem
The Coalition report reveals that the majority of ransomware claims started with threat actors compromising perimeter security appliances (58%) or remote desktop software (18%). These perimeter security appliances include products from vendors such as Fortinet, Cisco, SonicWall, and Palo Alto Networks, which typically offer both VPN and firewall functionality.
Remote desktop software was the second-most commonly exploited technology. The Remote Desktop Protocol (RDP), developed and maintained by Microsoft, was compromised in almost 80% of the incidents in this category, according to the report.
Across all ransomware claims, the most common initial access vectors were stolen credentials (47%) and software exploits (29%), the report noted. Compromised credentials typically targeted RDP and VPNs, which provide threat actors with privileged access to internal systems and networks. Investigators observed brute-force password guessing in just under half (42%) of these incidents.
Software exploits typically take advantage of a vulnerable system, ranging in complexity from simple commands that exploit a single vulnerability to advanced espionage software that chains together multiple vulnerabilities, Coalition reported. Social engineering was the third-most common initial access vector, typically involving email to communicate with victims.
Exposed Login Interfaces
Coalition detected more than 5 million internet-exposed remote management solutions and tens of thousands of exposed login panels across the internet. More than 65% of businesses had at least one internet-exposed web login panel at the time of applying for cyber insurance. These panels were identified by an AI system built by Coalition, trained to detect the visual patterns of web login panels.
The detected panels span email, VPN, finance, human resources, and more, according to the report. At least five web panels were detected on 15% of these submissions, and seven businesses were found to have at least 100 exposed web login panels, the report noted.
Software Vulnerabilities Explosion
Just over 40,000 software vulnerabilities were published in 2024, a 38% increase on 2023, according to Coalition. Threat actors were able to choose from over 3,000 new vulnerabilities every month, which helps explain why software exploits were the second-most frequent initial access vector in Coalition ransomware claims.
A dramatic spike in vulnerabilities in April and May—more than 5,000 vulnerabilities published in May alone—coincided with a breakdown in the system of classification. Most vulnerabilities were classified as “unknown severity,” rather than low, medium, high, or critical.
The report recommends that organizations monitor their attack surface to detect exposed login panels and services, patch emergent zero-day vulnerabilities in internet-facing technology, and educate employees about common social engineering tactics. Implementing 24/7 monitoring of systems and networks, with rapid response procedures, is also critical.
View the full report here. &
