What Ransomware Groups Look for Before They Pick a Victim

Ransomware attacks are rarely random.

Today's ransomware groups operate like businesses. Before launching an attack, they spend days—or even weeks—researching potential victims to determine who is both vulnerable and likely to pay.

Understanding how attackers evaluate targets can help organizations reduce their exposure and strengthen their defenses.

1. Internet-Exposed Systems

The first step for many ransomware groups is identifying systems that are accessible from the internet.

Common targets include:

• Remote Desktop Protocol (RDP)
• VPN gateways
• Firewalls and security appliances
• Remote management tools
• Web applications
• Public-facing APIs

Attackers continuously scan the internet for these services using automated tools. If a system is exposed and vulnerable—or protected by weak credentials—it may become an entry point.

How to reduce the risk:

• Remove unnecessary internet-facing services.
• Restrict remote access through VPNs or Zero Trust Network Access (ZTNA).
• Enable Multi-Factor Authentication (MFA).
• Keep internet-facing systems fully patched.

2. Weak Identity Security

Compromising user accounts is often easier than exploiting software vulnerabilities.

Attackers look for signs of poor identity management, including:

• Weak or reused passwords
• Accounts without MFA
• Dormant user accounts
• Shared administrative accounts
• Excessive user privileges

Once valid credentials are obtained, attackers can blend in with legitimate users, making detection more difficult.

How to reduce the risk:

• Enforce strong password policies.
• Require phishing-resistant MFA where possible.
• Remove unused accounts promptly.
• Apply the principle of least privilege.

3. Outdated or Unpatched Systems

Many ransomware attacks exploit vulnerabilities that have had security updates available for months—or even years.

Examples include:

• VPN appliances
• Microsoft Exchange Server
• VMware ESXi
• Network devices
• Public-facing web servers

Attackers prioritize organizations that delay patching because publicly available exploit code often exists.

How to reduce the risk:

• Maintain a comprehensive asset inventory.
• Prioritize patching based on risk.
• Regularly conduct vulnerability assessments.
• Monitor vendor security advisories.

4. Flat Networks

Once attackers gain initial access, they want to move freely across the environment.

In networks with little or no segmentation, compromising one system may provide access to:

• Domain Controllers
• File servers
• Backup infrastructure
• Database servers
• Production systems

This makes ransomware deployment significantly easier.

How to reduce the risk:

• Segment critical systems.
• Restrict lateral communication between network zones.
• Monitor east-west traffic.
• Limit administrative access.

5. Valuable Data

Modern ransomware groups rarely rely on encryption alone.

Before encrypting systems, they often steal sensitive information to increase pressure during negotiations—a tactic known as double extortion.

Data of particular interest includes:

• Customer records
• Financial information
• Intellectual property
• Healthcare data
• Employee records
• Legal documents

Organizations that handle high-value data are more attractive targets because the threat of public disclosure increases leverage.

How to reduce the risk:

• Classify sensitive data.
• Encrypt data at rest and in transit.
• Monitor for unusual data transfers.
• Implement Data Loss Prevention (DLP) controls where appropriate.

6. Weak Backup Strategies

Many organizations have backups—but not all backups are useful during a ransomware incident.

Attackers often attempt to locate and encrypt or delete backup repositories before deploying ransomware.

If backups are accessible from the production environment, they may be compromised as well.

How to reduce the risk:

• Maintain offline or immutable backups.
• Test restoration procedures regularly.
• Separate backup infrastructure from production systems.
• Limit administrative access to backup platforms.

7. Poor Security Visibility

Attackers prefer environments where they can operate without being detected.

They look for signs such as:

• Limited log collection
• No centralized monitoring
• Disabled endpoint security
• Infrequent security reviews
• Lack of incident response capabilities

The longer attackers remain undetected, the more opportunity they have to expand access and prepare for ransomware deployment.

How to reduce the risk:

• Deploy Endpoint Detection and Response (EDR).
• Centralize logs using a SIEM.
• Monitor authentication events and privileged account activity.
• Conduct regular threat hunting and incident response exercises.

8. Ability to Pay

Ransomware operators are financially motivated.

Before launching an attack, they often research:

• Company size
• Annual revenue
• Industry
• Geographic location
• Public financial reports
• Customer base
• Business-critical operations

Their objective is to identify organizations where operational disruption is likely to result in a ransom payment.

Common Misconceptions

Many organizations believe they are "too small" to attract ransomware groups.

In reality, attackers frequently target small and medium-sized businesses because they may have:

• Fewer dedicated security resources
• Less mature security controls
• Valuable customer data
• Greater pressure to restore operations quickly

Cybercriminals are generally looking for accessible opportunities, not just large enterprises.

Building a Less Attractive Target

While no organization can eliminate cyber risk entirely, the following practices significantly reduce exposure:

• Secure internet-facing services.
• Enforce Multi-Factor Authentication (MFA).
• Apply the principle of least privilege.
• Patch critical vulnerabilities promptly.
• Segment networks.
• Maintain tested offline or immutable backups.
• Deploy EDR and centralized logging.
• Conduct regular vulnerability assessments and penetration testing.
• Train employees to recognize phishing and social engineering.

Conclusion

Ransomware groups are strategic. They look for organizations that combine valuable assets with exploitable weaknesses.

The good news is that many of the controls that make an organization more resilient—strong identity security, timely patching, network segmentation, effective monitoring, and reliable backups—are well understood and achievable.

Reducing your attack surface doesn't guarantee immunity, but it can significantly increase the effort required for an attacker to succeed and improve your organization's ability to detect, contain, and recover from an incident.

Reduce your organization's attractiveness to attackers

Talk to our security engineers about vulnerability assessments and security posture reviews.

Get in Touch