90% Of Ransomware Attacks Are Exploiting Firewalls: How Attackers Hide Among Routine IT Changes
ET Insights, Tuesday, February 24th, 2026
The modern ransomware attack no longer begins with a dramatic breach. It begins quietly with a login that looks routine, a firewall rule that appears legitimate, or a user added to a privileged group during what seems like everyday IT maintenance.
According to the February 2026 Managed XDR Global Threat Report by Barracuda Networks, 90% of ransomware incidents in 2025 exploited firewalls either through a known CVE vulnerability or a compromised account. That single statistic should unsettle every CIO and CISO. The very device meant to be the first line of defense has become one of the most reliable entry points.