--- title: Ransomware Attack Vectors: 5 Endpoint Blind Spots description: Security teams are walked through five endpoint blind spots that ransomware actors exploit before detonation: abused remote-access tools (WinSCP, AnyDesk,... canonical: https://daily.dev/posts/ransomware-attack-vectors-5-endpoint-blind-spots-plmyjumdm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ransomware Attack Vectors: 5 Endpoint Blind Spots | daily.dev og:description: Security teams are walked through five endpoint blind spots that ransomware actors exploit before detonation: abused remote-access tools (WinSCP, AnyDesk,... og:url: https://daily.dev/posts/ransomware-attack-vectors-5-endpoint-blind-spots-plmyjumdm og:image: https://api.daily.dev/og/posts/plmYjUMDm.png og:image:alt: Ransomware Attack Vectors: 5 Endpoint Blind Spots og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ransomware Attack Vectors: 5 Endpoint Blind Spots **[Cyble](https://daily.dev/sources/cyble)** · 6 min read · 0 upvotes · 0 comments ## Summary Security teams are walked through five endpoint blind spots that ransomware actors exploit before detonation: abused remote-access tools (WinSCP, AnyDesk, ScreenConnect used by Qilin affiliates), credential harvesting via tools like Mimikatz and NirSoft plus BYOVD techniques, vendor/supply-chain trust abuse (island hopping), under-patched OT/ICS environments, and targeted phishing against business email accounts. It cites Cyble data showing 57 new ransomware groups and 27 new extortion groups identified in 2025, over 350 new ransomware strains, an 86% rise in global ransomware incidents between January and April 2025, and Cl0P accounting for 28% of activity in that period. The piece closes with recommendations (MFA, network segmentation, EDR, least privilege) and promotes Cyble Titan endpoint security product with Blaze-AI. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What remote access tools have ransomware groups like Qilin abused for lateral movement? Qilin affiliates have abused legitimate remote-access and file-transfer tools including WinSCP, AnyDesk, and ScreenConnect to move laterally inside compromised networks. Because these are legitimate administration tools, attackers using stolen valid credentials can blend into normal IT activity without deploying obvious malware, making detection harder for security teams relying on antivirus alone. _daily.dev surfaces security research like this for teams tightening remote-access monitoring against ransomware._ ### How much did global ransomware incidents increase in early 2025 and which group was most active? Global ransomware incidents rose 86% between January and April 2025, with the Cl0P group accounting for 28% of that activity, according to Cyble. Cyble also identified 57 new ransomware groups, 27 new extortion groups, and more than 350 new ransomware strains across 2025. _Track ransomware trend data like this on daily.dev to keep security roadmaps grounded in current activity._ ### What is BYOVD and why is it a concern for ransomware detection? BYOVD, or Bring Your Own Vulnerable Driver, is a technique where attackers load a legitimate but vulnerable signed driver onto a system to bypass security controls, including EDR and antivirus protections. Ransomware operators use it alongside credential-harvesting tools such as Mimikatz and NirSoft to escalate privileges while avoiding detection during the pre-execution phase. _daily.dev helps defenders stay current on evasion techniques like BYOVD used against endpoint protection._ ## Similar posts on daily.dev - [Ransomware groups switch to stealthy attacks and long-term access](https://daily.dev/posts/ransomware-groups-switch-to-stealthy-attacks-and-long-term-access-odq0idhho) · CSO Online · 0 upvotes · 0 comments - [Ransomware Groups Surge In Q4 2025 – Cyble Insights](https://daily.dev/posts/ransomware-groups-surge-in-q4-2025-cyble-insights-bekvw1yk1) · Cyble · 1 upvotes · 0 comments - [Reviewing the trends in ransomware attacks in 2026](https://daily.dev/posts/reviewing-the-trends-in-ransomware-attacks-in-2026-zduvsdh2i) · Securelist · 0 upvotes · 0 comments - [Cyber OpSec Fail: Beast Gang Exposes Ransomware Server](https://daily.dev/posts/cyber-opsec-fail-beast-gang-exposes-ransomware-server-asgud4ggr) · Dark Reading · 0 upvotes · 0 comments - [Every Ransomware Attack Has a Backstory](https://daily.dev/posts/every-ransomware-attack-has-a-backstory-bzo7w3b2j) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/ransomware-attack-vectors-5-endpoint-blind-spots-plmyjumdm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ransomware Attack Vectors: 5 Endpoint Blind Spots","url":"https://daily.dev/posts/ransomware-attack-vectors-5-endpoint-blind-spots-plmyjumdm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ransomware-attack-vectors-5-endpoint-blind-spots-plmyjumdm"},"datePublished":"2026-08-21T08:33:20.246Z","dateModified":"2026-08-21T08:33:47.153Z","description":"Security teams are walked through five endpoint blind spots that ransomware actors exploit before detonation: abused remote-access tools (WinSCP, AnyDesk,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9deed54d0ffb0b3cf8ac6e12f508c01e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9deed54d0ffb0b3cf8ac6e12f508c01e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cyble","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cyble","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/345d6009096c4c2da164d9d8e6ccfbe6","url":"https://daily.dev/sources/cyble"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ransomware-attack-vectors-5-endpoint-blind-spots-plmyjumdm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware,phishing","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cyble","item":"https://daily.dev/sources/cyble"},{"@type":"ListItem","position":3,"name":"Ransomware Attack Vectors: 5 Endpoint Blind Spots"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ransomware-attack-vectors-5-endpoint-blind-spots-plmyjumdm#faq","mainEntity":[{"@type":"Question","name":"What remote access tools have ransomware groups like Qilin abused for lateral movement?","acceptedAnswer":{"@type":"Answer","text":"Qilin affiliates have abused legitimate remote-access and file-transfer tools including WinSCP, AnyDesk, and ScreenConnect to move laterally inside compromised networks. Because these are legitimate administration tools, attackers using stolen valid credentials can blend into normal IT activity without deploying obvious malware, making detection harder for security teams relying on antivirus alone. daily.dev surfaces security research like this for teams tightening remote-access monitoring against ransomware."}},{"@type":"Question","name":"How much did global ransomware incidents increase in early 2025 and which group was most active?","acceptedAnswer":{"@type":"Answer","text":"Global ransomware incidents rose 86% between January and April 2025, with the Cl0P group accounting for 28% of that activity, according to Cyble. Cyble also identified 57 new ransomware groups, 27 new extortion groups, and more than 350 new ransomware strains across 2025. Track ransomware trend data like this on daily.dev to keep security roadmaps grounded in current activity."}},{"@type":"Question","name":"What is BYOVD and why is it a concern for ransomware detection?","acceptedAnswer":{"@type":"Answer","text":"BYOVD, or Bring Your Own Vulnerable Driver, is a technique where attackers load a legitimate but vulnerable signed driver onto a system to bypass security controls, including EDR and antivirus protections. Ransomware operators use it alongside credential-harvesting tools such as Mimikatz and NirSoft to escalate privileges while avoiding detection during the pre-execution phase. daily.dev helps defenders stay current on evasion techniques like BYOVD used against endpoint protection."}}]} ```