Cisco VPN Credentials Become Lucrative Commodity for Ransomware Operators

VPN credentials have become a lucrative commodity for ransomware operators, who can purchase them from initial access brokers. According to recent data, remote access credentials appear in 53% of listings on criminal access marketplaces.

The most common target is Cisco AnyConnect, which has a large market share and numerous exposed endpoints on the public internet. Attackers use credential stuffing, which involves testing billions of username/password pairs from historical breaches against VPN login portals. Another tactic is password spraying, where attackers try a single common password across thousands of accounts.

Microsoft's Digital Defense Report 2025 found that remote access credentials are frequently used by ransomware groups to gain access to corporate networks. The report noted that stolen VPN credentials can often provide immediate access to the network without multi-factor authentication (MFA).

To mitigate this risk, organizations can implement MFA for Cisco AnyConnect via RADIUS. This involves configuring a second authentication factor at the authentication layer, which cannot be bypassed by attackers. A RADIUS proxy can validate passwords against Active Directory or another LDAP directory and prompt users for a second factor.