Batten down the hatches - ransomware attacks are increasingly targeting firewalls, experts claim

• Firewalls are a common target for hackers, report claims
• Barracuda report finds 90% of all ransomware incidents in 2025 exploited firewalls
• Some flaws were more than a decade old, so patch now

If you can secure just one device on your network today - make sure it’s the firewall, as a new report from Barracuda claims almost all ransomware incidents start with a compromised firewall instance.

The Barracuda Managed XDR Global Threat Report is based on Barracuda Managed XDR’s 2025 dataset of more than two trillion IT events and some 600,000 security alerts.

The researchers found 90% of all ransomware incidents which took place in 2025 exploited firewalls through either a vulnerability, or a compromised account. One in every 10 detected vulnerabilities already had a known exploit, they added, meaning in many instances they were targeting “low-hanging fruit”.