Cybersecurity Market

Cybersecurity Technologies & Markets

Ransomware in Three Hours: What Barracuda’s 2025 XDR Data Reveals About the New Breach Reality

By Leave a Comment

The numbers coming out of Barracuda Networks, Inc. land with a thud, not because they are abstract or theoretical, but because they describe how quietly and quickly modern ransomware now works when it finds even the smallest opening. According to data released in the Barracuda Managed XDR Global Threat Report, a staggering 90 percent of ransomware incidents observed in 2025 began by exploiting firewalls, either through unpatched software vulnerabilities or through compromised and poorly managed accounts. That alone should unsettle anyone still thinking of firewalls as static perimeter walls rather than living systems that age, drift out of configuration, and quietly accumulate risk. Even more unsettling is the speed: the fastest ransomware incident Barracuda recorded took just three hours from initial breach to full encryption, using the Akira ransomware strain. Three hours is barely enough time for a human SOC analyst to notice something feels off, let alone investigate, escalate, and contain it.

What the report makes painfully clear is that attackers are no longer relying on exotic zero-day magic in most cases. Instead, they are winning by exploiting things that are technically mundane and operationally boring: a forgotten account that was never disabled after an employee left, a remote access tool that seemed harmless until it wasn’t, a dormant application still running an old encryption algorithm from a decade ago. Barracuda’s data shows that one in ten detected vulnerabilities already had a known exploit in the wild, which means attackers are not guessing; they are shopping from a catalog of proven techniques. One of the most widely detected flaws, CVE-2013-2566, dates back to 2013 and relates to outdated encryption still present in legacy servers, embedded devices, or aging applications quietly humming along in production. These are not headline-grabbing bugs, but they are effective, especially when nobody remembers they are there.

Once attackers gain a foothold, the report highlights a moment that should now be treated as a blaring siren rather than a subtle warning: lateral movement. In 96 percent of incidents where lateral movement was detected, the attack ultimately ended with ransomware deployment. That means the instant an attacker starts moving sideways across systems, probing permissions and hopping between endpoints, the clock is no longer ticking slowly; it is sprinting. Add to that the growing role of the supply chain, with 66 percent of incidents involving third parties or external software dependencies, up sharply from 45 percent in 2024, and the picture becomes one of attackers scaling access through trust relationships that organizations barely have visibility into. It is no longer just about defending what you own, but about defending what you depend on, often indirectly and invisibly.

Underlying all of this is a brutal asymmetry. As Merium Khalid, Director of SOC Offensive Security at Barracuda, points out, many organizations are defended not by a well-funded team, but by a single overstretched IT professional juggling identities, endpoints, cloud assets, firewalls, and alerts from fragmented tools. Attackers only need to find one overlooked weakness to succeed, while defenders need to get everything right, continuously. Barracuda’s dataset, drawn from more than two trillion IT events, nearly 600,000 security alerts, and over 300,000 protected assets during 2025, reinforces that this is not a niche problem affecting only unlucky victims. It is a systemic issue driven by speed, complexity, and the quiet accumulation of technical debt. The uncomfortable takeaway is simple: ransomware today is less about dramatic hacks and more about operational hygiene, and the window to react is no longer measured in days, but in hours, sometimes less.

Upcoming tech events:

Reader Interactions

Leave a Reply

Your email address will not be published. Required fields are marked *