When analyzing recent major ransomware incidents both domestically and internationally, there are common features. Most of the attacks were initiated through known vulnerabilities. Attackers precisely targeted areas where 'basics' were not adhered to, such as VPN devices without proper security updates, exposed remote access services, and weak authentication frameworks. 

Companies are operating VPNs that are exposed to known vulnerabilities without patch updates. Since VPNs are gateways connecting the internal network from the outside, applying the latest security patches and continuous monitoring is essential. 

There are many cases where some administrator accounts within companies have unnecessary permissions. The administrator privileges of certain servers become a pathway to access other systems. The principle of least privilege needs to be reassessed.   

Operating backup servers in isolated environments is failing. In Active Directory (AD) environments, backup servers are often connected to the network in real-time, allowing attackers to access them. This makes it impossible for attackers to access the backup and prevent restoration. Backups should be managed in an independently isolated environment both physically and logically, but these foundational principles are not being followed. 

The operation of security monitoring services is insufficient. There are many instances where external log collection and monitoring systems in companies do not function properly. Even when attackers engage in multiple suspicious activities after initial penetration, they go undetected. This allows attackers to continue lateral movement within the company.